Alright, welcome back to Wireshark Foundations.
This is day 3. We will be covering specifically how to use the Wireshark tool.
We will be taking everything that we've learned in the past 2 days.
And looking at issues and samples, and trying to use all the tools together
that you can find and use it in Wireshark.
And talk about some, some examples to where
you can use this tool to troubleshoot things in a lab,
in production networks, on the job or to practise with.
So again, this is Rob Shimonski. This is day 3.
This will be our final day for Wireshark Foundations.
And today, we will cover again, a lot of scenario-based stuff
to talk about how to use everything that you've learned in the past 2 days
to really examine some issues and try to get through them.
In this module, we will be covering capturing client/server response.
So what is client/server communication?
We've been covering this for the past couple of days in the modules.
But everything that we talked about now as we troubleshoot problems
will rely on your understanding of the client or source
to the server destination communication.
That does not necessarily mean that
it's always going to be a client and a server.
What we're going to be looking at
primarily in the next set of troubleshooting scenarios
will be client to server but just remember that communication can take place
between just about any host on a network.
And Wireshark will be able to capture that and show that to you.
So, just as a refresher, when I use Wireshark - 'what can I do with it?'
Again, you really need to know placement.
So if you're going to capture client/server communications,
you need to know where to put this, put the Wireshark capture device,
or your endpoint - have Wireshark an endpoint.
Because if you don't put it in the right place,
you will not capture the communication that you need to capture.
So, we'll go over the, the lab set up again. Just so that you understand
what it is that we're trying to accomplish when we're troubleshooting with Wireshark.
And remember, one of the biggest challenges is
to try to see exactly what it is that you want to see.
So as an example, I can do a pre-capture filter and
blot out exactly what I don't want to see.
And I can capture everything and then run a display filter,
and try to see what it is that I do want to see.
So essentially, what am I analyzing?
A communication pattern, one of the examples we're going to use in this segment
is a simple FTP site. We're going to look at
the actual communication from the client to the server
and get an understanding of what's taking place.
Is it responding correctly?
Is it responding in time and some of the issues that could take place when doing so?
So just to highlight again, this is a foundation course.
So, understanding the placement of Wireshark
in this example is very simple one.
However, it's the understanding of this simple network diagram
that's going to allow you to expand out
because essentially, if you're just looking at
the client and that's where you're running Wireshark
and or running Wireshark on the client and the server,
no matter what is in the middle
it really is just going to complicate
what it is that you're going to see on both sides to analyze.
However, you're still going to be using the same type of framework in your mind.
You're going to be capturing on the client.
You're going to capture on the server, and or the server.
And or, as we see in the diagram, you can set up a separate device
and mirror the traffic, span it and send all the data
to a mirrored-port where you can capture it for analysis.
So again, this is the simple set up that we're going to be using.
So in this example, what I wanted to do is
is I wanted to run a simple capture here.
And what we're going to simulate here is an FTP.
So I'm going to open up Wireshark. I am on a launchpad - the start page.
And just again to reference, I'm going to go to the capture pane
and I am going to, in this case, I'm not going to send any capture options, although I could.
I could specifically choose the interface here.
I could set up a capture filter if I required one.
And I could split the files up if need be.
Since I selected the interface here, I'm going to click start.
And what I am going to do is I am going to open an FTP site.
And when I'm opening an FTP site, I purposely did some things here
to mess with the response time.
So I wanted to be able to show you a few things as we're capturing.
So when we look at the actual capture, you'll be able to,
you'll be able to see a few things. So let's just give that a moment.
Ok, now if we filter for FTP,
we will see quite a few things here.
For one, it has captured everything that we were doing in FTP.
And a way we can take a quick look at what could be some basic problems is
run into the Expert and take a look to see some basic notes, warnings, chats.
I see a couple of re-transmissions, a couple of duplicate ACK's,
and my whole entire conversation captured here.
So essentially, it looks pretty good.
However, it did hesitate momentarily.
So what we can then do is go to statistics and take a look at a flow graph.
And here, we will see the client/server response,
where the time it took from me opening up the FTP session
and it closing out, and it kind of what happened in the middle.
So essentially, we can see that FTP client, FTP client to the FTP server,
we captured that response with Wireshark.
And we can take a look in some of these tools
to specifically see some of the things that took place.
So as an example, I can look at the TCP stream.
Here, you will see at first, when we were logging in.
There was an anonymous log in and it passed.
This is in clear text. Again, when we were talking about security,
you can see this information in clear text.
Again, this is a quite, quite an issue on an open network.
This is an anonymous log in so it's not that big of a deal.
It's just an example for you.
But, one of the things that you should definitely take away from this is that
when you're using the protocol analyzer, right here in the TCP stream,
you can gather the information, credentials.
For example, if you're telling that into a router or some other device,
those, that information can be captured.
So then bring down, we can see that there was a permission denied.
That was the hang-up. And then FTP moved into passive mode.
And then I changed the directory.
And then I closed everything out.
So essentially, when we're talking about client/server communications,
this is what we're talking about.
What Wireshark can show you.
All we did is run Wireshark on an interface.
We access something from a client to a server.
And with a lot of the tools we've already learned
we were able to ascertain quite a few things.
We were able to see the information was sent in clear text.
We were able to see that there was a permissions issue.
We were able to see that essentially,
it opened and closed in a fair amount of time.
And that even though we saw a duplicate ACK or 2,
and a re-transmission, that doesn't necessarily mean there was an issue.
Some networks that was operating here on a wireless network
may be something was a little slow
and they had to re-transmit a packet.
Not a big deal but again to reference back to earlier modules,
it doesn't necessarily mean that the Expert was telling you something was wrong.
We found it in a different way. We found it in the actual stream itself.
So just to review, Wireshark can assist with finding IP based issues.
As we move up to OSI model, you can look directly into TCP and UDP.
The next module we'll talk about the TCP handshake specifically.
But as we can see, as we're learning, all these things do play into helping you
analyze and dissect exactly what a problem could be.
You can use Wireshark as an example
to resolve client/server communication issues.
Using the TCP flow graph, the flow graph - I'm just highlighting on TCP.
We were able to do this with just one instance of Wireshark.
So, back to our network lab, we didn't need to necessarily set up Wireshark remotely.
If we felt there was an issue that we needed to address there
we could have set up a capture on either end and then looked at both.
And try to use the tools to figure out what possibly be the issue.
And again, as we've mentioned, there are other
parts of the equation that could be a problem.
It could be that there's and I/O issue on the box.
It could be that there's a contention on the network,
and so on and so forth.
So, some of the available tools that we looked at was obviously the capture window.
We ran a capture, a very simple capture.
We simulated an FTP connection to, from an FTP client to an FTP site.
We saw an issue with that.
We were able to quickly open up a few of the tools.
We filtered on the traffic. We just looked at FTP.
We looked at a couple of tools and we were able to quickly find
an issue with the client/server communication.
In sum, you can, you can run a capture and you can jump around a capture window
and try to figure things out. You can click on single packets and look at
what exactly what was going on in that particular packet.
But, to learn this tool,
before you start getting into the greater detail of looking directly into the packet,
and finding specific issues, remember, you had to refine what you're looking at first,
because if you're not sure, it's going to be very bloated.
you're going to see a lot of stuff in the capture window.
And it's best to filter down to what it is that you think you need to see.
And then, one of few of the tools that we learned about,
and then go into the packets themselves, into the details to try to find the other issues.