-: In this lesson, 2 2
I'm going to use a tool known as Wireshark 3 3
which is a packet analyzer 4 4
to be able to pull apart some network traffic 5 5
and show you the different layers of the OSI model. 6 6
But for right now, 7 7
I just want you to focus 8 8
on how I'm pulling apart these different layers 9 9
and the type of information I can get from Wireshark. 10 10
Again, this is going to be further and more in-depth 11 11
than you need to know for the exam, 12 12
but it's going to help you understand the OSI model 13 13
a little bit better, 14 14
as we start putting these pieces together 15 15
from this theory, 16 16
into something that's actually used on the network. 17 17
So let's jump into the environment and take a look. 18 18
Alright, welcome to Wireshark. 19 19
Now the first thing we need to do is have a file to look at. 20 20
So I have a couple of different packet captures 21 21
and I'm just going to open one up here 22 22
and it's going to be right here. 23 23
This is an HTTP connection. 24 24
So what I'm showing here on the screen, 25 25
is everything that happened 26 26
for one computer to make a request 27 27
from my computer to a server and back. 28 28
So as you can see here, 29 29
it starts at time zero. 30 30
The source IP is my machine that sent the request, 31 31
and the destination IP is the server I'm trying to go to. 32 32
That's how we read these things. 33 33
It's time, source, 34 34
destination, the protocol used, 35 35
in this case TCP, 36 36
and then the information that was sent. 37 37
As you go through, 38 38
you'll see there's this two-way conversation 39 39
going back and forth between the two. 40 40
And what you're seeing here, 41 41
is actually the session traffic 42 42
that was captured from one host to one server. 43 43
Now as I scroll down a little bit further 44 44
you're going to see it goes down 45 45
to 43 different line items happened. 46 46
It took 30 seconds total. 47 47
And we're going to go in and look at some of this information. 48 48
So let me go into this first packet, 49 49
and here in the middle section, 50 50
you'll see that we have frame one. 51 51
This was the first frame. 52 52
Now going back to our OSI model, 53 53
what is frame? 54 54
Where do frames operate? 55 55
Well, they operate at layer two. 56 56
So I should expect to see some layer two data in here. 57 57
What type of things are layer two data? 58 58
Well, things like Mac addresses. 59 59
So if I open this up, 60 60
you're going to see that the encapsulation type was ethernet 61 61
which is a layer two protocol. 62 62
We can see the time it arrived, 63 63
we can see the time that it left. 64 64
We can see what frame number it was 65 65
and how long the frame was. 66 66
We can see how much was captured 67 67
and all that type of information there. 68 68
Next, if I go into ethernet two, 69 69
this again is part of ethernet, 70 70
which is layer two. 71 71
And inside layer two, 72 72
we can see our destination and our source. 73 73
So this is our destination. 74 74
This is the server I was trying to get to. 75 75
It's the MAC address. 76 76
And underneath it we can see the source, 77 77
which is the machine that I had that made the request 78 78
and it happened over IPv4. 79 79
And if I bring this down, 80 80
you can actually see it even further details. 81 81
Now, the next thing I'm going to look at is IPv4. 82 82
When I start talking about IP, 83 83
what are we talking about now? 84 84
We're talking about layer three 85 85
'cause we're talking about internet protocol. 86 86
This means that 87 87
we're going to have source and destination IPs 88 88
as you can see here highlighted in blue. 89 89
And if I open that up, 90 90
you'll see that this was version four. 91 91
We can see the header length 92 92
and then we can actually dig into that packet. 93 93
But again, way beyond the scope, 94 94
the big thing we want to take away is, 95 95
layer two is Mac addresses. 96 96
Layer three was IPs. 97 97
Now when we go to layer four, 98 98
we're going to be talking about did we use TCP or UDP? 99 99
In this case, we used TCP. 100 100
So this is our layer four of the OSI model. 101 101
And as you can see, 102 102
we're building up each of these layers. 103 103
And all of that was one packet, 104 104
62 byte packet that we captured. 105 105
So the next one I'm going to do, 106 106
is the one that came back from the server to the host. 107 107
So we sent the SYN over 108 108
and now we got back a SYN, ACK. 109 109
As we look at that, 110 110
we can see the same type of information 111 111
the same layout each time. 112 112
You'll see that we have our frame, 113 113
our layer two addresses, 114 114
our IP addresses, 115 115
and then our TCP protocol layer four. 116 116
So layer two, layer two, 117 117
layer three, layer four. Okay? 118 118
And we can go through the entire packet 119 119
and look at each and every one of them. 120 120
Now, if I want to figure out 121 121
what was happening during this session, 122 122
I can do that as well. 123 123
So if I go in here, 124 124
I can see that there was a get request over HTTP. 125 125
Now, HTTP is a protocol, 126 126
it's an application. 127 127
So this is actually a layer seven capture here. 128 128
And what was done, 129 129
if I open this up, 130 130
I can see that they went 131 131
to the server etherreal.com. 132 132
They were using Mozilla, 133 133
which is Firefox 134 134
and that they came from this webpage, 135 135
etherreal.com/development.html. 136 136
And they clicked on the link for download html. 137 137
And that's what we're asking for. 138 138
We're asking for the webpage, 139 139
to download HTML at this point. 140 140
This then is acknowledged by the server 141 141
and goes back and forth 142 142
as they're getting more and more data. 143 143
And eventually we get that webpage downloaded. 144 144
In fact, if I right click on this, 145 145
I can tell it to follow the stream 146 146
and I can see what that webpage looked like. 147 147
Now this webpage is being shown to me in HTML, 148 148
because that's how webpages are sent, 149 149
but this is exactly what this person got 150 150
when they went to that website 151 151
and we captured all that in this network packet. 152 152
I could actually copy this, 153 153
make it into an HTML file 154 154
and then load it up inside of Internet Explorer 155 155
or Edge or Google Chrome or Firefox 156 156
and be able to look at all of that. 157 157
So I think that's enough of that packet. 158 158
Let's take a look at another one 159 159
and see if it looks similar. 160 160
The next one I'm going to look at, 161 161
is this one here that says FTP. 162 162
And what FTP is going to do, 163 163
it's file transfer protocol. 164 164
It's going to be very similar. 165 165
You're going to see that 166 166
we went from a source to a destination 167 167
and they went back and forth 168 168
a whole bunch of different times. 169 169
And in this case, 170 170
it was a much longer stream. 171 171
561 different packets went through that were captured. 172 172
So if I go back to the first one, 173 173
you'll see that there was this acknowledgement 174 174
and they went back and forth 175 175
and we can go through here and see frame. 176 176
Again, that's layer two ethernet. 177 177
And so again, 178 178
we can see the source and the destination 179 179
as far as those Mac addresses. 180 180
If we go down to the next one, 181 181
we go up to layer three. 182 182
We're now seeing the source and destination IP addresses. 183 183
And when we get to layer four, 184 184
we're able to see that this was a TCP session 185 185
transmission control protocol. 186 186
And so again, if I wanted to, 187 187
I can right click this and follow that stream. 188 188
Now, when I follow that stream, 189 189
what am I going to see? 190 190
I'm not going to see a pretty webpage 191 191
because this was FTP traffic, 192 192
somebody was downloading a file. 193 193
All of this, 194 194
if I convert it back into its hexadecimal or binary format, 195 195
let's go to raw for instance, 196 196
I can copy this in 197 197
and try to figure out 198 198
what type of file it was and put that back together. 199 199
That's what happens 200 200
with network forensics and digital forensics. 201 201
Way beyond the scope of this particular course. 202 202
But that's the idea here. 203 203
You can capture everything going over the network 204 204
into these PCAP files, 205 205
packet capture files 206 206
and you'll be able to open them 207 207
inside of Wireshark 208 208
to see what type of traffic is being used on your network. 209 209
Really, you're going to be focused mostly on this screen, 210 210
the source and the destination, 211 211
the protocol and even the ports. 212 212
You can see here it went from port 80 213 213
the web port to port 2727. 214 214
The server then answered up 215 215
from 2727 back to port 80 216 216
and they went back and forth throughout this communication. 217 217
Let's open up one more. 218 218
We're going to open up Telenet. 219 219
Now, Telenet is a way to remotely control a computer. 220 220
Again, you're going to see 221 221
that we have the time, 222 222
the source, the destination, 223 223
and the protocol, 224 224
just like we did before. 225 225
We have our SYN, 226 226
SYN ACK, ACK 227 227
which is that three-way handshake. 228 228
And again, down here we have layer two, 229 229
layer two, layer three and layer four. 230 230
Now in the protocol column, 231 231
you're going to see TCP 232 232
but you're also going to see this Telnet data 233 233
and that is an application. 234 234
So this is layer seven again, 235 235
just like we saw with HTTP before. 236 236
And if I go over here, 237 237
I can see that layer seven now is added, 238 238
and I get different information for that. 239 239
If I go through and right click it 240 240
and follow that stream, 241 241
let's see what we get this time. 242 242
There we go. 243 243
So what we're seeing is the person and their session 244 244
when they tried to connect to a Telenet server. 245 245
So what you see in blue is what the server sent back. 246 246
So when they connected the server said, 247 247
"Hey I'm an open BSD server, log in." 248 248
What the person did was, 249 249
they typed F-A-K-E 250 250
which you can see is red. 251 251
That's what the user sent to the server, 252 252
and the blue is what the server displayed on the screen 253 253
which was F-A-K-E. 254 254
So their username was fake. 255 255
Then it asked for their password, 256 256
and the user typed in user, 257 257
so their username is fake 258 258
and their password is user. 259 259
At this point, 260 260
they were able to log into the server 261 261
and start running commands. 262 262
They run the LS command, 263 263
which if you remember from A+ 264 264
on a Unix system, 265 265
it's going to list the contents of a directory. 266 266
And then they did it again, LS -a. 267 267
They wanted to see it going across the side 268 268
and you saw this is what came back. 269 269
This is the list of directories. 270 270
Then they tried to run a program 271 271
sbin/ping www.yahoo.com, 272 272
and that is showing that they try to do a ping 273 273
from this Telenet server, 274 274
out to yahoo.com 275 275
and they receive this information back. 276 276
Now we're seeing the entire conversation. 277 277
We're seeing both halves, 278 278
but if I wanted to see 279 279
just what one person sent to the other, 280 280
I can see the server side. 281 281
It's a lot easier to read, right? 282 282
But now I don't see that password. 283 283
I don't see the commands that got sent over. 284 284
When I go here, 285 285
and I switch it over to the client side, 286 286
this is what they typed in. 287 287
I can see that they typed in user 288 288
which was their password, 289 289
fake, which was their username 290 290
and then the commands, 291 291
the list command, 292 292
the list all 293 293
and the sbin/ping www.yahoo.com, 294 294
and then exit. 295 295
So you can see how this is useful 296 296
where we can start digging into this stuff. 297 297
If you go in furthering your career with CompTIA 298 298
and you go to your pen test plus training, 299 299
you'll get very familiar with Wireshark 300 300
and be able to dig in 301 301
and grab this information from the wire. 302 302
Now again, like I said, 303 303
this video was a little bit beyond the scope 304 304
of what you really need to know 305 305
but hopefully I've wedded your appetite 306 306
where you're really interested 307 307
in being able to learn more about Wireshark 308 308
and be able to learn how you can use this 309 309
both as a network technician 310 310
being able to see where the breakdown of communication is 311 311
whether it's layer two, layer three, 312 312
layer four or layer seven, 313 313
or using it more from the defense side 314 314
with cybersecurity analysts 315 315
going through these packets 316 316
and figuring out what did the bad guy do on your system 317 317
because you'll be able to see what the bad guy did 318 318
because it's capturing everything, 319 319
both the server side and the client side, 320 320
or if you're using it for pen test plus. 321 321
If you got this type of data, 322 322
you now have access to that person's username and password 323 323
that you can use as a follow on in your pen test.