You need to be careful when using wire shock to capture packets or frames from a network.
You need to think about how traffic flows through a network and make sure that you're capturing in the
right part of the network.
So as an example, if PC one opens up a browser and connects to the server.
Where do you need to capture the traffic?
Now it's obvious that you may capture here or may capture here, but what happens if you capture over
here?
Will you see the traffic sent from the client to the server?
Notice we're seeing a whole bunch of traffic here.
We're seeing ISP, we're seeing Spanning Tree.
We see other protocols, but let's filter for HTTP.
So at the moment we see no HTTP traffic.
What happens when PC one opens up a browser to the server?
So I'll close this down.
And let's open up a browser.
And go to 10.1 at 1.100.
So the server.
Do we see?
Any HTTP traffic.
And the answer is no.
If I clear the filters, I'll see a whole bunch of traffic.
So as an example, I can see DNS.
So there's DNS queries.
So let's filter for DNS.
Notice the client ten 111 sent a DNS query.
You can see query here to the DNS server.
The source IP address is ten 111 destination is ten 11254.
Now in this topology, the router is acting as a DNS server.
This is a Cisco router.
So show version here shows me that I'm running Cisco iOS software on this router.
Now, if you're not familiar with Cisco again, you get free access to my CCNA course.
So that'll teach you a whole bunch about Cisco routers.
But you don't need to know that to use Wireshark.
But if you want to be a serious network engineer, I strongly suggest that you learn about Cisco because
Cisco the biggest vendor out there.
But what I've done here if I type show run pipe include DNS, I have set up this router as a DNS server
through this command IP DNS server.
Now these commands may be confusing, so let me show you that the router is also acting as a DHCP server
or dynamic host configuration protocol server.
In other words, it's allocating IP addresses to clients dynamically.
The PCs are not configured with static IP addresses.
They dynamically get IP addresses from the DHCP server.
So this allows me to configure the router as a DHCP server and this command allows me to create entries
in the DNS server running on this router that says Janus three dot com has this IP address.
So as an example, if I ping June three dot com that resolves to this IP address, domain name, server
or domain name system.
DNS allows us to resolve easy to read names to IP addresses.
This is three topology is not connected to the Internet.
It's running locally on my computer.
So Julius Newcomb, if you surf from an Internet connected device, will take you to the actual gas
three server.
But in this example, it's simply taking us to this server in the topology.
Now what I'll do is stop this Wireshark capture.
And I'll save this.
Basic Wireshark capture, too.
So you can also once again have a look at this capture if you want to.
But Natasha, the client is sending a DNS request to the server.
The reason this was captured is we were capturing traffic on this link and the PC is sending a DNS request
to the router, which is the DNS server.
Source Mac addresses the PC destination address is the router.
We can prove that once again by going to the Rada and I can use the command show interface gigabit.
0/0.
Notice the Mac address of this router is this.
And that's the destination mac address of the frame.
So the PC sent a DNS request to the router source ip address is the PC destination.
IP address is the router.
I can prove that once again by going back to the router.
Remember I typed this command.
There's the MAC address.
There's the IP address of the router.
Ten 11254.
Source port number is an ephemeral or random or dynamic port number destination port number is a well
known port.
Number 53 is the well known port number for DNS.
So again, layer two frames.
Layer three packets.
Layer four segments.
In this case, however, it's UDP or user datagram protocol.
It's not TCP.
DNS in this example is using UDP source port again, destination port if we get to layer 5 to 7.
So top layers of the OS model, you can see it's a standard query.
Let's go through that Senate query.
So the queries are in this example for MSN.
So something was happening in the background.
But let's have a look for Jenny three dot com.
But notice windows just right out the gate is querying for a whole bunch of stuff, including Bing.
So a whole bunch of queries there.
Let's see if we carry on a bunch of Microsoft and MSN keep going.
A lot of queries, but this is the one I'm off to notice newsweek.com.
So the windows PC in this example queried for three dot com and the server hopefully at some point replies
here we go server reply back to the client notice source port is 53.
Destination port is the ephemeral port used by the client.
Now notice different port numbers were used for different queries.
So the Bing query over here used this source port number from the client.
I'd have to go back and find the Genesis three query.
There it is.
Notice 5503 seven is the source port.
When the query was made, when the server replies, it's replying back to that port number and it tells
the client the IP address of the server.
So the router acting as a DNS server is telling the client.
June History.com has this IP address ten one one 100 and then the client can initiate a session to the
server.
But we don't see that if we capture traffic on this link.
So again, if I filter.
For HDPE, I see nothing in the output because the HTTP traffic is sent directly from the client to
the server.
Why?
Because this is a switch.
It's important to remember that switchers do not flood traffic once they know the Mac address is involved
in a conversation.
So as an example if I type show Mac address table.
Notice we can see the MAC addresses that have been learnt.
The switch has learnt about this MAC address on gigabit zero zero.
It's also learnt about this MAC address and it's learnt about this MAC address on gigabyte zero one.
Now when I send traffic from the client, so that could have timed out if I refresh that page.
Notice it's learnt about this Mac address on gigabit zero two.
Once the switch learns about the MAC addresses in the conversation, this once again is the server.
And just in case you don't believe me.
Notice, this is the Mac address of the server.
This is the HTTP server over here.
Notice this Mac address was learnt on gigabit zero two.
Once this switch is learnt about to the devices in the conversation, it's not going to flood the frames
out of other ports.
It's going to be switched directly between these two hosts.
So the PC.
With this MAC address 000c ending in dd7.
You know the words this Mac address is going to have its traffic forwarded directly to the server and
the server traffic is going to go directly back to the PC.
So if you capture traffic on this link, you won't see the conversation between the server and the client.
That's why you need to either span a port or mirror a port on the switch to be able to see what's going
on.
Or you need to have a network tap or something in the network where you can see the traffic.
You've got to get the traffic to your capturing device.
Otherwise you won't see it.
So in the next video, I'll show you how to do that.
Let's add a mirror to the topology so that we can actually see what's going on.