Wireshark 101: Fixing Network Problems with Wireshark; HakTip 134 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this episode of hack tip is brought to
you by HipChat welcome to act tip the
show we break down concepts tools and
techniques for hackers gurus and IT
ninjas I'm Shannon Morse and today we
are checking out Wireshark in how to
tell if a site is down for you or for
everyone now obviously a really simple
and easy way to do this is just to visit
down for everyone calm or whatever that
site is called and just find out but if
you want to really get geeky here's how
to tell if a website is down via
Wireshark now this is a pretty common
problem and sometimes the issue can be
within your network or sometimes it can
be outside of the network if the website
is actually down if several people are
having the same issue it's either
because the website is down or your
network is actually messed up if all
those people are in your network now in
my case I want to visit threat wire.com
which I know is currently down each time
I tried to do this I'm sent back an
error on my browser that says the
website you're trying to visit is
currently unavailable what a lot and we
can know how irritating that can get now
if I try to find it in Wireshark it's
kind of tough to tell so what I did was
open my control my command prompt prompt
and I pinged threat wire comm it
automatically tells me what IP address
it resolves to and then it tries to send
several ping requests now if I do this
and I have done this before with
Wireshark on my tutorials in hack tip if
I do this while I have Wireshark up I'm
going to receive these four ICMP
protocol requests so they say echo ping
requests it's very very obvious to tell
once we get those four requests we can
then try searching for it in the browser
if I do that I get a bunch of
synchronized packets but no answers to
these you'll notice up here I also have
all these TCP protocol packets now those
happen whenever you search for it in the
browser and you end up getting that
error code I would get a bunch of
synchronized packets but no answer so it
keeps on trying to retransmit up to
three different times now you see a
whole bunch of
transmits down here as well so we have
the TCP protocol packet port 80
synchronized but when it can't
synchronize tries this TCP
retransmission and this is also TCP
protocol and it tries the same exact
thing you'll notice that these two I
believe it's these two match up with
this one and then below that we have a
second one that matches up with the
second to TCP tree transmissions the
third one matches up with these because
it's going to try three times and after
that it's going to basically come out
with an error if you take a closer look
at the info dialog the ping requests all
say no response found so that's kind of
interesting if we look all the way up
here all four of them say no response
found very very easy way to tell if
there's an error going on while you're
trying to visit the website while the
TCP packets just say retransmission now
if we look at other packets in this
can't in this capture for other sites
within my network we can prove that the
problem only occurs when trying to visit
this one site not the entire network so
we know that it's an issue with this
website not everything else now after
the break I'll detail a few other
problems that you might face whenever
dealing with issues trying to reconnect
to the Internet's and whatnot and what
to look for in Wireshark how is your
team communicating are they using a
variety of email I am texting cloud
storage and document sharing apps
HipChat puts everything in one place and
is designed specifically for businesses
this solution called HipChat is I am
video chat document sharing screen
sharing system up States code sharing
integrated into one simple platform
emails to slow meetings get sidetracked
and regular items just don't work well
for groups HipChat keeps your team in
sync and it works on any device no
matter where you are and the best part
HipChat is integrated with the top
developer tools like github which is my
favorite JIRA Zendesk and more in fact
there are 57 services that HipChat will
basically play nice with HipChat brings
your entire project in your team
communications together they're also
easy to set up fun to use and it makes
your team wildly productive I've been
using HipChat here in our offices to
send Darren
little code snippets for my stuff over
on hack five all that Arduino code super
simple to just send over to Darren via
my github account now there is a
freemium version which you can use for
free forever but for the next 30 days
you'll get the full version of HipChat
for free which includes the bonus
features of video and screen sharing you
can try a hip chat for free no credit
card required visit HipChat comm / hack
tips signup click on start chatting and
then invite a few team members and try
it for free for 30 days
remember that's hip chat calm / hot tip
and for the first 100 signups hip chat
is going to extend their 30 day free
trial offer to 90 days HipChat your team
your project in sync instantly we are
back with more disconnection failures
and sad times in Wireshark okay they're
not too sad if you can solve the problem
now we know how to see if a site is down
in Wireshark but what else can we figure
out because there's a lot that we can
probably figure out I've run into a
problem where I couldn't access the
internet but all of my co-workers could
for example this is a great one so we
used a single router and the IP
addresses all came from DHCP this
actually happened at the hack 5
warehouse now by using Wireshark I was
able to determine that the problem was
with DNS I was able to reach my router
and my computer had no problem
connecting to it but couldn't figure out
the DNS requests everyone else could log
on to the internet so I knew it must
have been a problem with my computer
itself we were able to find the problem
was because I had to manually set my
default gateway address instead of
letting it be DHCP assigned so I
switched it back and then da it worked
and I could totally hit Google and get
on my facebook now what if you can
access the net but you keep getting a
can't display web page we hate those
errors that shows up on your browser if
you are in a really small network such
as here in the hacker Wyatt warehouse or
wherever you might be and you pull up
Wireshark this would show you sending
the site a TCP packet but you would end
up getting an rst error or reset packet
error back to you now that packet
terminates the communication and after a
few seconds the browser gives you an
error if you are able to send a TCP
packet through your router to the
it but you have trouble sending a DNS
query it could be because the host file
for your device already has the DNS map
to that IP or because it's mapped in the
DNS cache so what you would do at this
point is check your computer's host file
for the easiest solution what which
would be the easiest solution and then
just remove the DNS mapping if it ends
up being there and it's incorrect by
checking Wireshark for these kind of
issues and understanding the packets you
can then fix all sorts of problems
faster for your network and for your
co-workers or for even just your friends
and family there are a ton of other
problems that can occur when trying to
establish a connection to the outside
world so read up on some of the examples
online and on the Wireshark website
because there's tons of they're really
really good examples of course let me
know what you think as well you can send
a comment below or you can email us tips
at hack 5 org and be sure to check out
our sister show hack 5 for more great
stuff just like this I'll be there
reminding you to trust your techno lest
one takes nubs