WEBVTT 00:00.810 --> 00:01.540 Check it out. 00:01.560 --> 00:08.700 It's time for us to get ready for an upcoming assignment and notice we are going to be doing none other 00:08.700 --> 00:13.200 than utilizing Wireshark in this next assignment. 00:13.200 --> 00:21.330 So notice I'm doing a Google search for Wireshark and we are going to be brought to the Wireshark dot 00:21.330 --> 00:22.470 org site. 00:22.800 --> 00:26.700 What we're going to do is download the popular Wireshark. 00:26.700 --> 00:31.590 I'm on a Windows platform, so I'll choose the 64 bit Windows Installer. 00:31.980 --> 00:37.320 What we are going to do with Wireshark is we are going to sniff packets. 00:37.320 --> 00:37.740 That's right. 00:37.740 --> 00:45.150 We're going to capture packets off of the wire or the wireless environment and we are going to analyze 00:45.300 --> 00:46.290 their contents. 00:46.650 --> 00:55.470 Notice you've got to get on a machine that you can download Wireshark to, and this is typically going 00:55.470 --> 00:58.620 to be a machine that is not in your corporate environment. 00:59.070 --> 01:06.330 As you know, your corporate environment, firewalls and policies are probably not going to allow you 01:06.330 --> 01:09.090 to download and install and enable. 01:09.090 --> 01:14.330 Wireshark Because this is one of those tools that could be used maliciously. 01:14.610 --> 01:21.150 So your first order of business is going to be to get into a place on equipment where you can indeed 01:21.150 --> 01:22.950 download this free tool. 01:23.490 --> 01:25.620 All right, I've got it downloaded. 01:25.620 --> 01:28.110 Let's go ahead and open the file. 01:28.320 --> 01:34.170 And that should kick off the installation executable and it does. 01:34.500 --> 01:35.100 All right. 01:35.100 --> 01:43.050 So we are going to say noted and notice that we have the ability to download all of the components. 01:43.290 --> 01:44.100 So that's great. 01:44.700 --> 01:48.780 And do we want a quick launch icon start menu desktop? 01:48.780 --> 01:53.460 Yes, I'll do all of these associations, get all of these icons. 01:53.700 --> 02:01.080 Notice we are installing into the default location and then notice that there's this ENPI cap. 02:01.740 --> 02:09.300 What this is going to enable us to do is capture the live network data from our network. 02:09.450 --> 02:11.130 So that is perfect. 02:11.130 --> 02:14.100 We'll go ahead, install in and install that. 02:14.580 --> 02:24.180 Should we have traffic coming in via USB devices, maybe we have a USB type of adapter for receiving 02:24.180 --> 02:25.770 wired network traffic. 02:25.980 --> 02:28.740 I know on my laptop I'll often do that. 02:29.040 --> 02:36.900 I'll go ahead and connect Ethernet via a USB adapter that I have to give myself a wired connection. 02:37.260 --> 02:40.950 Since we don't have that, I will not install that option. 02:41.640 --> 02:42.240 All right. 02:42.240 --> 02:48.360 Well, this install is going to go very quick, so I'm just going to stay here live with you, because 02:48.360 --> 02:51.480 I want to make sure that, you know, we don't do the old. 02:51.870 --> 02:57.750 There were tricks up my sleeve and you didn't get to see things that might have been required. 02:58.350 --> 03:06.210 By the way, in case you're wondering, I am on an HP Omen laptop right now and it is running Windows 03:06.210 --> 03:06.960 11. 03:07.110 --> 03:11.940 So this is a Windows 11 system that we are installing Wireshark on. 03:12.540 --> 03:12.990 All right. 03:12.990 --> 03:13.680 Well, right. 03:13.680 --> 03:18.570 When I said claim that it would be a very fast install, it started taking a long time. 03:18.870 --> 03:22.800 All I had to do is complain about it and that prompted it to get going. 03:23.220 --> 03:29.700 Here is the end Pcap installation that we said we wanted and let's check these options. 03:29.700 --> 03:33.030 Restrict and caps driver access to administrators only. 03:33.030 --> 03:34.140 That's a great idea. 03:34.380 --> 03:40.530 Support RA 802. 11 Traffic and monitor mode for wireless adapters. 03:41.010 --> 03:49.260 I'm going to turn that on and install and cap in win p pcap API compatible mode that will make sure 03:49.260 --> 03:53.310 that I get the network traffic captured that I want someone to enable that as well. 03:53.880 --> 03:55.740 Notice that second question. 03:55.920 --> 03:57.990 Boy, is that an important one. 03:58.260 --> 04:05.310 Notice that this can place our wireless LAN adapter into what is called monitor mode. 04:05.460 --> 04:08.640 I want you to memorize that for certification purposes. 04:08.940 --> 04:18.300 Monitor mode with 802. 11 NICS are going to enable you to not only get the data frames off of the wireless 04:18.300 --> 04:21.570 network, but also get the control frames as well. 04:21.750 --> 04:29.580 So you just start gobbling up on your network card for analysis all of the frames that are associated 04:29.580 --> 04:31.320 with the wireless communications. 04:31.680 --> 04:37.530 As you might guess, this monitor mode is something that your computer criminals are going to absolutely 04:37.530 --> 04:38.070 love. 04:38.370 --> 04:44.070 They're going to want to put their wireless network cards into this mode to gather traffic off your 04:44.070 --> 04:44.580 network. 04:44.790 --> 04:53.250 You can see why this tool is very dangerous and why we install Wireshark in our lab environments or 04:53.250 --> 04:57.150 where it's authorized to behind the walls of our corporation. 04:57.510 --> 04:59.070 Well, I'm going to choose next. 04:59.070 --> 04:59.550 And. 04:59.860 --> 05:05.620 Finish and notice that was just the install for the NW cap utility. 05:05.830 --> 05:13.510 So now Wireshark, now that that is done, will be finishing up its installation and then prompting 05:13.510 --> 05:21.640 us to install any additional tools that it might have for us and look at that will choose next and we 05:21.640 --> 05:24.790 will manually reboot this computer later. 05:25.000 --> 05:26.500 And we're going to choose finish. 05:26.830 --> 05:33.670 That reboot is going to be a requirement should you want to stop start monitoring traffic? 05:33.910 --> 05:36.190 Most likely on some systems. 05:36.190 --> 05:39.430 I found that I can actually start monitoring traffic now. 05:39.700 --> 05:46.090 But just to be on the safe side, of course, I will reboot and we will pick up right here in this video 05:46.180 --> 05:49.780 with this demonstration for you right after the reboot. 05:50.170 --> 05:57.830 So as you can see, we are back and we are on that Windows 11 workstation and Wireshark. 05:57.850 --> 05:59.470 I love that icon. 05:59.470 --> 05:59.780 Right. 05:59.800 --> 06:00.640 So cool. 06:00.850 --> 06:03.010 Wireshark is installed. 06:03.010 --> 06:05.800 I'm going to double click that icon on the desktop. 06:06.340 --> 06:14.830 And I just got an alert that several things wanted to manipulate this underlying system and. 06:17.710 --> 06:18.300 Wow. 06:18.310 --> 06:22.180 After literally saying yes, it's okay. 06:22.180 --> 06:23.140 Yes, it's okay. 06:23.140 --> 06:24.010 Yes, it's okay. 06:24.010 --> 06:30.400 About four times as Wireshark was digging into the configuration of this device. 06:30.760 --> 06:36.760 Notice it went in and started monitoring my wi fi. 06:36.760 --> 06:37.300 Look at that. 06:37.300 --> 06:41.860 So I am on a Wi-Fi network right now and look at that. 06:41.860 --> 06:44.170 You can see the packet activity. 06:44.530 --> 06:53.890 Now, if you double click if I double click that entry, notice I start seeing the actual packet flow. 06:54.130 --> 06:59.800 So I am now capturing the packets over the wi fi. 07:00.100 --> 07:04.030 This is the stuff that hackers are made of, isn't it? 07:04.180 --> 07:04.540 Yeah. 07:04.750 --> 07:13.240 We are gathering all of this incredible, useful information off of this network device right now. 07:13.600 --> 07:17.890 Notice there is a stop button up in the top left corner. 07:18.010 --> 07:21.430 So I'm going to go ahead and stop the capture now. 07:21.670 --> 07:29.980 And you can see that we have up in the top pane, I'm scrolling through all of the incredible number 07:29.980 --> 07:34.480 of packets that we successfully sniffed off the wire. 07:34.720 --> 07:36.790 So it's an incredible number. 07:36.910 --> 07:45.910 And notice it's in a grid and it's like a spreadsheet where if we wanted to sort it all by protocol, 07:46.030 --> 07:46.720 we could. 07:46.990 --> 07:52.450 So I just click in the protocol header there, and now we have sorted all of the packets. 07:52.460 --> 08:00.310 Look at how useful this would be if we want to see what exactly is occurring via DNS, what exactly 08:00.310 --> 08:01.210 is occurring. 08:01.360 --> 08:08.860 The ARP notice down here the OCI model is really brought to life for us, isn't it? 08:09.100 --> 08:13.480 Because we can see information that's in the frame. 08:13.660 --> 08:20.050 We can see ether information in the Ethernet two frames specifically. 08:20.230 --> 08:28.840 And if we look in here you can see the destination mac address is a Netgear device. 08:28.840 --> 08:32.320 So this must be the device that we are communicating through. 08:32.470 --> 08:39.550 And there is source mac address information from what appears to be an intel component. 08:39.790 --> 08:46.030 Probably the adapter notice there is IP version for information. 08:46.270 --> 08:52.150 So if we want to go in and look at the network addressing that, we said would be there. 08:52.330 --> 08:53.320 There it is. 08:53.500 --> 08:58.540 There's the source IP address and the destination IP address. 08:58.810 --> 09:01.780 What do we notice about the source IP address? 09:02.020 --> 09:07.720 Well, it's an RF C 1918 private use only address. 09:08.020 --> 09:16.600 And sure enough, the destination address is a 13 dot address, which means it is part of the public 09:16.600 --> 09:18.130 internet address space. 09:18.670 --> 09:22.150 Here's the transmission control protocol parameters. 09:22.360 --> 09:28.720 So now we are looking at the information that is at the transport layer. 09:29.410 --> 09:38.110 One of the reasons I'm showing you this tool now and I'm having you use this tool now is because as 09:38.110 --> 09:44.800 we study things like transmission control protocol, you will be able to pull up. 09:44.800 --> 09:51.490 Wireshark captures of this information and you'll be able to see it as you are studying it. 09:51.820 --> 09:57.940 This really brings this information to life, and I don't think I could have survived in this field 09:58.090 --> 09:59.560 without Wireshark. 09:59.560 --> 10:05.110 Well, certainly I could have survived in my field without Wireshark, but it sure would have made the 10:05.110 --> 10:09.240 learning much less enjoyable, that's for sure. 10:09.310 --> 10:15.010 This really does bring it to life, and I want you to be one with this tool, so to speak. 10:15.370 --> 10:16.450 Thanks for watching. 10:16.450 --> 10:22.360 And this is your prep for the assignment that follows.