As we just learned with Wireshark
there's a lot of data that
can be captured on the network.
And one of the things that we're going to see
is protocols and
you will have to understand the foundation
of what a protocol is
and how it works on your network.
Basically as we already covered in module 1,
it's going to encapsulate your data
it's going to add some data to the traffic
that's flowing to give it some more
some more information
so that each and each way of the OSI model
system know what to do with it, for example.
It's at layer 2, it's just the MAC address
what's going to wind up happening is
you're going to see MAC addresses in the capture.
So what happens when it moves up
to layer 3, the network player
as it's going through a router.
Well, at this layer,
you're going to now have IP addresses
and you're going to have routing information.
So at each layer of the OSI model
there's going to be more information added
to the packet or the frame if it's at layer 2 and
this course will predominantly
going to call everything packets
even though we, there's segments in this frames
but at this layer, let's say, at layer 3,
the network layer, the packet's going to contain
a lot of information within it.
So that when we do capture it with Wireshark
and you look at it
and you analyze it, it's going to
give you information such as
source IP, destination IP and so on.
In this module, we're going to
take a very simple protocol
and we're going to take a
a look at it in a way where
we can see with Wireshark
what we're capturing and why it's
so important to understand the protocol.
So that when you do capture it,
you, you know what to do with it.
You know what it's supposed
to be doing on your network.
So as an example,
and we'll look at this in future modules.
If you capture ARP or you capture ICMP
or you capture TCP,
what are those protocols really
supposed to be doing?
So, when you talk about ICMP
or internet control message protocol,
one of the things that
it's responsible for doing is,
providing error or problem
information on your network.
So, some of the tools that uses ICMP is a
simple ping, or trace route,
and it's used to troubleshoot
network connectivity.
Now, when you capture it with Wireshark
and, and on the screen is a simple
ICMP capture,
you're going to see traffic of
flowing to the network
from a source to destination address,
and you're going to see
in the protocol column, ICMP.
Now in the, in the information column,
you're going to see
specific information like echo
and you're going to see
echo request, echo reply.
So if you didn't understand how
protocol ICMP actually works
when you open up Wireshark,
you really wouldn't understand what it
it's really telling you.
So, some of the ways that you can learn
more about protocols is to read RFC's,
requests for comments,
do some research,
there's some good books that you can read.
But predominantly,
and the way that I've done in the past
is everytime I run a capture and I find things
it immediately sparks interest in me to dig
deeper into what that is and how it actually
operates on the network - what it does.
Now, as we were in networking fundamentals,
there's certain things that we have to know.
We obviously have to know how IP works.
If we want to configure a router, or a switch.
We have to understand that if you're going to
configure an IP address in,
if you're going to build how
the routing's going to work,
you have to understand the fundamentals of it.
This simple protocol that we picked
for just to get you through
foundations, beginnings here,
ICMP, we have to understand how that works.
Where sending pings across.
We want to know what the TTL is.
We want to understand what that really means.
While we have our ways of doing that as
network professionals and we know
that we're going to send a ping, it will tell us
destination unreachable,
possible routing problem.
There's certain things that we understand.
But if we actually capture the data,
what would that really mean?
What would that mean to us?
So obviously, we're going to use Wireshark
to capture this traffic
from source to destination.
And again that's the most important thing.
If you want to send a ping or a trace route,
and again, this is a simple example
of what we are trying to get across-
let's say, we couldn't ping something, why?
So the quickest way to do this
is would be to set up Wireshark
ping it to endpoints and start capturing the data.
So let's say, at a source, a client
and I'm running a ping, a continuous ping,
from the source to a destination,
let's say, it's just a file server,
and it's continuously running,
it's running over and over,
and I see nothing but drops.
So I see milliseconds that
are very high and then very low.
Why would that be doing that?
Well, as we mentioned already in the earlier module,
we would want to look at, first
hey, let's run a trace route,
let's see if there is something else
that we don't see.
Maybe, we do have access or don't have access
through the routers, let's take a look there.
But, if we were only limited to using Wireshark,
and we just installed on the source
to the destination, what exactly would we see?
Well, if we did so,
we would see that we would capture
data that looks as if
in here, that we had a ping request
and we would look for replies
identifiers, we'd see sequence numbers
we'd see some specific data
that may or may not give us
a clue as to what it is, but
in some instances, it may.
So again, it may not always
tell you what the problem is
you may have to do a little bit deeper diving
using tools outside of Wireshark.
But just remember, if you were looking
at the actual packet,
there's information in the actual packet
that match to other things.
So what do we use ICMP mostly for?
We use it to use ping,
we use it do trace route.
It's part of the TCP/IP protocol sweep.
It relays query messages
and it uses control messages.
So what does these really mean?
So one of the things that's important
to understand with ICMP is that
this is actually the information that's appended
as the packets are moving
and up and down from the client
source to the destination
and in here you can see some of those exact
things that we were just talking about.
You could see the source address,
the destination address,
options, the time to live,
the checksum.
Those are the things that when you learn
about the protocols themselves
and you do deep dives into the protocols,
it will provide you the information
so that when you capture it with Wireshark,
and you look at the data in the details,
you will understand deeper information about
what that actually means.
Now, when you do filters,
you'll also be able to build filters
based on this information.
For example, if you wanted to
build an offset filter,
specific hexadecimal code
could be used to build
filters to search for information
that may or may not be in this headers.
So, this is one of the key things
to remember about protocols
when you're troubleshooting with Wireshark.
So when we're doing traffic
full analysis with Wireshark
and again with the protocol ICMP,
some of the things that we're going to
be looking for - some dropped packets,
maybe an incorrect gateway assignment,
it's taking the incorrect path,
maybe there's latency.
There's many reasons why the data may not
be getting from source to destination
either in an appropriate time,
it may not be getting there at all,
or maybe taking an incorrect route.
Whatever those things are,
those things could be found
when you capture the data from the source
and at the destination, and analyze
both captures to see specifically
what that protocol is doing.
Filter for ICMP and
specifically look inside the data
to find the information you need
to get the clues to solve that problem.