So Wireshark is not a disaster movie set in the wide open sea.
It is a free, open source and the world's foremost network packet analyzer.
And it is the de facto standard across system and network administrators with a graphical user interface.
Wireshark has the ability to listen and record traffic, as well as advanced filtering and reviewing
options.
So I'm going to visit a Http website first, then an Https website.
Let's go to Cali and run Wireshark.
You can open a terminal screen and type Wireshark to start it.
So these are the network interfaces that Wireshark is able to listen to.
They open another terminal screen and run the ifconfig command to see the network interfaces.
So as you know, if config stands for network interface configuration, so if we use the command without
any parameter, it will list all the interfaces available.
We have eth0 as a network interface to listen to.
So now I'll turn back to Wireshark and double click Eth0 to select it.
Now Wireshark starts to listen to the Ethernet interface of Kali and to create some traffic I'll open
a web browser and just visit an arbitrary website.
And now we have enough packets to examine.
So I'll click the stop button at the upper left corner of Wireshark to stop listening to the traffic.
So first we have some DNS packets to find out the IP address of the visited site.
We'll look at these kinds of packets soon, but right now let's just have a brief look.
So a DNS query for the IP version four.
Another DNS query for IP version six.
Don't worry about the versions right now.
We'll cover them soon, I promise.
These DNS queries are transferred as UDP packets in transport layer.
The destination port is 53.
This is the IP packet with the source and the destination IP addresses.
So we'll go through the layers one by one and we'll see all these packets datagrams and frames in detail.
So we'll keep going.
This is the structure of the Ethernet frame.
First, there are two DNS queries for Dub Dub Dub Hacker Academy UK.
One for the IPV four address and the other one is for the IPV six address.
And because the website is redirected to Hacker Academy UK, there are two more DNS requests for this
address.
Next DNS packets are the DNS query responses.
This response is type A, That means it's an answer for the IPV four request.
And here's the answer.
The IP address of the website.
Now DNS response packet uses UDP at the transport layer, IP at the network layer, etcetera.
Here we have a TCP handshake between Kali and the Web server.
We'll also see this in detail later on.
A syn packet.
A synack as a reply and an ack packet to complete the handshake.
This is an Http get request.
We learn the IP address of the website and now the system is ready to receive the web page.
Http protocol and application layer.
Now you can see the headers and the parameters of the request.
TCP Protocol and Transport layer.
Source Port.
Destination.
Port flags, etcetera.
IP protocol in network layer.
Here are the source and destination addresses.
An Ethernet frame in layer two.
These are the TCP packets which will build the Http response.
So in this example, it's the web page.
In other words, the response is transferred between the web server and our system as fragmented packets
in transport layer.
Here's the Http response.
200.
Okay, So the Web page is received and here's the data, which is our Web page.
These are the response details, response type headers, etcetera.
Here.
There's additional information produced by Wireshark which says that the Http response is created by
reassembling five TCP segments or packets.
So now I'd like to show you the difference between that and https traffic.
So I'll go to the browser and visit an https page now.
But before visiting the page, let's start Wireshark.
Here's a start button.
Continue without saving.
Okay, now we have a clean sheet.
So I'll go to the browser and hit enter.
Wow.
Lots of packets in milliseconds.
So we've got plenty of packets to investigate.
Just click the stop button once again.
Okay, So the DNS request and the response packets first.
Here is a response with an IPV four address.
Here there is a TCP three way handshake between Carly and Port 443 of Google's Web server.
And now a client.
Hello.
TLS packet to start the TLS handshake again between Kali and Google Server.
Now to get rid of the other traffic records.
I'd like to filter the results by the IP address of the Google server.
Now while the mouse pointer is on the server IP address, right click and go to apply as filter and
select the selected option.
So as you can see here in the filter bar, the IP address is assigned as the destination IP address.
Now, we only have to see the traffic where the destination is the Google server, but we'd like to
see both the incoming and the outgoing traffic, so I'll change the DST part of the filter to addr and
click the blue arrow to activate the new filter.
Now we can see the traffic in both directions.
Okay, so here we are at the Hello TLS message.
Here are the details of the message.
TLS uses TCP protocol in transport layer.
The Google server replies a serverhello message as the second step of the TLS handshake.
Then comes the certificate and server key exchange and the server.
Hello.
Done message is sent by the server.
Kylie sends the client key exchange.
Google server sends a new session ticket.
And the encrypted communication starts.
Here is some encrypted application data which is meaningless for others who listen to the traffic.
And as you can see here, the message is encrypted at the application layer.
So you can still see the source and the destination addresses the ports, etcetera.
This is how an IPV four packet is seen on Wireshark.
So it's a DNS query response.
The fields we mentioned are seen pretty clearly.
Versions for.
Header length is five words, which means no options.
Field.
Total length is 96 bytes.
MF and DF flags are not set.
And you can see the source and the destination addresses and all the rest.