Okay.
So I'm going to open up a web browser from PC one to the server.
The service IP address and this is a Linux server is ten .1.1. 100.
I used the command if config to see the server's IP address.
So what I'll do is start capturing traffic between the PC and the switch.
Janus three makes us a very easy.
It allows us to capture traffic directly within the topology rather than having to install a hub or
a wiretap or something to see the traffic.
So I'm going to capture the traffic between the PC and the switch and we'll be able to see exactly what's
going on within this Wireshark capture.
So you can see that we've got spending tree traffic, we've got IP traffic, dynamic trunk protocol
traffic already displayed.
And being captured by why shock.
What I'm going to do, however, is filter for HTTP.
There's no HTTP traffic at the moment.
But what we'll do is open up a web browser on the PC and connect to the server.
So let's use PC one.
Open up a web browser.
I'm going to browse to.
Ten .1.1. 100, which is the server.
And as you can see there, a web page is displayed.
Now it's nothing fancy.
It's just a basic web page hosted on the server.
But it's enough for us to see what's going on.
So in Wireshark, you can see that traffic was sent from a source IP address.
Ten 111 to a destination IP address of ten one one 100.
This is a HTTP traffic.
You can see the protocol.
There is http.
You can see the length.
You can see that it's an HTTP get.
In other words, the PC is trying to get a web page from the server.
Now, before I go through the Wireshark capture in more detail, let's explain some of the basics that
you see in Wireshark.
The first thing you see is a frame.
Now in networking, this is known as Layer two of The O.C. model.
Information captured here are known as Frames.
So this is known as a frame.
We've captured an Ethernet two frame.
In other words, we've captured traffic on Ethernet.
There are different types of Ethernet frames, but Ethernet two is the most common.
The source Mac address is a VMware host destination.
Mac addresses this.
So the source Mac address is the PC.
This PC is actually running inside of VMware.
If I type IP config slash all, you'll be able to see the MAC address of the host 000c 29 ending in
DC DX seven.
And hopefully that's what we see over here.
So notice mac address is DC D seven.
So notice this mac address is the mac address of the PC.
Destination address is this.
That's the mac address of the server.
Notice the mac address over here.
36 E 45 C 4091, A2.
There you go.
That's the IP address of the server MAC address of the server.
Here's the IP address of the PC and the MAC address of the PC.
So in networking, we use the term frame at layer two.
You get different types of frames on Ethernet, typically Ethernet too, but on a WAN connection or
wide area network connection, you could be using something like point to point protocol or PGP or HDL-C.
Or in the old days you had encapsulation like frame relay or ATM.
In other words, the layer two frame changes depending on the physical technology that you're using.
Most common technology today is Ethernet.
Most common Ethernet frame type is Ethernet too.
So this is known as a frame.
Now, just to make it more confusing, in Wireshark, they talk about frames here as well.
But this is actually just metadata used within Wireshark that tells us about the frame.
So again, this is just metadata.
We don't typically talk about that as a frame in networking.
This is known as a frame.
This is known as layer two in the OSSI model.
So this is a frame.
At a layer three, we have what's called a packet.
So when we refer to the layers in the OSA model, we use terms such as frame at layer two packets,
layer three and segment at the layer for at layer three.
We've captured the IP version for addresses.
So this is IP version for information.
The protocol used to add layer four is IP version four.
What I'll do, actually, at this point is stop my Wireshark capture.
So that the capture that I share with you isn't too big.
And I'll save this as.
Basic wire shock.
Capture one.
Notice it's a pcap in g file will pick up next generation Wireshark file.
So that's the file that you'll download and you'll be able to do something similar to what I've done
here.
So again, protocol at layer three is IP version four.
Source IP addresses this destination IP addresses.
This IP version four contains a lot of information, differentiated services, code points or differentiated
services field DHCP Differentiated Services Code points is to do with quality of service.
Quality of service or cause or chaos allows us to differentiate some traffic types from others.
So in other words, we could say that voice traffic is more important than FTP traffic.
So when you make a voice call, it should be prioritized over file transfer protocol or FTP traffic.
This is a way to indicate to the network how important the traffic is.
A lot of other information is shown in this header, including as an example that the protocol used
at layer four is TCP IP.
So layer four, once again, this is layer two frame.
Layer three is packet, layer four is segment at layer four.
In the OCI model, we are using TCP here and you can see source and destination port numbers, HTTP
or hypertext transfer protocol uses the well-known port number of 80.
The server was listening on port 80.
That's why when the client made a connection to the server.
The Web page displayed.
The client initiated a session to Port 80.
The server was listening on Port 80.
It served because it's a server.
It served a web page to the client, in this case using the protocol HTTP.
So it basically has this page, this web page hosted on its harddrive, and it served that page to the
client when the client connected on Port 80.
The client uses this random port number or ephemeral port number to use the correct term.
So it connects to the server using an ephemeral or random port number, going to a well known port number
of 80.
And then you can see here.
The application used is hypertext transfer protocol.
Now in networking, we talk about the same model, but typically it's a hybrid model between the TCP
model and the OCI model.
At the top of the other model we have application, presentation and session.
Those layers are often grouped into a single layer called application.
So notice we have layer two here.
Layer one is the physical medium.
So that's not shown in the Wireshark capture.
The physical medium here is Ethernet, could be copper or could be fibre.
In our example, this is just a virtual network, but in the real world this would be physical Ethernet,
in this case perhaps copper.
So the physical media is copper.
So that's the physical connection.
He had just a virtual logical connection.
So layer one, physical layer two data link, or in this case, it's Ethernet.
Layer three is network.
In this case, we've got IP.
Layer four is transport.
In this case, it's TCP IP.
And then the top three layers are kind of combined into one layer, application layer.
So notice hypertext transfer protocol.
And inside here we can see details such as the client used it shows up stall as windows 9010 164 but
using a browser Mozilla 5.0.
So in this example, I'm actually using Microsoft Edge.
That's the browser used within Windows ten.
So this is a Windows ten of virtual computer.
In other words, it's a virtualized.
I'm actually running on a mac here recording on a mac, but I'm running VMware, which allows me to
virtualize multiple devices within my journey.
Three Topology.
So the Wireshark capture sees the client as a Windows ten computer, which is correct.
It's using 64 bit Windows.
Mozilla is the browser.
It's actually Microsoft Edge and then the server replies back.
Notice in the server example, the Mac addresses are swapped round.
In this example, I've got a layer two switch.
A layer two switch means that it's just simply switching frames.
In other words, layer two data from one port to another.
It's not trying to route the data from one network to another.
These two hosts are in the same subnet or the same network, so the switch is simply switching the traffic
from one port to another.
So in this example, the IP addresses are swapped around and so are the MAC addresses going back to
the first example.
Notice source MAC address is this destination.
Mac addresses this when the server replies, those are simply swapped around so the server is replying
with its MAC addresses.
The source destination MAC address is the Windows computer.
IP addresses are swapped around and so are port numbers.
And if we look at the hypertext protocol, notice we can see services 200.
Okay, 200 means that the server was able to provide the data to the client.
We didn't have a404 HTML error.
As an example, some data was provided to the client.
Notice you can see here the actual web page that was served to the client.
So you can see it says Networkers Toolkit.
You can see the PNG file notice network is toolkit.
And if I look at that web page on the client, notice you can see the output here.
It says w w w files located at var w w w html.
And if we look here, that's actually what you see files located at var w w w dot html.
So if I scroll to the right notice, you see the full output you get to root after logging in.
Notice we told you you can place files in TFTP boot and that's exactly what you see over here.
So Wireshark has read the HTTP traffic.
Be careful with http.
It's clear text.
So through Wireshark you can see exactly what's going on here.
The client is trying to get the PNG image, so it's trying to get the actual PNG image.
And here the server which is an Ubuntu server is providing the PNG file.
So that's the actual file and you can actually export that.
And I do this again in other videos.
But let's do it right now.
This three image.
So I'm going to export that to my desktop.
And on my desktop, I'm going to change that.
To a PNG file.
And then when I open it up.
Notice there's the actual image.
So why shot captured all the data from the server as well as the image?
And that's the image that we have on the server.
So once again, to do that, click Portable Network Graphics because there's a PNG file and then go
export packet bytes, save it to your hard drive.
So I'm going to save it once again as genius.
Three.
Image two.
And then I'm going to rename it.
So it saved it as a bond file.
I'm going to rename that as PAG because it's a PNG file.
And then when I open it up, you can see that it's a PNG file and there's the actual image.
So.
You can see here, it's getting the fave icon and then we're getting something http for for error,
something not found.
So something went wrong here.
But the point is, is that you can read the actual HTTP traffic and remember.
Because these devices are in the same subnet.
All that happens is the MAC addresses are swapped around IP addresses.
The swapped round port numbers are swapped around during that communication.
So source IP is host here, source IP is the server.
So when the server replies back, it's replying back from Port 80 to the client.
So that was a very basic example of using Wireshark to see what's going on in the network.
Were you able to download the Pcap file?
Were you able to open it up in Wireshark and actually do something similar to what I've done here?
There's no better way to learn than to practically use Wireshark capture frames and see for yourself
what's going on.
I've made it a little bit more simple by giving you some pcap files, but hopefully they mean something
because you you're using the actual files that I'm recording right now rather than just some random
file that you got off the Internet.
Now, please note it means a lot to me if you provide feedback on the course.
So if you're enjoying the video, then please say so.
If you get prompted to leave a review and you're enjoying the course, then please do that because it
helps other students and it helps me make the course better.
Let me know how I can improve the course as well.