-: In this lesson, I'm going to use a tool known as Wireshark, 2 2
which is a packet analyzer, 3 3
to be able to pull apart some network traffic 4 4
and show you the different layers of the OSI model. 5 5
Now, the actual usage of this tool known as Wireshark 6 6
is not covered by the Network+ exam. 7 7
You do need to know that this tool is a packet analyzer 8 8
and what kind of functions we might use it for. 9 9
And we'll talk about those specifically 10 10
in the troubleshooting section. 11 11
But for right now, I just want you to focus 12 12
on how I'm pulling apart these different layers 13 13
and the type of information I can get from Wireshark. 14 14
Again, this is going to be further and more in depth 15 15
than you need to know for the exam, 16 16
but it's going to help you understand 17 17
the OSI model a little bit better 18 18
as we start putting these pieces together from this theory 19 19
into something that's actually used on the network. 20 20
So let's jump into the environment and take a look. 21 21
All right, welcome to Wireshark. 22 22
Now, the first thing we need to do 23 23
is have a file to look at. 24 24
So I have a couple of different packet captures, 25 25
and I'm just going to open one up here, 26 26
and it's going to be right here. 27 27
This is an HTTP connection. 28 28
So what I'm showing here on the screen 29 29
is everything that happened for one computer 30 30
to make a request from my computer to a server and back. 31 31
So, as you can see here, it starts at time zero, 32 32
the source IP is my machine that sent the request, 33 33
and the destination IP is the server I'm trying to go to. 34 34
That's how we read these things. 35 35
It's time, source, destination, 36 36
the protocol used, in this case, TCP, 37 37
which we'll talk about later in the course, 38 38
and then the information that was sent. 39 39
As you go through, 40 40
you'll see there's this two-way conversation 41 41
going back and forth between the two, 42 42
and this is all at the packet layer. 43 43
And what you're seeing here is actually the session traffic 44 44
that was captured from one host to one server. 45 45
Now, as I scroll down a little bit further, 46 46
you're going to see it goes down 47 47
to 43 different line items happened. 48 48
It took 30 seconds total. 49 49
And we're going to go in and look at some of this information. 50 50
So let me go into this first packet. 51 51
And here, in the middle section, 52 52
you'll see that we have Frame 1. This was the first frame. 53 53
Now, going back to our OSI model, what is frame? 54 54
Where do frames operate? 55 55
Well, they operate at layer 2. 56 56
So I should expect to see some layer 2 data in here. 57 57
What type of things are layer 2 data? 58 58
Well, things like MAC addresses. 59 59
So if I open this up, 60 60
you're going to see that the encapsulation type was ethernet, 61 61
which is a layer 2 protocol. 62 62
We can see the time it arrived. 63 63
We can see the time that it left. 64 64
We can see what frame number it was 65 65
and how long the frame was. 66 66
We can see how much was captured, 67 67
and all that type of information there. 68 68
Next, if I go into Ethernet II, 69 69
this, again, is part of ethernet, which is layer 2, 70 70
and inside layer 2, 71 71
we can see our destination and our source. 72 72
So this is our destination. 73 73
This is the server I was trying to get to. 74 74
It's the MAC address. 75 75
And underneath it, we can see the source, 76 76
which is the machine that I had that made the request. 77 77
And it happened over IPv4. 78 78
And if I bring this down, you can actually see it 79 79
even further details. 80 80
Now, the next thing I'm going to look at is IPv4. 81 81
When we start talking about IP, 82 82
what are we talking about now? 83 83
We're talking about layer 3 84 84
because we're talking about Internet Protocol. 85 85
This means that we're going to have source and destination IPs, 86 86
as you can see here, highlighted in blue. 87 87
And if I open that up, you'll see that this was version 4, 88 88
we can see the header length, 89 89
and then we can actually dig into that packet. 90 90
But again, way beyond the scope of Network+. 91 91
The big thing we want to take away is, 92 92
layer 2 is MAC addresses, layer 3 was IPs. 93 93
Now, we go to layer 4, we're going to be talking about, 94 94
did we use TCP or UDP? 95 95
In this case, we used TCP. 96 96
So this is our layer 4 of the OSI model. 97 97
And as you can see, we're building up each of these layers 98 98
and all of that was one packet. 99 99
So the next one I'm going to do 100 100
is the one that came back from the server to the host. 101 101
So we sent the SYN over, and now we got back a SYN-ACK. 102 102
As we look at that, we can see the same type of information, 103 103
the same layout each time. 104 104
You'll see that we have our frame, 105 105
our layer 2 addresses, our IP addresses, 106 106
and then our TCP protocol layer 4. 107 107
So layer 2, layer 2, layer 3, layer 4. 108 108
And we can go through the entire packet 109 109
and look at each and every one of them. 110 110
Now, if I want to figure out what was happening 111 111
during this session, I can do that as well. 112 112
So if I go in here, 113 113
I can see that there was a GET request over HTTP. 114 114
Now, HTTP is a protocol. It's an application. 115 115
So this is actually a layer 7 capture here. 116 116
And what was done, if I open this up, 117 117
I can see that they went to the server etherreal.com, 118 118
they were using Mozilla, which is Firefox, 119 119
and that they came from this webpage, 120 120
etherreal.com/development.html, 121 121
and they clicked on the link for download.html. 122 122
And that's what we're asking for. 123 123
We're asking for the webpage, download.html at this point. 124 124
This then is acknowledged by the server 125 125
and goes back and forth 126 126
as we're getting more and more data. 127 127
And eventually, we get that webpage downloaded. 128 128
In fact, if I right-click on this, 129 129
I can tell it to follow the stream, 130 130
and I can see what that webpage looked like. 131 131
Now, this webpage is being shown to me in HTML 132 132
because that's how webpages are sent, 133 133
but this is exactly what this person got 134 134
when they went to that website, 135 135
and we captured all that in this network packet. 136 136
I could actually copy this, make it into an HTML file, 137 137
and then load it up inside of Internet Explorer, 138 138
or Edge, or Google Chrome, or Firefox 139 139
and be able to look at all of that. 140 140
So I think that's enough of that packet. 141 141
Let's take a look at another one 142 142
and see if it looks similar. 143 143
The next one I'm going to look at 144 144
is this one here that says FTP. 145 145
And what FTP is going to do is File Transfer Protocol. 146 146
It's going to be very similar. 147 147
You're going to see that we went from a source 148 148
to a destination, and then went back and forth 149 149
a whole bunch of different times. 150 150
And in this case, it was a much longer stream. 151 151
561 different packets went through that were captured. 152 152
So if I go back to the first one, 153 153
you'll see that there was this acknowledgement, 154 154
and they went back and forth, 155 155
and we can go through here and see frame. 156 156
Again, that's layer 2. 157 157
Ethernet. 158 158
And so again, we can see the source and the destination 159 159
as far as those MAC addresses. 160 160
If we go down to the next one, we go up to layer 3. 161 161
We're now seeing the source and destination IP addresses. 162 162
And when we get to layer 4, 163 163
we're able to see that this was a TCP session, 164 164
Transmission Control Protocol. 165 165
And so again, if I wanted to, 166 166
I can right-click this and follow that stream. 167 167
Now, when I follow that stream, what am I going to see? 168 168
I'm not going to see a pretty webpage 169 169
because this was FTP traffic. 170 170
Somebody was downloading a file. 171 171
All of this, if I convert it back 172 172
into its hexadecimal or binary format, 173 173
let's go to RAW, for instance, 174 174
I can copy this in and try to figure out 175 175
what type of file it was and put that back together. 176 176
That's what happens with network forensics 177 177
and digital forensics. 178 178
Way beyond the scope of this particular course, 179 179
but that's the idea here. 180 180
You can capture everything going over the network 181 181
into these PCAP files, packet capture files, 182 182
and you'll be able to open them inside of Wireshark 183 183
to see what type of traffic is being used on your network. 184 184
And as a network technician, 185 185
really, you're going to be focused mostly on this screen, 186 186
the source and the destination, 187 187
the protocol, and even the ports. 188 188
You can see here it went from port 80, the web port, 189 189
to port 2727. 190 190
The server then answered up from 2727 back to port 80, 191 191
and they went back and forth throughout this communication. 192 192
Let's open up one more. We're going to open up Telnet. 193 193
Now, Telnet is a way to remotely control a computer. 194 194
Again, you're going to see that we have the time, 195 195
the source, the destination, and the protocol, 196 196
just like we did before. 197 197
We have our SYN, SYN-ACK, ACK, 198 198
which is that three-way handshake. 199 199
And again, down here, we have layer 2, layer 2, 200 200
layer 3, and layer 4. 201 201
Now, in the protocol column, you're going to see TCP, 202 202
but you're also going to see this Telnet data. 203 203
And that is an application, so this is layer seven again, 204 204
just like we saw with HTTP before. 205 205
And if I go over here, I can see that layer 7 now is added, 206 206
and I get different information for that. 207 207
If I go through and right-click it and follow that stream, 208 208
let's see what we get this time. 209 209
There we go. 210 210
So what we're seeing is the person and their session 211 211
when they try to connect to a Telnet server. 212 212
So what you see in blue is what the server sent back. 213 213
So when they connected, the server said, "Hey, 214 214
"I'm an OpenBSD server, log in." 215 215
What the person did was they typed, F-A-K-E, 216 216
which you can see is red. 217 217
That's what the user sent to the server. 218 218
And the blue is what the server displayed on the screen, 219 219
which was F-A-K-E, so their username was fake. 220 220
Then, it asked for their password 221 221
and the user typed in, user. 222 222
So their username is fake and their password is user. 223 223
At this point, they were able to log into the server 224 224
and start running commands. 225 225
They ran the ls command, 226 226
which if you remember from A+, on a Unix system, 227 227
it's going to list the contents of a directory. 228 228
And then, they did it again, ls -a. 229 229
They wanted to see it going across the side. 230 230
And you saw, this is what came back. 231 231
This is the list of directories. 232 232
Then, they tried to run a program, 233 233
sbin/ping www.yahoo.com, 234 234
and that is showing that they tried to do a ping 235 235
from this Telnet server out to yahoo.com, 236 236
and they received this information back. 237 237
Now, we're seeing the entire conversation. 238 238
We're seeing both halves. 239 239
But if I wanted to see 240 240
just what one person sent to the other, 241 241
I can see the server side. 242 242
It's a lot easier to read, right? 243 243
But now, I don't see that password. 244 244
I don't see the commands that got sent over. 245 245
When I go here and I switched over to the client side, 246 246
this is what they typed in. 247 247
I can see that they typed in user, which was their password, 248 248
fake, which was their username, 249 249
and then the commands, the list command, the list all, 250 250
and the sbin/ping www.yahoo.com, and then exit. 251 251
So you can see how this is useful, 252 252
where we can start digging into this stuff. 253 253
If you go further in your career with CompTIA 254 254
and you go to your Cybersecurity Analyst training 255 255
or your PenTest+ training, 256 256
you'll get very familiar with Wireshark 257 257
and be able to dig in 258 258
and grab this information from the wire. 259 259
Now, again, like I said, 260 260
this video is a little bit beyond the scope 261 261
of what you need to know for the Network+ exam, 262 262
but hopefully, I've whetted your appetite, 263 263
where you're really interested in being able to learn more 264 264
about Wireshark and be able to learn how you can use this, 265 265
both as a network technician, 266 266
be able to see where the breakdown in communication is, 267 267
whether it's layer 2, layer 3, layer 4, or layer 7, 268 268
or using it more from the defense side, 269 269
with cybersecurity analysts going through these packets 270 270
and figuring out what did the bad guy do on your system, 271 271
because you'll be able to see what the bad guy did 272 272
because it's capturing everything, 273 273
both the server side and the client side, 274 274
or if you're using it for PenTest+, 275 275
if you got this type of data, 276 276
you now have access to that person's username and password 277 277
that you can use as a follow on in your pentest. 278 278
So I hope you enjoyed this video. 279 279
Now, let's get back to Network+.