Wireshark 101: User Datagram Protocol and Internet Control Message Protocol; Haktip 127 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this episode of hack tip is brought to
you by HipChat plus welcome to active
the show will we break down concepts
tools and techniques for hackers gurus
and IT ninjas I'm Shannon Morrison today
we are checking out Wireshark and UDP
and ICMP so first off UDP UDP stands for
user Datagram protocol this is another
layer for protocol commonly called a
connectionless protocol that is used on
lots of different modern networks to
make the transmission of data a whole
lot faster now the weird thing about UDP
is that it doesn't have a start
handshake and a cut-off session like you
would have with TCP for example since
UDP doesn't have the whole packet
handshake that TCP does you think that
it wouldn't work right of course that
would make sense but it actually helps
other protocols streamline data in a
much faster pace let me show you a UDP
packet I'm gonna pull one up real quick
in my Wireshark perfect I have one right
here so you'll notice that I actually
highlighted this in yellow so it was
much easier for me to find and it's
labeled UDP right there under protocols
so that's very easy to see and let me
just go down here to this Center window
I'll get that a little bit bigger for
you okay so down here we have user
Datagram protocol you'll see that little
bit right there it's a super super small
packet it only has four different parts
so first you have the source and the
destination ports right here so you'll
notice my source port is 3 3 2 3 3
destination is 5 9 3 to 9 so very easy
very obvious then you have the packet
link and the checksum so the source and
destination those are usually
self-explanatory just like in this one
the packet length is in bytes and the
checksum ensures that the data is intact
when it actually arrives so that's
pretty much it about UDP next we have
ICMP which is a little bit more
explanatory so this stands for Internet
control message protocol this protocol
works with tcp/ip and it tells you if a
device a service or a route is available
on a tcp/ip network ICMP packet headers
have a type a code a checksum and
variable the type is the type of ICMP
message based on RFC code the code is
the subclass of ICMP message also a part
of the RFC code and then checksum of
course make sure that the content is
intact and variable is a bit that
changes depending on the type and the
code now I found a really handy site
that I want you guys to check out it's
over at IANA org slash assignment slash
ICMP parameters dot XHTML I'll put that
in the show leaks for you as well down
here you can find a whole listing of all
the different codes and types that
you'll find
so this Ayana website shows you all the
known types and all the known codes that
you might run into when dealing with an
ICMP packet because you'll see these
codes and types in your header packets
for ICMP and Wireshark now if there is a
problem with the connection it may have
to do with this specific packet so this
will help you a lot ICMP is very
important using the type and the code
you can determine what went wrong and
wherever it might have happened now if I
go down here and I'll just choose type
three so say I saw Type three in my
Wireshark says destination unreachable
so I can click on that and I see a list
of codes down here 0 through 15 so for
example if it said code 1 that would
mean that the host whatever I was trying
to get to my destination stands for RFC
791 reachable there you go
bookmark that website very very easy to
use now I'm going to show you an example
of an ICMP header right after the break
I'd like to thank HipChat plus for
sponsoring this episode of hack tip they
allow you to do I am video chat document
sharing screen sharing system updates
and code sharing integrated all into one
simple platform
I've been trying HipChat plus over here
in our office to send code snippets back
and forth do quick video conferences and
more offer one platform
instead of like for HipChat integrates
into github bitbucket Zendesk and more
and it uses 256 bit ssl encryption you
can get your team on the same page in
seconds I want you to try HipChat plus
for free no credit card required visit
HipChat comm / hack tip sign up and then
click on start chatting then invite a
few of your team
and try it for free for 30-days remember
that's HipChat dot-com / hot tip and
sign up for the first 100 signups by the
way HipChat is going to extend their
30-day free trial to 90 days HipChat
your team your project in sync instantly
we are back with ICMP packet headers I
found a ton of them in my Wireshark
packet capture when I was doing a couple
of pings and trace routes so I wanted to
get into why ICMP exists for all the
different reasons so first off it's
great with the ping utility in the
command prompt for example if I go over
here to my CMD there we go
you'll notice that I just pained Google
8.8.8.8 when you do that you're gonna
see a whole bunch of ICMP echo and pain
requests and responses in Wireshark you
can also see what happens when you run
peeing and well check it over there so
I'm gonna go ahead and pull up my echo
and ping requests and replies in here so
these packets you'll notice they have a
couple of different things in here if I
go under ICMP under packet header I see
the code is zero and the type is also
zero my checksum identify our sequence
number and then the request frame if you
click on that it automatically takes you
to wherever the request frame exists
which is a pretty handy little feature
now on this one it says type 8 code 0 so
if I go over to my I Ana website and
that was code 0 oh wait it was type 8
right yeah type 8 excuse me type 8 code
0 alright so there's no code for that
one it's just an echo that's it we also
have this nice handy feature called
trace routing which ICMP is a part of
trace routing is when you ID the path
that some data takes from one device to
another it'll tell you how many routes
or routers that it's going to have to go
through to get to its destination so if
it has to go through 8th route urse
you'll see eight different router J's
destinations that it has to get through
to actually get to its destination if
that made sense now if you find an ICMP
packet that has a TTL value that is set
to one as opposed to anything else
it's time to live that means that it's
only had one travel or it's only had to
travel through one router to get
wherever its destination is now in a
traceroute the packet will return to the
original source with a type of 11 and a
code of zero this means that the
destination when it's unreachable due to
the TTL being exceeded during transit
and I believe we've mentioned that in
the past as well now I'm gonna go back
down here to my trace routing because I
also did a quick and simple little trace
route over to Google trace route 8.8.8.8
when you do this you see in real time
all the hops that you have to take to
get to your destination eventually we
get to Google servers and the trace ends
up being complete after eleven hops now
if I go over to a Wireshark
I see the same information over here
more descriptive so you see everything
from the pings the requests and any kind
of issues that you might have this data
is from the original echo requests
you'll see this pattern continued until
the destination host is reached by the
packets you'll see your echo ping echo
reply echo request and so on and so
forth now the route can also be seen in
command with trace RT and then whatever
your IP address is that you're trying to
get to in your destination now now that
we covered IP TCP UDP and ICMP you know
all the basic foundations that all
network communication runs on those are
the top four for that layer now let me
know what you think send me a comment
below or email us over at tips at hack 5
org and be sure to check out our sister
show hack 5 for more great stuff just
like this except sometimes harder I'll
be there reminding you to trust your
techni lest
maybe I'm from Long Island