‫Wireshark is free, open source and the world's foremost network packett analyzer and is the de facto
‫standard across system and network administrators.
‫Wireshark has the ability to listen and record traffic, as well as advance filtering and reviewing
‫options.
‫We're not going to do a deep dive into Wireshark right now, since that's the subject of network layer
‫attacks.
‫So here, let's let's see a summary of the traffic and the systems related to the interfaces.
‫We listen.
‫Let's go to college and start Wireshark, you can start Wireshark from the applications menu or open
‫a terminal window and type Wireshark to start the.
‫Don't worry about the ampersand in the end of the command, putting an ampersand at the end of a command
‫because it's a shelter run the process in the background, it's sort of multitasking.
‫You can have many processes running, but only one in the foreground at any given point.
‫The process in the foreground is the process that appears to have locked up the terminal, whatever
‫the first message is, because we are a super user on Colly.
‫No worries.
‫OK, the welcome page of Wireshark asks which interface we would like to listen to first.
‫So let's have a look at the interfaces of our system.
‫To look at the interfaces and to remember the IP address of Kali, open a terminal and type if config.
‫There are two ResultSet of the Afghan fingerman, either zero and L.O..
‫Ethe Zero is the first Ethernet interface, additional Ethernet interfaces would be named ethe one,
‫two cetera.
‫Here we have only one.
‫Now, Ello is the loop back interface.
‫This is a special network interface that the system uses to communicate with itself.
‫E0 is the interface that we're interested in at the moment, double click to open the e0 on the main
‫page of Wireshark to start capturing the packets, passing through our Ethernet interface.
‫Now, to speed it up, let's create some network traffic, open one of my virtual machines, a WASP
‫Liwei and paying Pinkly.
‫To stop Pinkman press control, see if config to learn the IP address of the machine.
‫Now I go to another Métis boy and paying the last PVM first.
‫And then Pengelley.
‫Here we have a lot of ICMP and art traffic at the moment.
‫So let's generate some traffic.
‫I open the browser and Cali and visit the website served by Voysey Machine.
‫And even more traffic, I visit NHS, Dot, UK, my favorite website.
‫OK, that's enough.
‫Let's turn back to Wireshark.
‫As you see, we have a lot of packet's captured and new package arrive every second hour, packet's
‫TCP packets, less packets for HTTPS, traffic, et cetera.
‫Here we don't investigate the package in detail.
‫We want to learn about this systems which are interacting with us to go to statistics menu and select
‫conversations.
‫There are five tabs in a conversation window by default.
‫And we're on the IPV for tab at the moment here, there are IP packets grouped by Address A and address
‫B in each line we see how many packets sent up to now total size of the packets and byte number and
‫size of packets from A to B and from B2K, et cetera.
‫There is traffic between eight eight eight eight eight eight and my colleague.
‫Now, I know that eight eight eight eight eight eight is the IP address of Google DNS, so I must have
‫set the Google DNS as the DNS of my colleague.
‫You know, I'd like to look at the network config.
‫And yes, my DNS address is eight eight eight eight eight.
‫The Ethernet tab, we can see the Mac addresses of the systems.
‫The address is full of F's, meaning that the packet is broadcasted, AAP requests or the examples for
‫these kind of packets.
‫In the DCPI tab, we can see TCP packets grouped by the addresses and this time by ports as well.
‫Because the system may have different interactions with any other system, for example, Carly may have
‫HTP traffic through Port 80 and at the same time it may have an S.H. connection through twenty two as
‫well.
‫Same as TCP packets are grouped by IPS and ports in the UDP tab.
‫Here we have learned a lot of live systems, IP addresses and Mac addresses, just listening to the
‫traffic go through our network interface.
‫If you like to investigate the traffic between the two machines, select the line right click if you
‫choose, apply his filter from the menu.
‫Only these kinds of packets will be seen in Wireshark.
‫I'll choose find at this time.
‫As you see, automatic query string is prepared.
‫I can navigate between the packets by clicking the find button.
‫Go back to the conversation window at the bottom right, there is a conversation type's button when
‫you click on it, a lot of different protocols are listed.
‫These selected five are the default selected protocols, you can add any protocol from the list when
‫you select one of them, a new tab is added to the conversation window.