Hello everyone and welcome to another video of expert malware analysis and reverse engineering. Continuing 1
from our previous video and this video we are going to give a quick introduction to Wireshark. 2
So what is Wireshark? Wireshark is a network packet and protocol analyzer tool. 3
It helps you in capturing the packages that are going in and out of your network and you can basically 4
dissect into those packets and you can look at all the headers and the information that is basically 5
contained in those packets. 6
wireshark is perhaps one of the best open source packet analyzers that is available today for Unix 7
and Windows. 8
It's used for network troubleshooting analysis software and communication protocol development as well 9
as education. Some intended purposes of wireshark: well its use by network administrators to trouble 10
shooting network problems. 11
And it's also used by security analyst to uncover different security traits of infections on a system. 12
Developers use it to debug protocol implementations. 13
People use it to learn network protocol internals and so on. 14
Wireshark is not really an intrusion detection system. 15
A lot of people have this misconception but it's not really an intrusion detection system. 16
All it does is that it basically gives you a replica of all the packets that are flowing into a network. 17
So here is a quick system overview of Wireshark. 18
Let's say you have the end point sitting here. 19
So if we expand the diagram and if you look on the complete right hand side you'll see that there are 20
four layers of the OSI model 21
And the first layer is the physical. 22
So this is where your entry point or exit point to the network starts or ends right. 23
So if you look here on the left this is the point which has been marked here. 24
So the data gets in here and exits from here as well. 25
So what wireshark does is that it basically sits at the link level twhere your ethernet is present 26
the hardware ethernet in your system. 27
It sits here and it copies all the ethernet frames that are sent and received. 28
And it kind of creates a packet capture or a pcap file. 29
So once the capture is done the UI can then use a packet analyzer to display you what is it. 30
So everything here basically works along with the operating system. 31
So once you have some kind of data coming in let's say you was at Google.com you will send the request 32
out and then other response will come back in and all the way to your web browser. 33
So once that once your request goes out it gets captured here and once the response comes in it gets 34
captured here as well. 35
So pcap will contain both the request and response bits that are going in and out of your network. 36
So downloading and installing wireshark is pretty straightforward or you can just go to wireshark.org 37
and you can download it from there and you can get the latest version. 38
Wireshark will install all their dependencies for you as well so you don't really have to worry about 39
those things. 40
The last I checked I don't think it gets installed with flare but you can obviously check with your 41
machine and see whether flare supports wireshark or not. 42
If not you can easily download it from here. 43
Much more updated version. 44
And it's pretty straightforward and you just run the executable and you'll have wireshark up and going 45
on your machine. 46
So once you are done with the installation part once you launch wireshark you'll see something similar 47
to the image shown here. 48
So there are few basic pointers that I want to go through. 49
So at the top once the GUI starts, the top bar basically shows you the command menus then you'll see 50
that there is a bar as well where you can type in. 51
So this bar is your display filter where you can apply different filters in order to look at specific 52
traffic that has been captured by a wireshark. We will be going into much more details about how filter 53
works. 54
It's a very critical part of analyzing pcaps. 55
So we will be doing a separate session completely on display folders and how to write your own filters 56
to look at traffic and analyze what data is present in it. 57
Then below here is the actual capture traffic. 58
Once you apply some filters here you see the result of the filter here. 59
If you don't apply anything you just see the entire capture of traffic then the details of the individual 60
packets can be seen here. 61
the details window. 62
This is also very important we know where you can get much more details you can drill down into the 63
package for example if you see here. 64
There is a drill-down of HTTP request so you can see all the HTTP headers here. 65
For example there is host information that is User-Agent there is encoding, connections, referee, cookie 66
and all those informations are present here so you can go down to the repeated requests and you look 67
at each of the headers and see what information has been transferred and lower down is the packet content 68
in hexadecimal format. 69
So you'll have both Hex as well as ASCII representation here so you can compare the data both at hex 70
as well as ASCII level. Moving ahead, 71
So once you launch wireshark it's very critical to make sure that you are capturing traffic from the 72
right interface. 73
So if you're connected with wireless internet you have to make sure that you're capturing your wireless 74
data if you're connected with an ethernet cable you have to make sure that you capture that data on 75
the ethernet cable. 76
So wireshark makes it easy for you and once launch Wireshark and once you go to interfaces 77
the option that is shown here. 78
If you click on capture it's any good or interfaces it will show all the interfaces that exist 79
on your machine and it to tell you which of those interfaces are active. 80
So if you are using a Wi-Fi you will automatically see that the Wi-Fi interface will show you a graph 81
which shows that OK there is some live traffic going on so you can just click on it and you can begin 82
to capture. 83
OK so here I have an example of all their faces as well. 84
So in this case you can see that there is a gigabit interface interface and there are two VMware virtual ethernet adapters 85
as well which didn't help me in capturing the traffic of my virtual 86
machines. 87
So if you can see the ethernet is having lots of Packets going in and out. 88
So I can just click on start and it will begin capturing the packets for me. 89
So the entire capture is basically split into two parts. 90
One is the packet list panel. 91
So this is basically the list of Packets in the current capture and they all are color coded so wireshark 92
uses lot of color code to denote different Packets for example for HTTP it will 93
use green color, for DNS it will use grey color and so on 94
So that's the packet list panel. 95
Then you have the packet details panel where you have all the details off of each packet or you can just select 96
one packet and it will give you much more details you can drill down pretty much like what we saw in 97
the previous slide. 98
Then there is a packet bytes panel as well which shows you packet bytes it Hex and ASCII. 99
So here is a snapshot of what I was mentioning in the previous slide. 100
You have a packet list panel where you have all the packets which are color-coded so you can see 101
that there are green for the http for TcP. 102
And there are grey ones. 103
There are blue ones for UDP. 104
So that's how the wireshark intelligently creates color coatings to make sure that they're able to 105
separate different protocols based on colors as well so that it's easy for you to interpret them. 106
And you jave packet details panel there you can drill down to the individual package that you select 107
here. 108
And at last you have the packet bytes panel which basically gives you hex and ASCII representation 109
of the packet bytes. 110
So once you are done with capturing the data. 111
Never forget to just click on the stop button so that it stops the packet capture. 112
Otherwise it will just keep going on and on forever. 113
So make sure that you click on the stop button so that it can stop your packet capture and then you 114
can just go ahead and save it as a pcap file you can transfer it to someone else who wants to look 115
at the pcap and you can use it as evidence for whatever type of examination you are doing. 116
So this was a brief introduction to wireshark in the later videos. 117
We are going to do a demo on how we can capture Wireshark and then we will see into analyzing suspicious 118
or malicious traffic using wireshark. 119
That's it for this video. 120
Thanks a lot guys.