Wireshark 101: Feedback and Tips - HakTip 141 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

today on hack tip we are checking out
your feedback and tips for Wireshark
this episode of tech tip is brought to
you by Atlassian welcome to active the
show where we break down concepts tools
and techniques for hackers gurus and IT
ninjas I am Shannon Morrison today we
are checking out Wireshark with your
tips and feedback because you guys are
awesome and you send me amazing ideas so
it is our last episode about Wireshark I
know it was awesome thank you for
sticking around for so long and sorry
about the break so it is time to wrap up
the series with feedback from you guys
first off let's start with some email
sent over two tips at hack 5.4 the first
one is from even nestling who writes I
have a tip for how I've used Wireshark
in my job as a network admin we had a
problem with IP phones in our DHCP
server and ended up with address
conflicts because two phones would use
the same IP to solve this and identify
the phones
I used Wireshark and filtered on ARP
duplicate tack address tack detected
this will give you all the duplicate
addresses on your network and help me
solve my problem that's an awesome tip
thank you so much and you can find all
the other filters related to address
resolution protocol or ARP over at
Wireshark org slash Doc's / DF ref / a /
RP HTML and our next email comes from
Michael who writes at one of our branch
offices users we're having issues with
Internet connectivity sometimes okay
most of the times horrible after
verifying cabling and then settings on
the router in workstations I used
Wireshark to see what was going on bingo
I found a rogue wireless router that was
using its external IP address which was
on the office's internal network that
conflicted with the offices default
gateway the packet capture sessions
showed the ARP transactions between
different MAC addresses with the same IP
found the rogue router and cut the
ethernet cable leading to the area it
was located with it without a doubt it
fixed the issue so as you can see ARP
issues are pretty common I too have had
a few issues with them Wireshark makes
it very very easy
to figure out what the heck is wrong on
your network and solve an issue fairly
quickly so you can tell that a lot of
people use this as Network admins and an
IT and we also got a question from
Taylor he asks does adding client fqdn
as a column mean a way that read names
people offer out that's a good question
so let's find out so I didn't see it
call him available to add but I did find
a filter so you can run this filter
through and see what happens
dhcpv6 client underscore fqdn so it does
end up being green because it is a
correct filter when you run this filter
and you'll see I didn't receive anything
now when you run this you'll notice in
the packet header there is a new section
for fully qualified domain name under
DHCP version 6 now in the use case
scenario of my machine it'll most likely
end up being Shannon Windows 10 or
Shannon laptop a fully qualified domain
name or fqdn is the complete domain name
for a specific computer a host or
whatever it might be on the internet now
if we were scanning the hak5 server it
would probably end up being WWI ak5 org
the fqdn is the full host which was
would be the WW and the domain name of
hak5 org now you can find more info on
that available on the RFC 4704 dock now
let's go ahead and take a quick break
and we'll be right back after a word
from our sponsor from genome mapping to
renewable energy to space exploration or
just blading your next team off-site
behind every great human achievement
there is a team so this big question is
how do you bring everybody together to
build what's next the solution with
Atlassian unleash your team's potential
with Atlassian's collaboration software
so you can work and communicate better
together
you can assign track and manage tasks
for any project no matter how complex
that's the clarity of JIRA you can
create and share content you can
organize results and bring team members
up to speed with the flexibility of
confluence and you can instant message
or video chat with your team from n
device with the freedom of HipChat or
and or you can test review in managed
code in real time with the power of
bitbucket Atlassian is helping teams in
every single industry from startups all
the way up to enterprises turn great
ideas into reality I have used HipChat
to videoconference with colleagues in
different parts of the country and it
makes it super easy you can go to
Atlassian comm to learn more and see how
JIRA confluence HipChat and bitbucket
give your team everything you need to
organize discuss and complete shared
work that's Atlassian comm unleash the
potential in your team and build what's
next we are back with more feedback from
you Philipp writes hi Shannon in
Wireshark filter bar the expression IP
DST exclamation mark equals and IP
address can generate issues that's why
it's highlighted in yellow you may want
to write something like not IP DST
equals equals with the IP address in
parentheses or exclamation mark IP
address equals IP address in parentheses
which will then appear in green in the
filter bar as said here any links us to
an address in section 6.4 dot for a
common mistake best regards and tons of
kisses from France to all the team thank
you so much Philip and I'm going to go
ahead and get on my computer and show
you exactly how that works first off we
have IP DST exclamation mark equals and
then the IP address so this time we're
going to make it 10 dots 73 dot 31.7 for
so it ends up being yellow just like he
said because it can generate unexpected
results and it'll give you this little
clue down here as to what you may expect
to see happen instead you can write not
IP DST equals equals 10.7 3.31 dots 74
which will give you a green filter bar
or you can write exclamation mark
parentheses IP address addr
equals equals 10 dot 73 30 1.74 or
whatever the IP address might be close
your parentheses and you receive the
same thing the link he is referring to a
straight from Wireshark org under six
point four point five
of this chapter it describes a common
mistake where the operator IP address
exclamation mark equals and then your IP
will still unfortunately show where
either source or destination IP address
equals one two three four so it doesn't
necessarily hide those so again thank
you so much Philip for sharing that
information it's very useful and lastly
from crazy 52 he says I found a page
with some examples to connect to
Wireshark over SSH over at command line
food comm I have a Raspberry Pi with a
land tap monitoring my internet traffic
over eth0
and a USB Ethernet adapter connecting it
back into my network using Windows with
putty plus Wireshark I managed to get it
to work with a command line and if you
want to check out command line food comm
it is over right here and I'll put it in
the show notes and he gives plenty of
examples on how you can use Wireshark
straight from your command that is so
cool
and it kind of brings me on to my next
segment so this brings me to my next
series I am going to be taking a look at
TCP dump and some other options in the
command line for Linux as well as
Windows we are going to start with the
installation and some simple commands
and then go from there and see what
happens so of course you can let me know
what you think you can send me a comment
below or you can email us tips at hak5
org and be sure to check out our sister
show check out have five hak5 org for
more stuff just like this I think we're
building drones right now it's pretty
cool now I will be there reminding you
to trust your techno list see you next
time