Graphic enters a network interface card in a binary form one frame at a time.
So there's an.
Here.
As you can see here, we have source IP source port and here Ethernet Ethernet to source address and
so on.
Type IP version four Internet Protocol Version four Flags, Time to Live one protocol UDP.
And there's so much information that we will need to analyze, right?
So while this space the wireshark uses the enhanced packet analyzer Epan, which decodes the bits into
human readable format.
So let me take my grommet to draw things on the screen and here apply.
So this is our.
Bits.
So these are the hex codes and so on.
So obviously you can't read this in your batteries and there's some information about that.
And here after getting this raw information, Wireshark translates it to in with enchants packet analyzer
engine which decodes as I said decodes the bits into human readable format here.
Perfect.
So now we will step through the pan.
So prior to 2006, Wireshark was called ethanol.
So, yeah, so the name has changed.
However, as obviously the main score is the same, right?
So it is the packet analyzing engine for Wireshark that use the sisters, also known as Decoder.
The So the sectors provide information on how to create the protocols in the proper format according
to the appropriate requests for comments RFC or other specification.
So IPAM contains four main APIs, which is the first is protocol three.
The sisters.
Sorry for this, the sectors, the sector, plugins and display filters.
So we have the protocol three, which is this displays the detailed analysis of a single packet.
We can.
We also have the sectors so these provide information how to break down the protocols into proper format.
We also have the sector plugins.
So these use the sectors as a separate functions.
And lastly, we have display filter and this allows you to filter captured data.
In most cases, Wireshark is able to correctly identify and dissect the protocol.
However, there are times when you will need help.
Wireshark decode the protocols, right?
So you can achieve this by right clicking on the frame here and here you will go to decode as here,
which will bring up this dialog.
Here.
As you can see here, we have several options here.
So once in this window, you can modify the values to match the appropriate protocol.
And this function is very useful when protocols either don't have a dedicated port or they are running
on a different port compared to the usual.
For example, you should use decode as when the HTTP is running on port 88 instead of port 80.
So once the bits have been converted into proper format, the next step is to display the results in
human readable format.
So now let's display the result here.
So in Wireshark, along with the many other packet analysis tools, there are many options to enhance
your graphical experience.
So when you open a packet capture in a wireshark, the default layout for the main display is is in
the three panels which is here.
Let me take my pen again.
So this is our.
Can you see it?
Sorry.
Please come.
I guess we.
Here.
So to painting home.
Gift home.
Yes.
Perfect.
So here, this is our packet list.
This tab we are using for is our packet list.
These are the packet details here.
These are the packet details and obviously these are the raw format, which is a packet bytes.
So.
Uh, the packet list here.
This is a list of all captured packet packets where each line represents a single packet, As you can
see here, broadcast IP destination, source, destination, source, protocol length info, and so
on.
Everything has a source and destination, right?
This was so philosophical here.
So we also have packet details.
So here this is a packet details that displays the details of a single packet and includes the protocols
and field values.
It also displays Wireshark specific hints, for example, when examining the TCP here, let's choose
some TCP here.
TCP oops.
Of course we have to use, uh, here.
So this is our TCP.
So when you examining a transmission control protocol header, you will see the stream index listed
below the source and destination force, right?
So however, there is no field value called the stream index, and a stream is a communication between
two endpoints that compromise the endpoint, A socket and endpoint B socket.
So to help you keep track of all those streams.
Wireshark lists each stream in a TCP header.
Here we have transmission control protocol.
Let's actually here you can also send protocol here, open this tab, transmission control protocol.
And as you can see here, stream index one.
That's kind of, kind of here.
Yeah.
Stream index one.
So I hope you see clearly.
So stream index one.
So this is what I called endpoint as an endpoint B socket, which is.
Uh, source and destination ports.
However, there is no field called stream index in some cases, and that's how you can bring it up.
And we also have packet bites.
This is a hexadecimal representation of a single packet as shown.
As you can see here and any plaintext data is displayed on the right hand side, as you can see here,
this link dot net something, something here.
Yes, Let's get some meaningful text here because it happens sometimes, right?
Okay.
You can also use your arrow keys to get user information and.
Okay, here.
Perfect.
That's it.
That's our request.
The http request.
So.
Yeah, this is a hexadecimal representation of a single packet that's shown here, and any plaintext
data is displayed on the right side.
And these are the hexadecimal this turned to.
Our.
Texts.
And after that, if it's not enough for you, the Wireshark like analyzes it itself.
And here request version, request URI request method, post request and so on.
In next lecture, we will also learn how to change the layout, how to analyze the package, capture,
and so on.
I'm waiting in next lecture.