1 1 00:00:00,480 --> 00:00:01,470 In this lesson, 2 2 00:00:01,470 --> 00:00:03,750 I'm going to use a tool known as Wireshark 3 3 00:00:03,750 --> 00:00:04,993 which is a packet analyzer 4 4 00:00:04,993 --> 00:00:07,800 to be able to pull apart some network traffic 5 5 00:00:07,800 --> 00:00:10,860 and show you the different layers of the OSI model. 6 6 00:00:10,860 --> 00:00:11,760 But for right now, 7 7 00:00:11,760 --> 00:00:13,110 I just want you to focus 8 8 00:00:13,110 --> 00:00:15,540 on how I'm pulling apart these different layers 9 9 00:00:15,540 --> 00:00:19,080 and the type of information I can get from Wireshark. 10 10 00:00:19,080 --> 00:00:21,360 Again, this is going to be further and more in-depth 11 11 00:00:21,360 --> 00:00:23,040 than you need to know for the exam, 12 12 00:00:23,040 --> 00:00:25,950 but it's going to help you understand the OSI model 13 13 00:00:25,950 --> 00:00:26,862 a little bit better, 14 14 00:00:26,862 --> 00:00:29,400 as we start putting these pieces together 15 15 00:00:29,400 --> 00:00:30,450 from this theory, 16 16 00:00:30,450 --> 00:00:32,880 into something that's actually used on the network. 17 17 00:00:32,880 --> 00:00:35,670 So let's jump into the environment and take a look. 18 18 00:00:35,670 --> 00:00:37,830 Alright, welcome to Wireshark. 19 19 00:00:37,830 --> 00:00:40,890 Now the first thing we need to do is have a file to look at. 20 20 00:00:40,890 --> 00:00:42,930 So I have a couple of different packet captures 21 21 00:00:42,930 --> 00:00:45,000 and I'm just going to open one up here 22 22 00:00:45,000 --> 00:00:47,550 and it's going to be right here. 23 23 00:00:47,550 --> 00:00:50,520 This is an HTTP connection. 24 24 00:00:50,520 --> 00:00:53,070 So what I'm showing here on the screen, 25 25 00:00:53,070 --> 00:00:54,750 is everything that happened 26 26 00:00:54,750 --> 00:00:57,180 for one computer to make a request 27 27 00:00:57,180 --> 00:01:00,570 from my computer to a server and back. 28 28 00:01:00,570 --> 00:01:01,710 So as you can see here, 29 29 00:01:01,710 --> 00:01:03,720 it starts at time zero. 30 30 00:01:03,720 --> 00:01:06,780 The source IP is my machine that sent the request, 31 31 00:01:06,780 --> 00:01:10,140 and the destination IP is the server I'm trying to go to. 32 32 00:01:10,140 --> 00:01:11,520 That's how we read these things. 33 33 00:01:11,520 --> 00:01:13,110 It's time, source, 34 34 00:01:13,110 --> 00:01:15,180 destination, the protocol used, 35 35 00:01:15,180 --> 00:01:17,010 in this case TCP, 36 36 00:01:17,010 --> 00:01:19,560 and then the information that was sent. 37 37 00:01:19,560 --> 00:01:20,393 As you go through, 38 38 00:01:20,393 --> 00:01:21,930 you'll see there's this two-way conversation 39 39 00:01:21,930 --> 00:01:24,090 going back and forth between the two. 40 40 00:01:24,090 --> 00:01:25,140 And what you're seeing here, 41 41 00:01:25,140 --> 00:01:27,000 is actually the session traffic 42 42 00:01:27,000 --> 00:01:31,410 that was captured from one host to one server. 43 43 00:01:31,410 --> 00:01:33,120 Now as I scroll down a little bit further 44 44 00:01:33,120 --> 00:01:34,350 you're going to see it goes down 45 45 00:01:34,350 --> 00:01:36,360 to 43 different line items happened. 46 46 00:01:36,360 --> 00:01:38,460 It took 30 seconds total. 47 47 00:01:38,460 --> 00:01:40,830 And we're going to go in and look at some of this information. 48 48 00:01:40,830 --> 00:01:42,840 So let me go into this first packet, 49 49 00:01:42,840 --> 00:01:44,670 and here in the middle section, 50 50 00:01:44,670 --> 00:01:46,890 you'll see that we have frame one. 51 51 00:01:46,890 --> 00:01:48,450 This was the first frame. 52 52 00:01:48,450 --> 00:01:50,490 Now going back to our OSI model, 53 53 00:01:50,490 --> 00:01:52,620 what is frame? 54 54 00:01:52,620 --> 00:01:54,120 Where do frames operate? 55 55 00:01:54,120 --> 00:01:56,220 Well, they operate at layer two. 56 56 00:01:56,220 --> 00:01:59,340 So I should expect to see some layer two data in here. 57 57 00:01:59,340 --> 00:02:01,020 What type of things are layer two data? 58 58 00:02:01,020 --> 00:02:03,060 Well, things like Mac addresses. 59 59 00:02:03,060 --> 00:02:04,560 So if I open this up, 60 60 00:02:04,560 --> 00:02:07,710 you're going to see that the encapsulation type was ethernet 61 61 00:02:07,710 --> 00:02:09,930 which is a layer two protocol. 62 62 00:02:09,930 --> 00:02:11,520 We can see the time it arrived, 63 63 00:02:11,520 --> 00:02:12,900 we can see the time that it left. 64 64 00:02:12,900 --> 00:02:14,250 We can see what frame number it was 65 65 00:02:14,250 --> 00:02:16,050 and how long the frame was. 66 66 00:02:16,050 --> 00:02:17,880 We can see how much was captured 67 67 00:02:17,880 --> 00:02:20,052 and all that type of information there. 68 68 00:02:20,052 --> 00:02:22,350 Next, if I go into ethernet two, 69 69 00:02:22,350 --> 00:02:24,960 this again is part of ethernet, 70 70 00:02:24,960 --> 00:02:26,040 which is layer two. 71 71 00:02:26,040 --> 00:02:27,120 And inside layer two, 72 72 00:02:27,120 --> 00:02:30,090 we can see our destination and our source. 73 73 00:02:30,090 --> 00:02:31,470 So this is our destination. 74 74 00:02:31,470 --> 00:02:33,060 This is the server I was trying to get to. 75 75 00:02:33,060 --> 00:02:34,560 It's the MAC address. 76 76 00:02:34,560 --> 00:02:36,540 And underneath it we can see the source, 77 77 00:02:36,540 --> 00:02:39,540 which is the machine that I had that made the request 78 78 00:02:39,540 --> 00:02:41,730 and it happened over IPv4. 79 79 00:02:41,730 --> 00:02:42,690 And if I bring this down, 80 80 00:02:42,690 --> 00:02:45,630 you can actually see it even further details. 81 81 00:02:45,630 --> 00:02:48,390 Now, the next thing I'm going to look at is IPv4. 82 82 00:02:48,390 --> 00:02:50,340 When I start talking about IP, 83 83 00:02:50,340 --> 00:02:51,750 what are we talking about now? 84 84 00:02:51,750 --> 00:02:53,550 We're talking about layer three 85 85 00:02:53,550 --> 00:02:55,410 'cause we're talking about internet protocol. 86 86 00:02:55,410 --> 00:02:56,243 This means that 87 87 00:02:56,243 --> 00:02:58,020 we're going to have source and destination IPs 88 88 00:02:58,020 --> 00:03:00,330 as you can see here highlighted in blue. 89 89 00:03:00,330 --> 00:03:01,290 And if I open that up, 90 90 00:03:01,290 --> 00:03:03,450 you'll see that this was version four. 91 91 00:03:03,450 --> 00:03:04,890 We can see the header length 92 92 00:03:04,890 --> 00:03:06,870 and then we can actually dig into that packet. 93 93 00:03:06,870 --> 00:03:08,820 But again, way beyond the scope, 94 94 00:03:08,820 --> 00:03:10,170 the big thing we want to take away is, 95 95 00:03:10,170 --> 00:03:11,820 layer two is Mac addresses. 96 96 00:03:11,820 --> 00:03:14,250 Layer three was IPs. 97 97 00:03:14,250 --> 00:03:15,690 Now when we go to layer four, 98 98 00:03:15,690 --> 00:03:19,320 we're going to be talking about did we use TCP or UDP? 99 99 00:03:19,320 --> 00:03:21,180 In this case, we used TCP. 100 100 00:03:21,180 --> 00:03:23,760 So this is our layer four of the OSI model. 101 101 00:03:23,760 --> 00:03:24,690 And as you can see, 102 102 00:03:24,690 --> 00:03:26,700 we're building up each of these layers. 103 103 00:03:26,700 --> 00:03:29,640 And all of that was one packet, 104 104 00:03:29,640 --> 00:03:33,510 62 byte packet that we captured. 105 105 00:03:33,510 --> 00:03:35,190 So the next one I'm going to do, 106 106 00:03:35,190 --> 00:03:39,270 is the one that came back from the server to the host. 107 107 00:03:39,270 --> 00:03:40,770 So we sent the SYN over 108 108 00:03:40,770 --> 00:03:43,350 and now we got back a SYN, ACK. 109 109 00:03:43,350 --> 00:03:44,490 As we look at that, 110 110 00:03:44,490 --> 00:03:46,770 we can see the same type of information 111 111 00:03:46,770 --> 00:03:48,690 the same layout each time. 112 112 00:03:48,690 --> 00:03:50,610 You'll see that we have our frame, 113 113 00:03:50,610 --> 00:03:51,900 our layer two addresses, 114 114 00:03:51,900 --> 00:03:53,220 our IP addresses, 115 115 00:03:53,220 --> 00:03:55,740 and then our TCP protocol layer four. 116 116 00:03:55,740 --> 00:03:57,570 So layer two, layer two, 117 117 00:03:57,570 --> 00:04:00,030 layer three, layer four. Okay? 118 118 00:04:00,030 --> 00:04:01,950 And we can go through the entire packet 119 119 00:04:01,950 --> 00:04:03,900 and look at each and every one of them. 120 120 00:04:03,900 --> 00:04:05,010 Now, if I want to figure out 121 121 00:04:05,010 --> 00:04:07,770 what was happening during this session, 122 122 00:04:07,770 --> 00:04:09,270 I can do that as well. 123 123 00:04:09,270 --> 00:04:10,860 So if I go in here, 124 124 00:04:10,860 --> 00:04:14,430 I can see that there was a get request over HTTP. 125 125 00:04:14,430 --> 00:04:16,440 Now, HTTP is a protocol, 126 126 00:04:16,440 --> 00:04:17,820 it's an application. 127 127 00:04:17,820 --> 00:04:21,090 So this is actually a layer seven capture here. 128 128 00:04:21,090 --> 00:04:22,410 And what was done, 129 129 00:04:22,410 --> 00:04:24,060 if I open this up, 130 130 00:04:24,060 --> 00:04:25,830 I can see that they went 131 131 00:04:25,830 --> 00:04:28,770 to the server etherreal.com. 132 132 00:04:28,770 --> 00:04:30,180 They were using Mozilla, 133 133 00:04:30,180 --> 00:04:32,310 which is Firefox 134 134 00:04:32,310 --> 00:04:34,860 and that they came from this webpage, 135 135 00:04:34,860 --> 00:04:38,070 etherreal.com/development.html. 136 136 00:04:38,070 --> 00:04:41,100 And they clicked on the link for download html. 137 137 00:04:41,100 --> 00:04:42,540 And that's what we're asking for. 138 138 00:04:42,540 --> 00:04:43,760 We're asking for the webpage, 139 139 00:04:43,760 --> 00:04:46,740 to download HTML at this point. 140 140 00:04:46,740 --> 00:04:48,698 This then is acknowledged by the server 141 141 00:04:48,698 --> 00:04:50,040 and goes back and forth 142 142 00:04:50,040 --> 00:04:52,020 as they're getting more and more data. 143 143 00:04:52,020 --> 00:04:54,360 And eventually we get that webpage downloaded. 144 144 00:04:54,360 --> 00:04:57,000 In fact, if I right click on this, 145 145 00:04:57,000 --> 00:04:59,260 I can tell it to follow the stream 146 146 00:05:00,180 --> 00:05:03,570 and I can see what that webpage looked like. 147 147 00:05:03,570 --> 00:05:06,660 Now this webpage is being shown to me in HTML, 148 148 00:05:06,660 --> 00:05:08,820 because that's how webpages are sent, 149 149 00:05:08,820 --> 00:05:11,010 but this is exactly what this person got 150 150 00:05:11,010 --> 00:05:12,630 when they went to that website 151 151 00:05:12,630 --> 00:05:15,510 and we captured all that in this network packet. 152 152 00:05:15,510 --> 00:05:17,040 I could actually copy this, 153 153 00:05:17,040 --> 00:05:18,900 make it into an HTML file 154 154 00:05:18,900 --> 00:05:21,300 and then load it up inside of Internet Explorer 155 155 00:05:21,300 --> 00:05:24,060 or Edge or Google Chrome or Firefox 156 156 00:05:24,060 --> 00:05:26,430 and be able to look at all of that. 157 157 00:05:26,430 --> 00:05:28,080 So I think that's enough of that packet. 158 158 00:05:28,080 --> 00:05:29,100 Let's take a look at another one 159 159 00:05:29,100 --> 00:05:30,810 and see if it looks similar. 160 160 00:05:30,810 --> 00:05:32,691 The next one I'm going to look at, 161 161 00:05:32,691 --> 00:05:35,490 is this one here that says FTP. 162 162 00:05:35,490 --> 00:05:36,930 And what FTP is going to do, 163 163 00:05:36,930 --> 00:05:39,090 it's file transfer protocol. 164 164 00:05:39,090 --> 00:05:40,080 It's going to be very similar. 165 165 00:05:40,080 --> 00:05:40,913 You're going to see that 166 166 00:05:40,913 --> 00:05:43,380 we went from a source to a destination 167 167 00:05:43,380 --> 00:05:44,430 and they went back and forth 168 168 00:05:44,430 --> 00:05:45,870 a whole bunch of different times. 169 169 00:05:45,870 --> 00:05:46,770 And in this case, 170 170 00:05:46,770 --> 00:05:48,000 it was a much longer stream. 171 171 00:05:48,000 --> 00:05:52,320 561 different packets went through that were captured. 172 172 00:05:52,320 --> 00:05:54,750 So if I go back to the first one, 173 173 00:05:54,750 --> 00:05:56,790 you'll see that there was this acknowledgement 174 174 00:05:56,790 --> 00:05:58,530 and they went back and forth 175 175 00:05:58,530 --> 00:06:00,960 and we can go through here and see frame. 176 176 00:06:00,960 --> 00:06:03,930 Again, that's layer two ethernet. 177 177 00:06:03,930 --> 00:06:04,763 And so again, 178 178 00:06:04,763 --> 00:06:06,696 we can see the source and the destination 179 179 00:06:06,696 --> 00:06:08,820 as far as those Mac addresses. 180 180 00:06:08,820 --> 00:06:09,960 If we go down to the next one, 181 181 00:06:09,960 --> 00:06:11,310 we go up to layer three. 182 182 00:06:11,310 --> 00:06:14,580 We're now seeing the source and destination IP addresses. 183 183 00:06:14,580 --> 00:06:16,140 And when we get to layer four, 184 184 00:06:16,140 --> 00:06:18,930 we're able to see that this was a TCP session 185 185 00:06:18,930 --> 00:06:21,360 transmission control protocol. 186 186 00:06:21,360 --> 00:06:22,740 And so again, if I wanted to, 187 187 00:06:22,740 --> 00:06:25,890 I can right click this and follow that stream. 188 188 00:06:25,890 --> 00:06:28,080 Now, when I follow that stream, 189 189 00:06:28,080 --> 00:06:29,550 what am I going to see? 190 190 00:06:29,550 --> 00:06:31,020 I'm not going to see a pretty webpage 191 191 00:06:31,020 --> 00:06:33,030 because this was FTP traffic, 192 192 00:06:33,030 --> 00:06:35,220 somebody was downloading a file. 193 193 00:06:35,220 --> 00:06:36,270 All of this, 194 194 00:06:36,270 --> 00:06:40,110 if I convert it back into its hexadecimal or binary format, 195 195 00:06:40,110 --> 00:06:42,060 let's go to raw for instance, 196 196 00:06:42,060 --> 00:06:43,140 I can copy this in 197 197 00:06:43,140 --> 00:06:44,160 and try to figure out 198 198 00:06:44,160 --> 00:06:46,710 what type of file it was and put that back together. 199 199 00:06:46,710 --> 00:06:47,543 That's what happens 200 200 00:06:47,543 --> 00:06:49,920 with network forensics and digital forensics. 201 201 00:06:49,920 --> 00:06:52,530 Way beyond the scope of this particular course. 202 202 00:06:52,530 --> 00:06:53,820 But that's the idea here. 203 203 00:06:53,820 --> 00:06:55,800 You can capture everything going over the network 204 204 00:06:55,800 --> 00:06:57,480 into these PCAP files, 205 205 00:06:57,480 --> 00:06:59,070 packet capture files 206 206 00:06:59,070 --> 00:07:00,300 and you'll be able to open them 207 207 00:07:00,300 --> 00:07:01,410 inside of Wireshark 208 208 00:07:01,410 --> 00:07:04,050 to see what type of traffic is being used on your network. 209 209 00:07:04,050 --> 00:07:06,360 Really, you're going to be focused mostly on this screen, 210 210 00:07:06,360 --> 00:07:08,220 the source and the destination, 211 211 00:07:08,220 --> 00:07:10,110 the protocol and even the ports. 212 212 00:07:10,110 --> 00:07:11,899 You can see here it went from port 80 213 213 00:07:11,899 --> 00:07:15,180 the web port to port 2727. 214 214 00:07:15,180 --> 00:07:16,260 The server then answered up 215 215 00:07:16,260 --> 00:07:19,620 from 2727 back to port 80 216 216 00:07:19,620 --> 00:07:22,320 and they went back and forth throughout this communication. 217 217 00:07:22,320 --> 00:07:23,760 Let's open up one more. 218 218 00:07:23,760 --> 00:07:25,770 We're going to open up Telenet. 219 219 00:07:25,770 --> 00:07:28,740 Now, Telenet is a way to remotely control a computer. 220 220 00:07:28,740 --> 00:07:30,030 Again, you're going to see 221 221 00:07:30,030 --> 00:07:31,080 that we have the time, 222 222 00:07:31,080 --> 00:07:32,250 the source, the destination, 223 223 00:07:32,250 --> 00:07:33,083 and the protocol, 224 224 00:07:33,083 --> 00:07:34,290 just like we did before. 225 225 00:07:34,290 --> 00:07:35,460 We have our SYN, 226 226 00:07:35,460 --> 00:07:37,080 SYN ACK, ACK 227 227 00:07:37,080 --> 00:07:38,850 which is that three-way handshake. 228 228 00:07:38,850 --> 00:07:41,040 And again, down here we have layer two, 229 229 00:07:41,040 --> 00:07:44,670 layer two, layer three and layer four. 230 230 00:07:44,670 --> 00:07:46,380 Now in the protocol column, 231 231 00:07:46,380 --> 00:07:47,539 you're going to see TCP 232 232 00:07:47,539 --> 00:07:50,580 but you're also going to see this Telnet data 233 233 00:07:50,580 --> 00:07:51,900 and that is an application. 234 234 00:07:51,900 --> 00:07:53,250 So this is layer seven again, 235 235 00:07:53,250 --> 00:07:55,830 just like we saw with HTTP before. 236 236 00:07:55,830 --> 00:07:56,700 And if I go over here, 237 237 00:07:56,700 --> 00:07:58,800 I can see that layer seven now is added, 238 238 00:07:58,800 --> 00:08:01,770 and I get different information for that. 239 239 00:08:01,770 --> 00:08:03,300 If I go through and right click it 240 240 00:08:03,300 --> 00:08:05,670 and follow that stream, 241 241 00:08:05,670 --> 00:08:07,650 let's see what we get this time. 242 242 00:08:07,650 --> 00:08:08,580 There we go. 243 243 00:08:08,580 --> 00:08:12,120 So what we're seeing is the person and their session 244 244 00:08:12,120 --> 00:08:14,940 when they tried to connect to a Telenet server. 245 245 00:08:14,940 --> 00:08:19,740 So what you see in blue is what the server sent back. 246 246 00:08:19,740 --> 00:08:21,067 So when they connected the server said, 247 247 00:08:21,067 --> 00:08:25,110 "Hey I'm an open BSD server, log in." 248 248 00:08:25,110 --> 00:08:26,520 What the person did was, 249 249 00:08:26,520 --> 00:08:29,910 they typed F-A-K-E 250 250 00:08:29,910 --> 00:08:31,740 which you can see is red. 251 251 00:08:31,740 --> 00:08:34,050 That's what the user sent to the server, 252 252 00:08:34,050 --> 00:08:35,940 and the blue is what the server displayed on the screen 253 253 00:08:35,940 --> 00:08:38,010 which was F-A-K-E. 254 254 00:08:38,010 --> 00:08:39,930 So their username was fake. 255 255 00:08:39,930 --> 00:08:41,390 Then it asked for their password, 256 256 00:08:41,390 --> 00:08:43,940 and the user typed in user, 257 257 00:08:43,940 --> 00:08:45,930 so their username is fake 258 258 00:08:45,930 --> 00:08:48,180 and their password is user. 259 259 00:08:48,180 --> 00:08:49,110 At this point, 260 260 00:08:49,110 --> 00:08:50,700 they were able to log into the server 261 261 00:08:50,700 --> 00:08:51,750 and start running commands. 262 262 00:08:51,750 --> 00:08:53,700 They run the LS command, 263 263 00:08:53,700 --> 00:08:55,440 which if you remember from A+ 264 264 00:08:55,440 --> 00:08:56,670 on a Unix system, 265 265 00:08:56,670 --> 00:08:59,370 it's going to list the contents of a directory. 266 266 00:08:59,370 --> 00:09:01,890 And then they did it again, LS -a. 267 267 00:09:01,890 --> 00:09:04,440 They wanted to see it going across the side 268 268 00:09:04,440 --> 00:09:06,480 and you saw this is what came back. 269 269 00:09:06,480 --> 00:09:08,550 This is the list of directories. 270 270 00:09:08,550 --> 00:09:10,560 Then they tried to run a program 271 271 00:09:10,560 --> 00:09:15,210 sbin/ping www.yahoo.com, 272 272 00:09:15,210 --> 00:09:17,310 and that is showing that they try to do a ping 273 273 00:09:17,310 --> 00:09:19,020 from this Telenet server, 274 274 00:09:19,020 --> 00:09:20,280 out to yahoo.com 275 275 00:09:20,280 --> 00:09:22,320 and they receive this information back. 276 276 00:09:22,320 --> 00:09:24,180 Now we're seeing the entire conversation. 277 277 00:09:24,180 --> 00:09:25,590 We're seeing both halves, 278 278 00:09:25,590 --> 00:09:26,940 but if I wanted to see 279 279 00:09:26,940 --> 00:09:29,400 just what one person sent to the other, 280 280 00:09:29,400 --> 00:09:31,110 I can see the server side. 281 281 00:09:31,110 --> 00:09:32,670 It's a lot easier to read, right? 282 282 00:09:32,670 --> 00:09:33,960 But now I don't see that password. 283 283 00:09:33,960 --> 00:09:36,540 I don't see the commands that got sent over. 284 284 00:09:36,540 --> 00:09:37,740 When I go here, 285 285 00:09:37,740 --> 00:09:40,080 and I switch it over to the client side, 286 286 00:09:40,080 --> 00:09:41,323 this is what they typed in. 287 287 00:09:41,323 --> 00:09:43,770 I can see that they typed in user 288 288 00:09:43,770 --> 00:09:45,000 which was their password, 289 289 00:09:45,000 --> 00:09:46,770 fake, which was their username 290 290 00:09:46,770 --> 00:09:47,700 and then the commands, 291 291 00:09:47,700 --> 00:09:48,690 the list command, 292 292 00:09:48,690 --> 00:09:49,890 the list all 293 293 00:09:49,890 --> 00:09:53,940 and the sbin/ping www.yahoo.com, 294 294 00:09:53,940 --> 00:09:55,500 and then exit. 295 295 00:09:55,500 --> 00:09:57,600 So you can see how this is useful 296 296 00:09:57,600 --> 00:09:59,640 where we can start digging into this stuff. 297 297 00:09:59,640 --> 00:10:02,130 If you go in furthering your career with CompTIA 298 298 00:10:02,130 --> 00:10:04,050 and you go to your pen test plus training, 299 299 00:10:04,050 --> 00:10:06,180 you'll get very familiar with Wireshark 300 300 00:10:06,180 --> 00:10:07,170 and be able to dig in 301 301 00:10:07,170 --> 00:10:09,750 and grab this information from the wire. 302 302 00:10:09,750 --> 00:10:10,950 Now again, like I said, 303 303 00:10:10,950 --> 00:10:13,380 this video was a little bit beyond the scope 304 304 00:10:13,380 --> 00:10:14,850 of what you really need to know 305 305 00:10:14,850 --> 00:10:16,980 but hopefully I've wedded your appetite 306 306 00:10:16,980 --> 00:10:17,970 where you're really interested 307 307 00:10:17,970 --> 00:10:20,100 in being able to learn more about Wireshark 308 308 00:10:20,100 --> 00:10:21,660 and be able to learn how you can use this 309 309 00:10:21,660 --> 00:10:22,994 both as a network technician 310 310 00:10:22,994 --> 00:10:25,980 being able to see where the breakdown of communication is 311 311 00:10:25,980 --> 00:10:28,140 whether it's layer two, layer three, 312 312 00:10:28,140 --> 00:10:30,300 layer four or layer seven, 313 313 00:10:30,300 --> 00:10:33,180 or using it more from the defense side 314 314 00:10:33,180 --> 00:10:34,860 with cybersecurity analysts 315 315 00:10:34,860 --> 00:10:36,090 going through these packets 316 316 00:10:36,090 --> 00:10:38,730 and figuring out what did the bad guy do on your system 317 317 00:10:38,730 --> 00:10:40,890 because you'll be able to see what the bad guy did 318 318 00:10:40,890 --> 00:10:42,600 because it's capturing everything, 319 319 00:10:42,600 --> 00:10:45,270 both the server side and the client side, 320 320 00:10:45,270 --> 00:10:46,980 or if you're using it for pen test plus. 321 321 00:10:46,980 --> 00:10:48,194 If you got this type of data, 322 322 00:10:48,194 --> 00:10:51,810 you now have access to that person's username and password 323 323 00:10:51,810 --> 00:10:54,303 that you can use as a follow on in your pen test.