Surprisingly, capturing useful traffic can be a challenging aspect of political entities.
This election and this actually this whole section of our course.
Describes two different capture techniques, passive capture techniques and active captors techniques,
passive capture doesn't directly interact with the traffic.
Instead, it extracts the data as it travels on the wire, which should be familiar from tools, for
example, like hair wireshark via front.
Why should?
Supports.
So.
Now you will find different applications, provides different mechanisms which have their own advantages
and disadvantages to either retire or traffic, active culture interferes with traffic between a client
application and the server.
This has a great power but can cause some complications.
You can think of active capture in terms of proxies or even men in the middle attack.
So let's look at both active and passive can use in more depth.
Let's get started with passive network traffic capture.
So now I want, uh, your, uh, write some diagrams.
Here.
Let's, uh, create some diagram here.
So we need, uh, actually two computers, two, uh, computers here.
Uh, this is the first one to hear actually here.
And one several said of yourselves.
So.
For example, let's make this survey here, and we just need another wife.
Here, for example, like this.
If.
And, uh, this is the this is our server here.
Server, uh, for example, uh, pass catcher device.
This is the attacker.
And this is the client client application.
Target.
Let me get this here and then.
We will connect is here, uh, like here.
And we will do this by the rational one.
And to.
Here and.
One.
To.
Lastly, here.
Connect this to settle.
So passive capture is relatively easy to conduct, so it doesn't typically require and specialist hardware,
nor the usual need to write your own code so you don't need to.
What I hope there is some so much programs like Russia.
In this figure, I illustrated the common scenario a client application and server communicating.
We are Ethernet over the network, so passive network capture can take place either on the network by
tapping the traffic as it created in some way or by sniffing directly on either the client or server
host.
So.
You know, in this election, actually, we will use Wireshark here.
Let me tell you.
He is.
This we will use Wireshark to make.
Passive, actually.
Yes, passive capture.
Yeah.
Oops!
So let's open my trunk here.
So White Shark is perhaps the most popular packet sniffing application available.
It's a cross-platform and easy to use, and it comes with many built-in protocol and assist features.
In the next lectures, you will learn how to write this sector to aid in political analysis.
But for now, let's say the word shock to capture IP traffic from the network to capture traffic from
an internet interface, wired or wireless, the capturing device must be in.
Who misuse what?
So a device in premises mode um receives and processes any ethernet frame it sees, even if that frame
wasn't designed for that interface.
Captioning an application running on the same computer, it is easy.
So just monitor the outbound network interface or the local loop interface better known as localhost.
So otherwise you might need to use networking hardware such as hub or configure switch to ensure traffic
is sent to your network interface so.
Because you can see here.
Uh, let's start out capturing here, I will, uh, select it, uh, internet interface here.
And let's open browser.
Let's go to coliforms.
So now, as you can see here, we have traffic's.
So.
Um, there are three main uh, there are three main windows, as you can see here.
So in a window, the top of that is area.
Here is the area, uh, of, uh, this area hosts, um, a time line of a row packets of the, uh,
network.
So the timeline provides a list of source, as you can see here.
Um uh, this progress and list of source and destination IP addresses, as well as the coded political
summary information.
Here, let's pause this, so um.
And this area here, this area, uh, provides.
This area provides a dissected weave of the packets separated into a distinct protocol list that corresponds
to the always-I layer USA networks like model.
And lastly, this area here.
This area here, uh, shows the capture is packaged its real world.
So the TCP IP network protocol is stream based and designed to recover from dropped packets or data
corruption due to the nature of networks and IP.
There is no guarantee that packets will be received in a particular order.
Therefore, when you are capturing packets, the timeline view might be difficult to interpret.
Fortunately, Wireshark offers the sectors for known protocols that will normally resemble the entire
stream and provide all the information in one place.
For example, a highlight, uh, a packet in TCP section in the travel time line as select analyzed
full of, uh, TCP, uh, TCP actually just two years.
Analyze.
Near.
Timesheets, as you can see here.
You can have, uh, they could uh, you can record this and.
Applications and features like that.
So.
You're.
Here, as you can see it.
And see, this is the package.
This is the raw files, and this is the analyzed here.
I see follow this stream and you can see here we can see the stream with streamflow and which order
a sent.
Uh, so actually, what protocols we took to the sector, Wireshark, uh, can decode the stream and
present it in easy to weave dialogue.
And Wireshark is a comprehensive tool, and covering all of its features is beyond the scope of this
course.
If you are not familiar with it, obtain a good reference.
Uh, in you can actually watch videos on YouTube about Wireshark.
There are books written about Wireshark because Wireshark is so big and comprehensive a comprehensive
tool, uh, covering all of its features.
We can't do that because we need at least five or six house with content.
So this is just an intermediate Wireshark um, course intermediate Wireshark connection.