So in typical traffic capturing on a network interface, there are a lot of packets received from and
delivered to all over the network and, well, the Internet as well.
So let's see how we can take a picture of that network.
Let's go to college and start Wireshark, you can start Wireshark from the applications menu or open
a terminal window and type Wireshark to start the app.
Don't worry about the ampersand in the end of the command, putting an ampersand at the end of a command
because it's a shell to run the process in the background.
It's sort of multitasking.
You can have many processes running, but only one in the foreground at any given point.
The process in the foreground is the process that appears to have locked up the terminal, whatever
the first message is, because we are a super user on Colley.
No worries.
OK, the welcome page of Wireshark asks which interface we would like to listen to first.
So let's have a look at the interfaces of our system.
To look at the interfaces and to remember the IP address of Kali overdetermined and type if config.
There are two ResultSet of the config command, either zero and L.O..
Ethe Zero is the first Ethernet interface, additional Ethernet interfaces would be named ethe one,
etc, etc. Here we have only one.
Now, Ello is the Lookback interface.
This is a special network interface that the system uses to communicate with itself.
E0 is the interface that we're interested in at the moment, double click to open the e0 on the main
page of Wireshark to start capturing the packets, passing through our Ethernet interface.
Now, to speed it up, let's create some network traffic, open one of my virtual machines oos BBWAA
and ping pinkly.
To stop Pinkman press control, see if config to learn the IP address of the machine.
Now I go to another via metastable and paying the last pvm first.
And then Pengelley.
Here we have a lot of ICMP and AAFP traffic at the moment.
So let's generate some traffic.
I open the browser and Cali and visit the website served by Voysey Machine.
And even more traffic, I visit NHS, Dot, UK, my favorite website.
OK, that's enough.
Let's turn back to Wireshark.
As you see, we have a lot of packet's captured and new package arrive every second hour, packet's
TCP packets, less packets for HTTPS, traffic, et cetera.
Here we don't investigate the packets in detail.
We want to learn about this systems which are interacting with us to go to statistics menu and select
conversations.
There are five tabs in a conversation window by default.
And we're on the IPV for tab at the moment here, there are IP packets grouped by Address A and address
B in each line we see how many packets sent up to now total size of the packets and byte number and
size of packets from A to B and from B2K, et cetera.
There is traffic between eight eight eight eight eight eight and my colleague.
Now, I know that eight eight eight eight eight is the IP address of Google DNS, so I must have set
the Google DNS as the DNS of my colleague.
You know, I'd like to look at the network config.
And yes, my DNS address is eight eight eight eight eight.
The Ethernet tab, we can see the Mac addresses of the systems.
The address is full of F's, meaning that the packet is broadcasted, our requests or the examples for
these kind of packets.
In the DCPI tab, we can see TCP packets grouped by the addresses and this time by ports as well.
Because the system may have different interactions with any other system, for example, Carly may have
HTP traffic through Port 80 and at the same time it may have an SS connection through twenty two as
well.
Same as TCP packets are grouped by IPS and ports in the UDP tab.
Here we have learned a lot of live systems, IP addresses and Mac addresses, just listening to the
traffic go through our network interface.
If you like to investigate the traffic between the two machines, select the line right click if you
choose, apply as filter from the menu, only these kinds of packets will be seen in Wireshark.
I'll choose find at this time.
As you see, automatic query string is prepared.
I can navigate between the packets by clicking the find button.
Go back to the conversation window at the bottom right, there is a conversation type's button when
you click on it, a lot of different protocols are listed.
These selected five are the default selected protocols, you can add any protocol from the list when
you select one of them, a new tab is added to the conversation window.