- [Narrator] Wireshark is one of the most well-known
packet or protocol analysis software.
This type of software is also called packet sniffer
because it collects and inspect packets
like dogs sniffing for evidence in a crime scene.
In this lesson, our goal is to observe
three-way handshaking, using Wireshark.
Transmission control protocol or TCP,
is a connection oriented protocol
that ensures packets are error-free,
and in sequence on the receiving side.
For TCP to establish a reliable connection,
it has to go through this process
called three-way handshaking.
The process consists of three steps,
which is why it's called three-way handshaking.
The first one is SYN or synchronize.
The second one is SYN/ACK or synchronize and acknowledge.
And finally ACK or acknowledge.
Here is a diagram that shows
how three-way handshaking occurs.
When starting your Wireshark instance,
remember that you're running it as root.
The root privilege gives you access to network interfaces.
Also, familiarize yourself with the use of filters
to display TCP traffic only.
To install Wireshark, type sudo,
space, apt get,
space, install, space, Wireshark,
and press enter.
Wireshark has now been installed.
To start Wireshark, type sudo, space, Wireshark.
And press enter.
Wireshark is now up and running.
Choose a proper network interface.
In this case, eth0, the first network interface of the host,
and then click the shark fin button.
The packets are being captured.
To generate some more traffic,
we'll be opening up a web browser.
Let's visit a website.
Type, worldwide web, microsoft.com.
Press enter.
You can see lots of messages are passing by.
We'll stop capturing, by clicking on the red square button.
Let's filter the packets by typing TCP in the filter window,
and press enter.
Now you only see TCP traffic.
Let's see if you can find the three-way handshaking process.
It's right here.
Here it says SYN.
The next line says SYN/ACK,
and finally the last line says ACK.
Congratulations, you have successfully observed
the TCP three-way handshaking.