WEBVTT 00:01.470 --> 00:04.350 World of analysis with Wireshark. 00:04.380 --> 00:05.550 My name is Stefan. 00:05.700 --> 00:13.650 In today's increasingly complex networks, troubleshooting and resolving uses often require us to visualize 00:13.650 --> 00:15.210 the problem at hand. 00:15.330 --> 00:22.980 That's where Wireshark comes in, a powerful tool that has been serving the network community for many 00:22.980 --> 00:23.670 years. 00:23.700 --> 00:29.280 In this section, we will explore the numerous benefits of using Wireshark for packet analysis, taking 00:29.280 --> 00:36.180 you on a journey through its exceptional history as an open source software with a wide range of rich 00:36.210 --> 00:37.040 features. 00:37.050 --> 00:41.580 But first, let's understand the importance of packet analysis. 00:41.790 --> 00:48.960 So by capturing and inspecting network traffic, you gain valuable insights into the inner workings 00:48.960 --> 00:50.100 of network. 00:50.280 --> 00:59.280 So this ability to pull data from the network and examine its contents is invaluable for network administrators 00:59.310 --> 01:08.470 as it enables them to troubleshoot, uses, perform testing and baselining and monitor the network for 01:08.470 --> 01:10.120 potential threats. 01:10.420 --> 01:17.320 So in this section, we will delve into the various ways of different groups can benefit from using 01:17.320 --> 01:19.390 packet analysis with Wireshark. 01:19.390 --> 01:26.080 Whether you are a network administrator responsible for maintaining a smooth operation, a student eager 01:26.080 --> 01:33.880 to learn about network protocols or a security analyst focused on detecting and mitigating threats, 01:33.910 --> 01:37.150 Wireshark has something to offer you. 01:37.180 --> 01:43.860 Furthermore, we will explore the different environments in which packet analysis can be conducted, 01:43.870 --> 01:51.730 whether you are analyzing traffic on a local area network, examining packets on a specific host, or 01:51.730 --> 01:54.130 even diving into the real world scenarios. 01:54.160 --> 02:01.560 Wireshark provides you with a flexibility and capability to uncover valuable information. 02:01.560 --> 02:09.570 And one of the key strengths of Wireshark, as is its ability to decode hundreds of different protocols. 02:09.720 --> 02:10.290 Right. 02:10.290 --> 02:20.910 So from a common protocols like TCP, IP and Http to more specialized ones, Wireshark supports a vast 02:20.940 --> 02:22.470 array of network protocols. 02:22.470 --> 02:29.610 And what's even more exciting is that Wireshark is constantly being improved and updating and ensuring 02:29.610 --> 02:35.040 that you have access to the latest protocols, deciding and decoding capabilities. 02:35.040 --> 02:41.610 So get ready to discover how this exceptional tool can enhance your network troubleshooting skills, 02:41.610 --> 02:47.220 empower your learning as a student, and bolster your network security efforts. 02:47.220 --> 02:56.010 And Wireshark truly is optimal choice for monitoring and understanding the intricacies of your network. 02:56.010 --> 03:04.000 So prepare to dive deep into the world of packet analysis with Wireshark and let's embark on this exciting 03:04.000 --> 03:05.530 adventure together. 03:05.530 --> 03:11.830 In this section, we will delve into these topics in detail, providing you with a comprehensive understanding 03:11.830 --> 03:15.370 of packet analysis and its significance. 03:15.370 --> 03:22.120 So let's take a closer look at here, what you will learn in this section. 03:22.120 --> 03:24.910 So we will review the packet analysis. 03:24.910 --> 03:32.830 So we will start by exploring the concepts of packet analysis, explaining what it is and why it's crucial. 03:32.830 --> 03:38.410 In today's network environments, you will gain a solid foundation of the principles and techniques 03:38.410 --> 03:42.310 involved in analyzing network packets. 03:42.340 --> 03:47.320 Also, you will recognize who benefits from using packet analysis. 03:47.320 --> 03:52.630 And next we will discuss the various groups and professionals who can greatly benefit from utilizing 03:52.630 --> 03:59.320 packet analysis from network administrators seeking to troubleshoot uses and optimize performance to 03:59.320 --> 04:06.340 students aiming to expand their knowledge and security analysts looking to identify potential threats. 04:06.370 --> 04:11.290 Packet analysis offers valuable insight for all. 04:11.650 --> 04:15.610 You will also learn how to identify where to use packet analysis. 04:15.610 --> 04:21.820 And one of the key aspects of packet analysis is determining where it can be applied. 04:21.820 --> 04:27.970 So we will explore the different scenarios and environments where packet analysis proves beneficial. 04:27.970 --> 04:35.260 This includes analyzing packets on local area networks, individual hosts and even real world network 04:35.260 --> 04:36.130 setups. 04:36.730 --> 04:42.670 We will also learn how timing plays a crucial role in effective packet analysis. 04:42.670 --> 04:48.670 So we will discuss the situations and circumstances in which packet analysis should be employed. 04:48.670 --> 04:54.490 Whether you are troubleshooting specific network usually is conducting regular monitoring and baselining 04:54.490 --> 04:57.070 or investigating security incidents. 04:57.070 --> 05:00.190 We will provide a guidance on when. 05:00.410 --> 05:02.030 To leverage the power. 05:03.140 --> 05:08.990 Lastly, we will in this section we will introduce you to Wireshark, the industry leading tool for 05:08.990 --> 05:10.190 packet analysis. 05:10.220 --> 05:17.840 We will explore its history, highlighting its evolution as an exceptional open source software product. 05:17.870 --> 05:23.450 Additionally, we will showcase the wide range of features and capabilities that make Wireshark the 05:23.480 --> 05:27.560 go to choice for network monitoring and analysis. 05:38.840 --> 05:46.250 Packet analysis involves examining packets to understand the characteristics and structure of traffic 05:46.250 --> 05:46.820 flow. 05:46.970 --> 05:53.600 It can become and it can be done in real time or by analyzing previously captured files. 05:53.720 --> 06:01.040 Specialized softwares like Wireshark or Tshark is used to capture network traffic and save it in a packet. 06:01.040 --> 06:05.600 Capture the file called Pcap. 06:06.260 --> 06:06.920 Pcap. 06:07.160 --> 06:09.320 Section pcap file. 06:09.410 --> 06:17.120 So here, this is the extension that we will use the already captured network analysis. 06:17.120 --> 06:23.270 So and here, as I said, packet analysis analysis benefits various groups. 06:23.690 --> 06:29.450 One of them are network administrators gain insights into network conditions. 06:29.450 --> 06:35.140 Security analysts use it for forensic investigations and identifying suspicious traffic. 06:35.150 --> 06:42.450 Students utilize packet analysis as a learning tool for understanding protocols, and hackers may employ 06:42.450 --> 06:46.140 it to gather network information during reconnaissance. 06:46.140 --> 06:52.860 So packet analysis occurs in different environments such as LANs, local area networks, hosts and real 06:52.860 --> 06:53.610 world scenarios. 06:53.610 --> 07:00.930 So it helps troubleshoot latency issues that test Internet of Things devices and establish network baselines. 07:00.990 --> 07:07.560 And since then, numerous other packets, analysis analyzer and analyzer tools and sniffing tools have 07:07.560 --> 07:15.570 emerged over the past two decades, and these tools have contributed to the evolution of advancement 07:15.570 --> 07:16.980 of packet analysis. 07:16.980 --> 07:24.180 So while this is not an exhaustive list, some notable examples here are included here. 07:24.180 --> 07:31.230 The Wireshark firstly here, this is the Wireshark, a versatile and widely used packet analyzer that 07:31.230 --> 07:37.110 offers a rich set of features and supports a vast range of protocols. 07:37.110 --> 07:39.870 We also have the TCP dump here. 07:39.930 --> 07:45.990 This is a common line packet sniffer known for its powerful, powerful capabilities and flexibility 07:45.990 --> 07:49.890 in capturing and analyzing network traffic. 07:50.070 --> 07:52.950 We also have the snort here. 07:53.910 --> 08:01.380 This is an open source intrusion intrusion detection system IDs that combines packet capture with a 08:01.380 --> 08:06.710 real time traffic analysis to detect and prevent network intrusions. 08:06.720 --> 08:10.740 We also have the Cain and Abel. 08:11.010 --> 08:17.490 This is a comprehensive network security tool that specializes in password cracking, VoIP, conversation, 08:17.490 --> 08:21.150 recording and various network attack capabilities. 08:21.150 --> 08:24.020 And we also have the Ettercap. 08:24.030 --> 08:31.410 So this is a versatile packet analyzer and attack tool used for network sniffing session, hijacking 08:31.410 --> 08:33.990 and protocol analysis. 08:33.990 --> 08:35.880 So these tools. 08:36.810 --> 08:42.480 Among others, have significantly contributed to the field of packet analysis, enabling the network 08:42.480 --> 08:49.380 administrators, security analysts and researchers to gain valuable insights into network traffic and 08:49.380 --> 08:51.570 troubleshoot uses effectively. 08:51.570 --> 08:56.970 As we delve deeper into the world of packet analysis using Wireshark, we will continue to explore its 08:56.970 --> 09:02.130 capabilities and how it has became a leading tool in this field. 09:02.130 --> 09:10.560 So packet analysis using Wireshark has become a valuable skill, but its history dates back to the 1990s. 09:10.920 --> 09:18.240 Early tools enabled network analysts to troubleshoot errors and monitor server server behavior. 09:18.330 --> 09:24.510 In the next sections, we will explore some of these early networking monitoring tools and during our 09:24.510 --> 09:31.380 explanation of packet analysis and Wireshark, we will encounter several tools that play important roles 09:31.380 --> 09:33.990 in network monitoring and analysis. 09:34.020 --> 09:38.490 So let's take a closer look. 09:38.740 --> 09:43.360 Some of the some of these tools and functionalities. 09:43.360 --> 09:45.910 So we will start from the one here. 09:45.940 --> 09:47.110 Cain and Abel. 09:47.110 --> 09:53.770 So Cain and Abel is a versatile tool known for its ability to gather passwords and record voice over 09:53.770 --> 09:55.540 Internet protocol conversation. 09:55.540 --> 10:01.600 As you learned in this lecture, it offers a various password cracking techniques and supports multiple 10:01.600 --> 10:02.050 protocols. 10:02.050 --> 10:03.610 We will use that tool here. 10:03.610 --> 10:09.400 And we also have natural insights formerly known as Carnivore. 10:09.490 --> 10:14.310 Natural Insights is a powerful tool used to monitor all Internet traffic. 10:14.320 --> 10:21.700 It is designed to provide deep packet inspection capabilities, allowing detailed analysis and monitoring 10:21.700 --> 10:23.710 of network communications. 10:23.710 --> 10:25.960 And we also have the Dsniff here. 10:25.990 --> 10:33.370 This is a network security tool that specializes in eavesdropping on network traffic to capture sensitive 10:33.370 --> 10:37.680 information such as passwords, emails and files. 10:37.680 --> 10:45.660 It can intercept and analyze various protocols, making it useful for security, auditing and testing. 10:45.660 --> 10:47.670 We also have ettercap. 10:48.090 --> 10:53.910 As I said, Ettercap is a popular protocol analyzer that operates from the command line, but it also 10:53.910 --> 10:56.250 has the graphical user interface which you can download. 10:56.250 --> 11:02.460 But in Linux it actually comes pre-installed and it is capable of performing various tasks, including 11:02.460 --> 11:06.360 network sniffing, network attacks and session hijacking. 11:06.360 --> 11:10.950 It also has a lot of plugins, so you can also use that plugins here. 11:10.950 --> 11:19.700 So Ettercap Ettercap is known for its versatility and flexibility in analyzing network protocols. 11:19.710 --> 11:21.480 We also have the Tcpdump. 11:21.480 --> 11:28.290 So Tcpdump is widely used packet sniffer that allows the capture and analysis of network traffic. 11:28.320 --> 11:34.080 It operates from the command line and provides detailed information about packets, including source 11:34.080 --> 11:37.990 and destination addresses, protocols and payload data. 11:37.990 --> 11:40.480 We also have the security onion here. 11:40.480 --> 11:46.900 The security onion is an open source tool that combines packet capture with an intrusion detection systems 11:46.930 --> 11:47.950 IDs. 11:48.130 --> 11:53.710 It provides a comprehensive network security platform allowing for the analysis and ethical hackers 11:53.710 --> 11:58.540 of network traffic and detection of potential security threats. 11:58.540 --> 12:03.190 And we also have the Wireshark our main topic. 12:03.610 --> 12:08.080 Finally, we come to the star of our section, Wireshark. 12:08.560 --> 12:15.070 Wireshark is a powerful and user friendly packet analyzer that offers a graphical interface for capturing, 12:15.070 --> 12:17.830 analyzing and dissecting network packets. 12:17.860 --> 12:25.360 It supports hundreds of protocols, making it an invaluable tool for network troubleshooting, performance 12:25.360 --> 12:28.810 optimization and of course, security analysis. 12:28.810 --> 12:36.940 So these tools collectively contribute to the field of network analysis and monitoring, each with its 12:36.940 --> 12:40.660 own unique capabilities and features. 12:41.290 --> 12:48.040 Throughout our journey, we will primarily focus on Wireshark, which stands as a versatile and comprehensive 12:48.070 --> 12:51.160 tool for packet analysis. 12:51.160 --> 12:57.190 By the end of this course, you will have a comprehensive understanding of packet analysis, its benefits 12:57.190 --> 13:02.170 for different user groups and the various scenarios in which it can be applied. 13:02.170 --> 13:11.110 And through the introduction of this powerful tool, Wireshark and get ready to unlock the potential 13:11.110 --> 13:17.500 of packet analysis and take your network troubleshooting and monitoring skills to the next level.