We're going to get started with the actual
getting into and getting Wireshark,
installing Wireshark and prepping it for use
because everything that we've talked about
until now has been - alright well, what do you,
what do you really need to know
before you use Wireshark?
What's the preliminary information required?
So before you use Wireshark at all,
as we discussed and we try to keep
that very brief. We try to say, alright before,
before you actually fire up Wireshark and use it,
what is the basics that you need to know?
So we just finalize those basics.
You need to know about networking
at the most fundamental layer,
about TCP/IP and basic form ethernet.
What devices exist?
Where you really are going to place this tool?
And what can you expect out of it?
Now, what we'd like to do is we'd like to get
into the installation, the preparation of this tool
so that when we get into the troubleshooting
of particular technology such as voice,
you will know how to operate all the tools
within Wireshark so that you can troubleshoot
those particular problems. Otherwise, if you're
you know, just in downloading, installing it,
running it and capturing it, it's likely unless
to configure it specifically to look for
the problems that or filter for the problems
that you want or to use the tools within it
or have the specific custom profile built for it,
you're going to have a difficult time
making heads or tails of what you're looking at.
Alright so, to move into the next module,
basically installing Wireshark is a, is
is somewhat of a no-brainer.
So we're going to talk about some of the
history behind it before we get into
the requirements and preparing to install.
So Wireshark's been around for a
pretty long time, so, somewhere in mid
to late 90's, a gentleman, Gerald Combs,
decided to build a protocol analyzer
because back in those days you could
only really use one and was really expensive
to use one with a full-blown out GUI or GUI.
Those were your, your old sniffer,
some Fluke tools and stuff like that.
They were actually really expensive.
And if you didn't use that, you could always
rely ona good old TCP dump.
Some people got away with
network monitor on Windows.
But you still had to pay for the server version
licensing so there were tools out there but
there was never a free tool.
And originally it was created as Ethereal and
it was developed and it was very good.
It was a, it needed further development but
it would actually allow you to do
somewhat what sniffer and these other tools
are allowing you to do. But what was
beautiful about it was that it was open source
and because it uses the GTK
which is GIMP, and a lot of the development
community open with the GPL and tooling
is devicing, really getting into it, is turned out
to be probably one of the most downloaded,
most used, most often requested
for use troubleshooting tools of our time.
So, that is the essential history of it
where it moved into with current versions.
It was then moved to a company called
CAC and then, right after that Riverbed
bought CAC and now it's really a
not predominantly a Riverbed product
because it's still open source.
It's still open to the community and
it's still being openly developed which is
really good but you will see with some of the
Riverbed tools like ARX and some of the more
more enterprise-wide tools,
it has very Wireshark feel to it.
So, that is essentially where we were,
where it went and where we are today.
So to get Wireshark basically, you just
need to go to the website wireshark.org.
You could download it and install it
pretty much without fee.
You just need an internet connection.
But to do that, you basically need
to have a device to install on.
So, some of these other enterprise tools
will allow you to - how a hand held
or a device where you can capture data.
Fluke releases a lot of these types of tool
a very good one, very good ones and a
there are some tools like the old sniffer
that also loaded on a PC.
But in this instance, this instance especially,
what we're going to be working on
you need to install Wireshark on a PC.
And if you're going to install it on a PC,
some of the things that you have to,
you have to look at is the system requirements.
So that can all be found at wireshark.org.
You can look through and find out specific
specific settings that you need to make -
what the requirements are.
But you just have to remember that
it has to be compatible PC.
Some of the things I will add, is that
in partcularly if you're going to be
saving a lot of data, you need to have a
place to save it. These captures can
grow very large in size. And you will need to
be able to place those not only in safe place
because you don't want these data to get
off your system or into the wrong hands.
Because as we mentioned
it could be a security violation.
But you will also want to have it in a place
where you can actually store it and not
completely wipe out the available space
on your hard drive.
If you're running Wireshark and you feel
that you're going to be running these long
captures, you're probably going to need some
extra memory to be able to handle it.
And you will want to obviously
use a compatible NIC.
So your prep to install is very simple.
You want to download Wireshark
on a compatible PC.
Sometimes this may be tricky because
if you're using it in the field, they may
ask you to install it on a server.
You would be very careful with that obviously.
You want to check to make sure you have the
appropriate permissions.
You want to make sure that you
have enough disc space and you want to
make sure that if you're running this
in tandem with the running application,
it does not compete for and take, wipe away
the memory of the application and
cause a performance degradation.
So just be, be aware of where you're
installing it and why you are installing it,
And what impact it will have on the source
and or the destination or target devices.
There are versions, there are stable versions
and there are development versions.
I, I recommend using in production
the stable version.
You're free to download and
play with what they would call the beta
or the development version at any time.
They're always developing the next
product version, so it's recommended that
if you're really into Wireshark,
you stay on top of the latest trends with it.
You can get on their mailing list.
They'll send you things
to tell you what's coming next, or
you can make recommendations yourself
and you can talk about the product.
Then you could probably
if you're a developer, get on the
development team and help build this product.
So that's another open door for it,
is that it is a open source tool
and it's one of the better ones out there.
It has a great development community.
WinPcap is the, the low level interface.
It's a lead Pcap on a lead Bcap
on Unix and Linux boxes, but
from Windows boxes is WinPcap
and this is the low level driver interface
put in promiscuous mode interfaced
with the API piece of software that actually
is the shim between Wireshark itself
and your physical NIC.
So this is the software that let's the
NIC and Wireshark work inter op,
allows it to inter-operate. It's a dirver, sorry,
and it's used to capture the data.
It puts your NIC in promiscuous mode.
So what does that mean?
So data is sent to and from your NIC card
and it's actually by unicast.
It's a targeted, it'll send targeted information
and it'll drop the rest that is not, that is not
it's not destined to go -
information destined to go to it, it will drop.
So, what's not good about that is
if you're trying to troubleshoot
with Wireshark and you wanted to see
everything going on and not just
specifically that unicast traffic -
what, what, what do you need to do?
So what when Pcap does is it allows your
NIC card to be put into promiscuous mode
so that you can see and capture all data
on the network segment in which
the NIC card is configured.
Wait, another important piece of information is
that Wireshark cannot
be used without WinPcap or
the Unix version because
when you go to install it, it's going to
check for and make sure that
it's installed and or installed for you.
So if you are uninstalling things on your system
and then you pull this off with Wireshark installed
just be wary that these two have
to inter-operate together.
You cannot use them separately.
You will not be able to run
and capture without it.
So when you run your installation,
a couple of things that you want to
pay attention to is if you're using
Wireshark often, you're likely going to
have an older version on there.
When you go to learn the new version
it's going to ask you to uninstall
that version if you'd like to.
So you can leave it and or you can
uninstall and put on the new version.
There are many plug ins.
This allows you to do different things
within Wireshark. So there's different filters,
and different types of services that you can add.
It's going to ask you to install WinPcap.
A lot of times you may already have it
installed on your system.
Just make sure that it's the most current,
current version since this
operates with other tools. WinPcap, it's
you may already have it installed.
So just as you're running through the
installation, make sure that it is installed.
Or you need to upgrade it, upgrade it.
It's going to set some global settings,
some personal settings and then the tools.
So once you're done installing Wireshark,
basically, you're going to launch and check it.
And this is going to get us
into the next module.
We're going to start going through the interface.
We will talk specifically about how things
tie together, the importance of customization
the tools, like the I/O graph, the flow graph,
streams, all that stuff.
We're going to look at all that but
to do that we're going to know how,
we need to know how to navigate the tool,
we're going to need to know to work
through the tool and that's what we will be
learning in our next module.