1 1 00:00:00,570 --> 00:00:03,860 In this lesson, I'm going to use a tool known as Wireshark, 2 2 00:00:03,860 --> 00:00:05,660 which is a packet analyzer, 3 3 00:00:05,660 --> 00:00:07,870 to be able to pull apart some network traffic 4 4 00:00:07,870 --> 00:00:11,190 and show you the different layers of the OSI model. 5 5 00:00:11,190 --> 00:00:14,180 Now, the actual usage of this tool known as Wireshark 6 6 00:00:14,180 --> 00:00:16,760 is not covered by the Network+ exam. 7 7 00:00:16,760 --> 00:00:19,360 You do need to know that this tool is a packet analyzer 8 8 00:00:19,360 --> 00:00:21,680 and what kind of functions we might use it for. 9 9 00:00:21,680 --> 00:00:23,170 And we'll talk about those specifically 10 10 00:00:23,170 --> 00:00:24,800 in the troubleshooting section. 11 11 00:00:24,800 --> 00:00:27,060 But for right now, I just want you to focus 12 12 00:00:27,060 --> 00:00:29,420 on how I'm pulling apart these different layers 13 13 00:00:29,420 --> 00:00:32,990 and the type of information I can get from Wireshark. 14 14 00:00:32,990 --> 00:00:35,310 Again, this is going to be further and more in depth 15 15 00:00:35,310 --> 00:00:36,950 than you need to know for the exam, 16 16 00:00:36,950 --> 00:00:38,930 but it's going to help you understand 17 17 00:00:38,930 --> 00:00:41,110 the OSI model a little bit better 18 18 00:00:41,110 --> 00:00:44,360 as we start putting these pieces together from this theory 19 19 00:00:44,360 --> 00:00:46,770 into something that's actually used on the network. 20 20 00:00:46,770 --> 00:00:49,500 So let's jump into the environment and take a look. 21 21 00:00:49,500 --> 00:00:51,630 All right, welcome to Wireshark. 22 22 00:00:51,630 --> 00:00:53,020 Now, the first thing we need to do 23 23 00:00:53,020 --> 00:00:54,710 is have a file to look at. 24 24 00:00:54,710 --> 00:00:56,750 So I have a couple of different packet captures, 25 25 00:00:56,750 --> 00:00:58,790 and I'm just going to open one up here, 26 26 00:00:58,790 --> 00:01:01,360 and it's going to be right here. 27 27 00:01:01,360 --> 00:01:04,330 This is an HTTP connection. 28 28 00:01:04,330 --> 00:01:06,880 So what I'm showing here on the screen 29 29 00:01:06,880 --> 00:01:09,780 is everything that happened for one computer 30 30 00:01:09,780 --> 00:01:14,380 to make a request from my computer to a server and back. 31 31 00:01:14,380 --> 00:01:17,510 So, as you can see here, it starts at time zero, 32 32 00:01:17,510 --> 00:01:20,530 the source IP is my machine that sent the request, 33 33 00:01:20,530 --> 00:01:23,940 and the destination IP is the server I'm trying to go to. 34 34 00:01:23,940 --> 00:01:25,340 That's how we read these things. 35 35 00:01:25,340 --> 00:01:28,030 It's time, source, destination, 36 36 00:01:28,030 --> 00:01:30,470 the protocol used, in this case, TCP, 37 37 00:01:30,470 --> 00:01:32,360 which we'll talk about later in the course, 38 38 00:01:32,360 --> 00:01:34,920 and then the information that was sent. 39 39 00:01:34,920 --> 00:01:35,753 As you go through, 40 40 00:01:35,753 --> 00:01:37,250 you'll see there's this two-way conversation 41 41 00:01:37,250 --> 00:01:39,250 going back and forth between the two, 42 42 00:01:39,250 --> 00:01:41,223 and this is all at the packet layer. 43 43 00:01:42,290 --> 00:01:45,220 And what you're seeing here is actually the session traffic 44 44 00:01:45,220 --> 00:01:49,630 that was captured from one host to one server. 45 45 00:01:49,630 --> 00:01:51,350 Now, as I scroll down a little bit further, 46 46 00:01:51,350 --> 00:01:52,560 you're going to see it goes down 47 47 00:01:52,560 --> 00:01:54,580 to 43 different line items happened. 48 48 00:01:54,580 --> 00:01:56,680 It took 30 seconds total. 49 49 00:01:56,680 --> 00:01:59,030 And we're going to go in and look at some of this information. 50 50 00:01:59,030 --> 00:02:01,040 So let me go into this first packet. 51 51 00:02:01,040 --> 00:02:02,890 And here, in the middle section, 52 52 00:02:02,890 --> 00:02:06,680 you'll see that we have Frame 1. This was the first frame. 53 53 00:02:06,680 --> 00:02:10,840 Now, going back to our OSI model, what is frame? 54 54 00:02:10,840 --> 00:02:12,330 Where do frames operate? 55 55 00:02:12,330 --> 00:02:14,440 Well, they operate at layer 2. 56 56 00:02:14,440 --> 00:02:17,540 So I should expect to see some layer 2 data in here. 57 57 00:02:17,540 --> 00:02:19,250 What type of things are layer 2 data? 58 58 00:02:19,250 --> 00:02:21,260 Well, things like MAC addresses. 59 59 00:02:21,260 --> 00:02:22,770 So if I open this up, 60 60 00:02:22,770 --> 00:02:25,920 you're going to see that the encapsulation type was ethernet, 61 61 00:02:25,920 --> 00:02:28,150 which is a layer 2 protocol. 62 62 00:02:28,150 --> 00:02:29,750 We can see the time it arrived. 63 63 00:02:29,750 --> 00:02:31,120 We can see the time that it left. 64 64 00:02:31,120 --> 00:02:32,470 We can see what frame number it was 65 65 00:02:32,470 --> 00:02:34,280 and how long the frame was. 66 66 00:02:34,280 --> 00:02:36,120 We can see how much was captured, 67 67 00:02:36,120 --> 00:02:38,610 and all that type of information there. 68 68 00:02:38,610 --> 00:02:40,580 Next, if I go into Ethernet II, 69 69 00:02:40,580 --> 00:02:44,280 this, again, is part of ethernet, which is layer 2, 70 70 00:02:44,280 --> 00:02:45,320 and inside layer 2, 71 71 00:02:45,320 --> 00:02:48,290 we can see our destination and our source. 72 72 00:02:48,290 --> 00:02:49,700 So this is our destination. 73 73 00:02:49,700 --> 00:02:51,270 This is the server I was trying to get to. 74 74 00:02:51,270 --> 00:02:52,740 It's the MAC address. 75 75 00:02:52,740 --> 00:02:54,770 And underneath it, we can see the source, 76 76 00:02:54,770 --> 00:02:57,770 which is the machine that I had that made the request. 77 77 00:02:57,770 --> 00:02:59,950 And it happened over IPv4. 78 78 00:02:59,950 --> 00:03:01,980 And if I bring this down, you can actually see it 79 79 00:03:01,980 --> 00:03:03,840 even further details. 80 80 00:03:03,840 --> 00:03:06,620 Now, the next thing I'm going to look at is IPv4. 81 81 00:03:06,620 --> 00:03:08,570 When we start talking about IP, 82 82 00:03:08,570 --> 00:03:09,960 what are we talking about now? 83 83 00:03:09,960 --> 00:03:11,700 We're talking about layer 3 84 84 00:03:11,700 --> 00:03:13,630 because we're talking about Internet Protocol. 85 85 00:03:13,630 --> 00:03:16,240 This means that we're going to have source and destination IPs, 86 86 00:03:16,240 --> 00:03:18,560 as you can see here, highlighted in blue. 87 87 00:03:18,560 --> 00:03:21,690 And if I open that up, you'll see that this was version 4, 88 88 00:03:21,690 --> 00:03:23,090 we can see the header length, 89 89 00:03:23,090 --> 00:03:25,080 and then we can actually dig into that packet. 90 90 00:03:25,080 --> 00:03:28,170 But again, way beyond the scope of Network+. 91 91 00:03:28,170 --> 00:03:29,540 The big thing we want to take away is, 92 92 00:03:29,540 --> 00:03:33,600 layer 2 is MAC addresses, layer 3 was IPs. 93 93 00:03:33,600 --> 00:03:36,270 Now, we go to layer 4, we're going to be talking about, 94 94 00:03:36,270 --> 00:03:38,670 did we use TCP or UDP? 95 95 00:03:38,670 --> 00:03:40,540 In this case, we used TCP. 96 96 00:03:40,540 --> 00:03:43,130 So this is our layer 4 of the OSI model. 97 97 00:03:43,130 --> 00:03:46,060 And as you can see, we're building up each of these layers 98 98 00:03:46,060 --> 00:03:49,420 and all of that was one packet. 99 99 00:03:49,420 --> 00:03:51,100 So the next one I'm going to do 100 100 00:03:51,100 --> 00:03:55,150 is the one that came back from the server to the host. 101 101 00:03:55,150 --> 00:03:59,270 So we sent the SYN over, and now we got back a SYN-ACK. 102 102 00:03:59,270 --> 00:04:02,670 As we look at that, we can see the same type of information, 103 103 00:04:02,670 --> 00:04:04,600 the same layout each time. 104 104 00:04:04,600 --> 00:04:06,530 You'll see that we have our frame, 105 105 00:04:06,530 --> 00:04:09,110 our layer 2 addresses, our IP addresses, 106 106 00:04:09,110 --> 00:04:11,660 and then our TCP protocol layer 4. 107 107 00:04:11,660 --> 00:04:15,900 So layer 2, layer 2, layer 3, layer 4. 108 108 00:04:15,900 --> 00:04:17,850 And we can go through the entire packet 109 109 00:04:17,850 --> 00:04:19,810 and look at each and every one of them. 110 110 00:04:19,810 --> 00:04:21,890 Now, if I want to figure out what was happening 111 111 00:04:21,890 --> 00:04:25,180 during this session, I can do that as well. 112 112 00:04:25,180 --> 00:04:26,760 So if I go in here, 113 113 00:04:26,760 --> 00:04:30,340 I can see that there was a GET request over HTTP. 114 114 00:04:30,340 --> 00:04:33,730 Now, HTTP is a protocol. It's an application. 115 115 00:04:33,730 --> 00:04:36,970 So this is actually a layer 7 capture here. 116 116 00:04:36,970 --> 00:04:39,970 And what was done, if I open this up, 117 117 00:04:39,970 --> 00:04:44,690 I can see that they went to the server etherreal.com, 118 118 00:04:44,690 --> 00:04:47,880 they were using Mozilla, which is Firefox, 119 119 00:04:47,880 --> 00:04:50,430 and that they came from this webpage, 120 120 00:04:50,430 --> 00:04:53,590 etherreal.com/development.html, 121 121 00:04:53,590 --> 00:04:56,670 and they clicked on the link for download.html. 122 122 00:04:56,670 --> 00:04:58,130 And that's what we're asking for. 123 123 00:04:58,130 --> 00:05:02,330 We're asking for the webpage, download.html at this point. 124 124 00:05:02,330 --> 00:05:04,630 This then is acknowledged by the server 125 125 00:05:04,630 --> 00:05:05,620 and goes back and forth 126 126 00:05:05,620 --> 00:05:07,600 as we're getting more and more data. 127 127 00:05:07,600 --> 00:05:09,960 And eventually, we get that webpage downloaded. 128 128 00:05:09,960 --> 00:05:12,580 In fact, if I right-click on this, 129 129 00:05:12,580 --> 00:05:15,750 I can tell it to follow the stream, 130 130 00:05:15,750 --> 00:05:19,170 and I can see what that webpage looked like. 131 131 00:05:19,170 --> 00:05:22,240 Now, this webpage is being shown to me in HTML 132 132 00:05:22,240 --> 00:05:24,370 because that's how webpages are sent, 133 133 00:05:24,370 --> 00:05:26,610 but this is exactly what this person got 134 134 00:05:26,610 --> 00:05:28,220 when they went to that website, 135 135 00:05:28,220 --> 00:05:31,080 and we captured all that in this network packet. 136 136 00:05:31,080 --> 00:05:34,500 I could actually copy this, make it into an HTML file, 137 137 00:05:34,500 --> 00:05:36,880 and then load it up inside of Internet Explorer, 138 138 00:05:36,880 --> 00:05:39,660 or Edge, or Google Chrome, or Firefox 139 139 00:05:39,660 --> 00:05:41,570 and be able to look at all of that. 140 140 00:05:41,570 --> 00:05:43,200 So I think that's enough of that packet. 141 141 00:05:43,200 --> 00:05:44,250 Let's take a look at another one 142 142 00:05:44,250 --> 00:05:45,960 and see if it looks similar. 143 143 00:05:45,960 --> 00:05:48,130 The next one I'm going to look at 144 144 00:05:48,130 --> 00:05:50,600 is this one here that says FTP. 145 145 00:05:50,600 --> 00:05:54,230 And what FTP is going to do is File Transfer Protocol. 146 146 00:05:54,230 --> 00:05:55,230 It's going to be very similar. 147 147 00:05:55,230 --> 00:05:57,180 You're going to see that we went from a source 148 148 00:05:57,180 --> 00:05:59,570 to a destination, and then went back and forth 149 149 00:05:59,570 --> 00:06:01,020 a whole bunch of different times. 150 150 00:06:01,020 --> 00:06:03,150 And in this case, it was a much longer stream. 151 151 00:06:03,150 --> 00:06:07,460 561 different packets went through that were captured. 152 152 00:06:07,460 --> 00:06:09,890 So if I go back to the first one, 153 153 00:06:09,890 --> 00:06:11,930 you'll see that there was this acknowledgement, 154 154 00:06:11,930 --> 00:06:13,670 and they went back and forth, 155 155 00:06:13,670 --> 00:06:16,100 and we can go through here and see frame. 156 156 00:06:16,100 --> 00:06:17,660 Again, that's layer 2. 157 157 00:06:17,660 --> 00:06:18,930 Ethernet. 158 158 00:06:18,930 --> 00:06:22,060 And so again, we can see the source and the destination 159 159 00:06:22,060 --> 00:06:23,810 as far as those MAC addresses. 160 160 00:06:23,810 --> 00:06:26,310 If we go down to the next one, we go up to layer 3. 161 161 00:06:26,310 --> 00:06:29,580 We're now seeing the source and destination IP addresses. 162 162 00:06:29,580 --> 00:06:31,160 And when we get to layer 4, 163 163 00:06:31,160 --> 00:06:33,950 we're able to see that this was a TCP session, 164 164 00:06:33,950 --> 00:06:35,603 Transmission Control Protocol. 165 165 00:06:36,480 --> 00:06:37,860 And so again, if I wanted to, 166 166 00:06:37,860 --> 00:06:40,990 I can right-click this and follow that stream. 167 167 00:06:40,990 --> 00:06:44,660 Now, when I follow that stream, what am I going to see? 168 168 00:06:44,660 --> 00:06:46,120 I'm not going to see a pretty webpage 169 169 00:06:46,120 --> 00:06:48,140 because this was FTP traffic. 170 170 00:06:48,140 --> 00:06:50,360 Somebody was downloading a file. 171 171 00:06:50,360 --> 00:06:52,430 All of this, if I convert it back 172 172 00:06:52,430 --> 00:06:55,240 into its hexadecimal or binary format, 173 173 00:06:55,240 --> 00:06:57,190 let's go to RAW, for instance, 174 174 00:06:57,190 --> 00:06:59,270 I can copy this in and try to figure out 175 175 00:06:59,270 --> 00:07:01,820 what type of file it was and put that back together. 176 176 00:07:01,820 --> 00:07:03,690 That's what happens with network forensics 177 177 00:07:03,690 --> 00:07:05,050 and digital forensics. 178 178 00:07:05,050 --> 00:07:07,630 Way beyond the scope of this particular course, 179 179 00:07:07,630 --> 00:07:08,920 but that's the idea here. 180 180 00:07:08,920 --> 00:07:10,890 You can capture everything going over the network 181 181 00:07:10,890 --> 00:07:14,170 into these PCAP files, packet capture files, 182 182 00:07:14,170 --> 00:07:16,530 and you'll be able to open them inside of Wireshark 183 183 00:07:16,530 --> 00:07:19,320 to see what type of traffic is being used on your network. 184 184 00:07:19,320 --> 00:07:20,930 And as a network technician, 185 185 00:07:20,930 --> 00:07:23,220 really, you're going to be focused mostly on this screen, 186 186 00:07:23,220 --> 00:07:25,070 the source and the destination, 187 187 00:07:25,070 --> 00:07:26,970 the protocol, and even the ports. 188 188 00:07:26,970 --> 00:07:30,000 You can see here it went from port 80, the web port, 189 189 00:07:30,000 --> 00:07:32,020 to port 2727. 190 190 00:07:32,020 --> 00:07:36,410 The server then answered up from 2727 back to port 80, 191 191 00:07:36,410 --> 00:07:39,240 and they went back and forth throughout this communication. 192 192 00:07:39,240 --> 00:07:42,610 Let's open up one more. We're going to open up Telnet. 193 193 00:07:42,610 --> 00:07:45,600 Now, Telnet is a way to remotely control a computer. 194 194 00:07:45,600 --> 00:07:47,930 Again, you're going to see that we have the time, 195 195 00:07:47,930 --> 00:07:49,720 the source, the destination, and the protocol, 196 196 00:07:49,720 --> 00:07:51,140 just like we did before. 197 197 00:07:51,140 --> 00:07:53,940 We have our SYN, SYN-ACK, ACK, 198 198 00:07:53,940 --> 00:07:55,700 which is that three-way handshake. 199 199 00:07:55,700 --> 00:07:58,710 And again, down here, we have layer 2, layer 2, 200 200 00:07:58,710 --> 00:08:01,490 layer 3, and layer 4. 201 201 00:08:01,490 --> 00:08:04,860 Now, in the protocol column, you're going to see TCP, 202 202 00:08:04,860 --> 00:08:07,420 but you're also going to see this Telnet data. 203 203 00:08:07,420 --> 00:08:10,080 And that is an application, so this is layer seven again, 204 204 00:08:10,080 --> 00:08:12,670 just like we saw with HTTP before. 205 205 00:08:12,670 --> 00:08:15,660 And if I go over here, I can see that layer 7 now is added, 206 206 00:08:15,660 --> 00:08:18,610 and I get different information for that. 207 207 00:08:18,610 --> 00:08:22,510 If I go through and right-click it and follow that stream, 208 208 00:08:22,510 --> 00:08:24,110 let's see what we get this time. 209 209 00:08:25,300 --> 00:08:26,210 There we go. 210 210 00:08:26,210 --> 00:08:29,780 So what we're seeing is the person and their session 211 211 00:08:29,780 --> 00:08:32,580 when they try to connect to a Telnet server. 212 212 00:08:32,580 --> 00:08:37,380 So what you see in blue is what the server sent back. 213 213 00:08:37,380 --> 00:08:39,127 So when they connected, the server said, "Hey, 214 214 00:08:39,127 --> 00:08:42,760 "I'm an OpenBSD server, log in." 215 215 00:08:42,760 --> 00:08:47,560 What the person did was they typed, F-A-K-E, 216 216 00:08:47,560 --> 00:08:49,400 which you can see is red. 217 217 00:08:49,400 --> 00:08:51,700 That's what the user sent to the server. 218 218 00:08:51,700 --> 00:08:53,580 And the blue is what the server displayed on the screen, 219 219 00:08:53,580 --> 00:08:57,590 which was F-A-K-E, so their username was fake. 220 220 00:08:57,590 --> 00:08:59,460 Then, it asked for their password 221 221 00:08:59,460 --> 00:09:02,250 and the user typed in, user. 222 222 00:09:02,250 --> 00:09:05,840 So their username is fake and their password is user. 223 223 00:09:05,840 --> 00:09:08,360 At this point, they were able to log into the server 224 224 00:09:08,360 --> 00:09:09,390 and start running commands. 225 225 00:09:09,390 --> 00:09:11,330 They ran the ls command, 226 226 00:09:11,330 --> 00:09:14,330 which if you remember from A+, on a Unix system, 227 227 00:09:14,330 --> 00:09:17,000 it's going to list the contents of a directory. 228 228 00:09:17,000 --> 00:09:19,550 And then, they did it again, ls -a. 229 229 00:09:19,550 --> 00:09:22,080 They wanted to see it going across the side. 230 230 00:09:22,080 --> 00:09:24,130 And you saw, this is what came back. 231 231 00:09:24,130 --> 00:09:26,210 This is the list of directories. 232 232 00:09:26,210 --> 00:09:28,210 Then, they tried to run a program, 233 233 00:09:28,210 --> 00:09:32,870 sbin/ping www.yahoo.com, 234 234 00:09:32,870 --> 00:09:34,970 and that is showing that they tried to do a ping 235 235 00:09:34,970 --> 00:09:37,940 from this Telnet server out to yahoo.com, 236 236 00:09:37,940 --> 00:09:39,960 and they received this information back. 237 237 00:09:39,960 --> 00:09:41,840 Now, we're seeing the entire conversation. 238 238 00:09:41,840 --> 00:09:43,230 We're seeing both halves. 239 239 00:09:43,230 --> 00:09:44,600 But if I wanted to see 240 240 00:09:44,600 --> 00:09:47,040 just what one person sent to the other, 241 241 00:09:47,040 --> 00:09:48,740 I can see the server side. 242 242 00:09:48,740 --> 00:09:50,300 It's a lot easier to read, right? 243 243 00:09:50,300 --> 00:09:52,280 But now, I don't see that password. 244 244 00:09:52,280 --> 00:09:54,200 I don't see the commands that got sent over. 245 245 00:09:54,200 --> 00:09:57,720 When I go here and I switched over to the client side, 246 246 00:09:57,720 --> 00:09:59,450 this is what they typed in. 247 247 00:09:59,450 --> 00:10:02,660 I can see that they typed in user, which was their password, 248 248 00:10:02,660 --> 00:10:04,290 fake, which was their username, 249 249 00:10:04,290 --> 00:10:07,550 and then the commands, the list command, the list all, 250 250 00:10:07,550 --> 00:10:12,550 and the sbin/ping www.yahoo.com, and then exit. 251 251 00:10:13,130 --> 00:10:15,250 So you can see how this is useful, 252 252 00:10:15,250 --> 00:10:17,290 where we can start digging into this stuff. 253 253 00:10:17,290 --> 00:10:19,800 If you go further in your career with CompTIA 254 254 00:10:19,800 --> 00:10:22,100 and you go to your Cybersecurity Analyst training 255 255 00:10:22,100 --> 00:10:23,790 or your PenTest+ training, 256 256 00:10:23,790 --> 00:10:25,547 you'll get very familiar with Wireshark 257 257 00:10:25,547 --> 00:10:26,930 and be able to dig in 258 258 00:10:26,930 --> 00:10:29,830 and grab this information from the wire. 259 259 00:10:29,830 --> 00:10:31,200 Now, again, like I said, 260 260 00:10:31,200 --> 00:10:33,540 this video is a little bit beyond the scope 261 261 00:10:33,540 --> 00:10:35,740 of what you need to know for the Network+ exam, 262 262 00:10:35,740 --> 00:10:37,880 but hopefully, I've whetted your appetite, 263 263 00:10:37,880 --> 00:10:39,840 where you're really interested in being able to learn more 264 264 00:10:39,840 --> 00:10:42,600 about Wireshark and be able to learn how you can use this, 265 265 00:10:42,600 --> 00:10:44,270 both as a network technician, 266 266 00:10:44,270 --> 00:10:46,890 be able to see where the breakdown in communication is, 267 267 00:10:46,890 --> 00:10:51,200 whether it's layer 2, layer 3, layer 4, or layer 7, 268 268 00:10:51,200 --> 00:10:54,100 or using it more from the defense side, 269 269 00:10:54,100 --> 00:10:56,970 with cybersecurity analysts going through these packets 270 270 00:10:56,970 --> 00:10:59,610 and figuring out what did the bad guy do on your system, 271 271 00:10:59,610 --> 00:11:01,770 because you'll be able to see what the bad guy did 272 272 00:11:01,770 --> 00:11:03,510 because it's capturing everything, 273 273 00:11:03,510 --> 00:11:06,160 both the server side and the client side, 274 274 00:11:06,160 --> 00:11:07,860 or if you're using it for PenTest+, 275 275 00:11:07,860 --> 00:11:09,460 if you got this type of data, 276 276 00:11:09,460 --> 00:11:12,690 you now have access to that person's username and password 277 277 00:11:12,690 --> 00:11:15,450 that you can use as a follow on in your pentest. 278 278 00:11:15,450 --> 00:11:17,180 So I hope you enjoyed this video. 279 279 00:11:17,180 --> 00:11:19,143 Now, let's get back to Network+.