User: سلام
Assistant: سلام! چطور می‌توانم به شما کمک کنم؟
User: "WEBVTT
Kind: captions
Language: en

00:00:00.025 --> 00:00:04.000
Wireshark is one of the most powerful
network traffic analyzers for both Mac

00:00:04.001 --> 00:00:05.001
and Windows.

00:00:05.150 --> 00:00:08.030
I'm going to show you how to use
it to view the traffic on your network,

00:00:08.150 --> 00:00:14.000
analyze packet data, and identify
any problematic or malicious activity.

00:00:14.001 --> 00:00:18.000
This video is an update to a
Wireshark tutorial that I published over 8

00:00:18.050 --> 00:00:19.000
years ago.

00:00:19.001 --> 00:00:21.038
Since then, I've
learned a lot more about

00:00:21.050 --> 00:00:23.000
Wireshark and
cybersecurity in general.

00:00:23.300 --> 00:00:25.000
So let's get into it.

00:00:25.001 --> 00:00:28.000
Wireshark is free to download
and use for both Mac and Windows.

00:00:28.001 --> 00:00:30.400
When you first install it, there's an
additional package that you also have

00:00:30.401 --> 00:00:31.000
to install, at

00:00:31.001 --> 00:00:34.000
least on Mac, so just make sure to
read the readme files that you see when

00:00:34.001 --> 00:00:36.000
you first download it.

00:00:36.001 --> 00:00:37.918
Now once it's installed
and open, you can

00:00:37.930 --> 00:00:40.000
immediately see in the
capture section which

00:00:40.001 --> 00:00:42.000
network interface cards
are picking up traffic.

00:00:42.001 --> 00:00:43.470
You obviously have
to be connected to the

00:00:43.482 --> 00:00:45.000
networks that you
want to look at with the

00:00:45.001 --> 00:00:46.076
device, the computer that you're using.

00:00:46.100 --> 00:00:47.538
Generally speaking,
you're going to want

00:00:47.550 --> 00:00:49.000
to look at your
Ethernet or your Wi -Fi.

00:00:49.001 --> 00:00:51.036
Depending on your
hardware setup, it can be

00:00:51.048 --> 00:00:53.000
difficult to sniff the
packets on a Wi-Fi

00:00:53.001 --> 00:00:54.000
network.

00:00:54.001 --> 00:00:55.000
Mac users should be totally fine.

00:00:55.001 --> 00:00:58.000
They have been for a long time
with Wireshark able to do that.

00:00:58.001 --> 00:01:00.000
There has been some issues
with Windows in the past.

00:01:00.001 --> 00:01:03.000
So to get started and just to jump
right in and make sure we're getting good

00:01:03.001 --> 00:01:07.000
data, let's just double click
on Ethernet to take a look.

00:01:07.075 --> 00:01:09.049
When we double click,
immediately Wireshark

00:01:09.061 --> 00:01:11.000
starts capturing
packets and we can let it

00:01:11.001 --> 00:01:14.000
go and capture packets
for as long as we'd like.

00:01:14.001 --> 00:01:15.453
So if you're
troubleshooting a particular

00:01:15.465 --> 00:01:17.000
website or something
like that, you'll want

00:01:17.001 --> 00:01:20.000
to try and access that
website now while it's capturing.

00:01:20.001 --> 00:01:24.000
And then once you think you have
enough data, once enough time has gone by,

00:01:24.001 --> 00:01:26.013
you can go ahead
and you can click on the

00:01:26.025 --> 00:01:28.000
red stop button up
here at the top left.

00:01:28.150 --> 00:01:30.000
So now we have some
information to work with.

00:01:30.300 --> 00:01:35.000
You can see at the very bottom of
the screen, it tells us that it captured

00:01:35.001 --> 00:01:37.334
242 packets and
of those, all of them,

00:01:37.346 --> 00:01:40.000
100% of them are
currently being displayed.

00:01:40.001 --> 00:01:41.965
But as we filter things
here in Wireshark,

00:01:41.977 --> 00:01:44.000
we'll probably drill
that down so we're not

00:01:44.001 --> 00:01:45.000
seeing all of them at once.

00:01:45.001 --> 00:01:46.859
Each of the rows
that you see on the

00:01:46.871 --> 00:01:49.000
screen is a single
packet of information.

00:01:49.001 --> 00:01:50.989
Whenever information
is transferred over

00:01:51.001 --> 00:01:53.000
a network, it's
transferred via packets.

00:01:53.001 --> 00:01:57.000
That means that every time you load
a webpage, every time you upload or

00:01:57.001 --> 00:01:58.000
download something,

00:01:58.001 --> 00:02:00.109
packets of information
are being transferred

00:02:00.121 --> 00:02:02.000
between your computer
and a web server.

00:02:02.001 --> 00:02:05.000
There are also a bunch of packets,
especially nowadays, that are being

00:02:05.001 --> 00:02:06.000
transferred at any

00:02:06.001 --> 00:02:10.000
given time, especially as all of
your IoT devices, your smart devices,

00:02:10.001 --> 00:02:11.000
communicate with

00:02:11.001 --> 00:02:14.000
each other and the router to make
sure that they still have a connection.

00:02:14.001 --> 00:02:18.000
Because of this, one of the major
challenges of Wireshark and doing network

00:02:18.001 --> 00:02:19.000
audits in general

00:02:19.001 --> 00:02:22.000
is sifting through all of the unimportant
stuff, or at least the stuff that

00:02:22.001 --> 00:02:24.000
's not important right now.

00:02:24.025 --> 00:02:25.904
So I'm going to show
you how we can get

00:02:25.916 --> 00:02:28.000
a bird's eye view of
really just everything

00:02:28.001 --> 00:02:31.000
that's going on here in Wireshark
and then how we can go from there and

00:02:31.100 --> 00:02:35.000
filter things out to drill down and
find exactly what we're looking for.

00:02:35.050 --> 00:02:37.513
The first thing I like
to do when looking

00:02:37.525 --> 00:02:40.000
at a new packet
capture or a PCAP as it's

00:02:40.001 --> 00:02:44.000
known as, is to go up here in Wireshark
and go to the statistics dropdown.

00:02:44.350 --> 00:02:47.000
Now there are some
really cool statistics in here.

00:02:47.001 --> 00:02:48.000
I'm not going to go through all of them.

00:02:48.001 --> 00:02:52.000
I'm going to go to one particular,
but do note that this menu exists and it

00:02:52.001 --> 00:02:53.444
's a really good
place to go if you're

00:02:53.456 --> 00:02:55.026
looking for general
information on stuff,

00:02:55.050 --> 00:02:57.000
especially like this
capture file properties.

00:02:57.001 --> 00:03:01.000
This shows the properties of the
entire PCAP that you have in front of you.

00:03:01.001 --> 00:03:05.000
But what I want to do is I want to
click on this conversations option.

00:03:05.001 --> 00:03:07.577
Now when I do that,
this window pops up here

00:03:07.589 --> 00:03:10.000
in Wireshark and I
can now see all of the

00:03:10.001 --> 00:03:13.000
conversations that are part of
the PCAP that I just captured.

00:03:13.300 --> 00:03:16.000
So I can see, we have some tabs
up here at the top to go through the

00:03:16.001 --> 00:03:18.000
different protocols.

00:03:18.001 --> 00:03:22.000
So I could for instance go to the
TCP protocol and I can see that this

00:03:22.125 --> 00:03:24.000
particular IP address

00:03:24.001 --> 00:03:26.953
was communicating
with, this happens to be

00:03:26.965 --> 00:03:30.000
my computer's IP
address, and they sent 591

00:03:30.001 --> 00:03:31.026
bytes in this conversation.

00:03:31.050 --> 00:03:34.013
We can see how many
packets were sent from

00:03:34.025 --> 00:03:37.000
A to B3, from B to A4,
and how large those

00:03:37.001 --> 00:03:40.000
packets were, the duration of the
conversation, and all of this really cool

00:03:40.001 --> 00:03:41.000
information.

00:03:41.001 --> 00:03:43.012
I should mention that
any time you're doing

00:03:43.024 --> 00:03:45.000
network analysis, it's
a good idea to know

00:03:45.001 --> 00:03:47.000
some of the IP addresses on your network.

00:03:47.001 --> 00:03:52.000
So for example, I know that
my computer is 192.168.1.220.

00:03:52.001 --> 00:03:53.506
You can find that out
just by going to your

00:03:53.518 --> 00:03:55.000
network settings on
your computer, whether

00:03:55.001 --> 00:03:57.000
it's Mac or Windows,
it'll be right in there.

00:03:57.125 --> 00:03:59.000
You also might want to know
the IP address of your router.

00:03:59.001 --> 00:04:02.000
And if there's a particular device
that you're trying to troubleshoot, it's

00:04:02.001 --> 00:04:03.000
a good idea to

00:04:03.001 --> 00:04:04.918
know maybe the Mac
address of that device

00:04:04.930 --> 00:04:07.000
so that you can find
it and see if it's even

00:04:07.001 --> 00:04:09.000
accessing the network at all.

00:04:09.001 --> 00:04:12.000
One thing to look for in this section
is you could look and see if your

00:04:12.001 --> 00:04:13.000
computer, so looking

00:04:13.001 --> 00:04:17.000
at your computer's IP address, is
having any long conversations with an

00:04:17.001 --> 00:04:18.000
unknown device.

00:04:18.001 --> 00:04:21.000
If you see that happening, you could
then dig a little bit deeper in Wiresh

00:04:21.001 --> 00:04:22.941
ark and try and discover
what the purpose

00:04:22.953 --> 00:04:25.000
of the communication
is or what device it's

00:04:25.001 --> 00:04:27.000
trying to communicate with.

00:04:27.001 --> 00:04:28.669
And actually, that
brings up a good point,

00:04:28.681 --> 00:04:30.161
and I want to step
back for a second.

00:04:30.350 --> 00:04:33.263
You see, Wireshark is
an incredibly powerful

00:04:33.275 --> 00:04:36.000
tool, but it's kind of
like an open world

00:04:36.001 --> 00:04:38.000
sandbox game.

00:04:38.050 --> 00:04:41.000
It's better used with a
particular goal in mind.

00:04:41.001 --> 00:04:46.000
So some examples include a device not
working on your network, and maybe you

00:04:46.001 --> 00:04:50.000
can use Wireshark to see if
there's any communication at all.

00:04:50.001 --> 00:04:51.453
Maybe someone at
your organization thinks

00:04:51.465 --> 00:04:53.000
they've been phished,
so you want to reopen

00:04:53.001 --> 00:04:55.036
the link that they got
in the sketchy email

00:04:55.048 --> 00:04:57.000
while capturing with
Wireshark, obviously

00:04:57.001 --> 00:05:01.000
on a safe machine, to see
what information can be gathered.

00:05:01.001 --> 00:05:05.000
Or more simply, maybe just to see what
devices are constantly communicating

00:05:05.001 --> 00:05:08.000
on your network to see if you
can improve your bandwidth.

00:05:08.001 --> 00:05:12.000
Wireshark can help with all of
these situations, but the filters that you

00:05:12.001 --> 00:05:15.000
use and the packets that
you focus on will be different.

00:05:15.001 --> 00:05:17.458
So the rest of this
video will be focused

00:05:17.470 --> 00:05:20.000
on helping you learn
how to use W ireshark

00:05:20.001 --> 00:05:24.000
from a general perspective so that
you can then start to learn on your own

00:05:24.001 --> 00:05:27.000
and seek tutorials
specific to your situation.

00:05:27.400 --> 00:05:31.000
Okay, back to the conversation
statistics pop-up where we left off.

00:05:31.150 --> 00:05:34.000
Here is where some Wireshark
awesomeness happens.

00:05:34.001 --> 00:05:36.036
You see, I brought
you here to get a bird's

00:05:36.048 --> 00:05:38.000
eye view of everything
that's going on in

00:05:38.001 --> 00:05:40.196
Wireshark, but
we can actually use

00:05:40.208 --> 00:05:43.000
this screen to start
filtering our packets.

00:05:43.001 --> 00:05:46.000
So what we can do is we can find an
IP address that we want to, let's say we

00:05:46.001 --> 00:05:50.000
want to look at all the packets to
and from a particular IP address.

00:05:50.001 --> 00:05:51.313
So I have my IP
address and I want

00:05:51.325 --> 00:05:53.000
to find where it's in
this address A field.

00:05:53.001 --> 00:05:55.161
It's just going to make
it a little bit easier for us.

00:05:55.300 --> 00:05:59.000
And then I'm going to right click on
my IP address and I'm going to go to

00:05:59.001 --> 00:06:02.000
apply as filter.

00:06:02.001 --> 00:06:04.000
And then I'm going to go to selected
and we have a number of different

00:06:04.001 --> 00:06:05.000
options in here.

00:06:05.001 --> 00:06:07.000
I'm just going to quickly go over
them a little bit so you kind of have an

00:06:07.001 --> 00:06:09.000
idea of what's going on.

00:06:09.001 --> 00:06:12.000
But you'll notice that the first
one will filter on this particular

00:06:12.001 --> 00:06:13.000
conversation stream.

00:06:13.001 --> 00:06:15.000
So just this entire conversation.

00:06:15.350 --> 00:06:17.745
The A, B with the two
arrows will filter any

00:06:17.757 --> 00:06:20.000
packets that were sent
between both A and

00:06:20.001 --> 00:06:25.000
B. The A arrow to B will show any
packets sent from A to B. The next one is

00:06:25.001 --> 00:06:27.518
any packets B to A.
And then we've got this

00:06:27.530 --> 00:06:30.000
one, A is either
sending or receiving from

00:06:30.001 --> 00:06:32.000
any IP address.

00:06:32.001 --> 00:06:35.000
And that's the one that
we're actually going to use.

00:06:35.001 --> 00:06:38.000
But you can kind of use which
one is specific to your situation.

00:06:38.001 --> 00:06:40.036
So when I click on
this, you'll notice that

00:06:40.048 --> 00:06:42.000
a filter is now
automatically put up here

00:06:42.001 --> 00:06:43.001
in the top.

00:06:43.100 --> 00:06:48.000
And because we have the port in
here as well, the filter included the port,

00:06:48.001 --> 00:06:51.000
which I don't really want
for this particular situation.

00:06:51.150 --> 00:06:53.000
So I'm just going to close
out the conversation window.

00:06:53.001 --> 00:06:55.364
And then I can go
into my filter and I

00:06:55.376 --> 00:06:58.000
can just delete out
that port number part.

00:06:58.001 --> 00:07:03.000
So we can see it says
IP.addr=192.168.1.220.

00:07:03.001 --> 00:07:04.918
That is how you can
find any packets that

00:07:04.930 --> 00:07:07.000
were sent either to or
from that IP address.

00:07:07.001 --> 00:07:08.471
You could have typed
this in manually, but

00:07:08.483 --> 00:07:10.000
I showed you how
you can do it a little bit

00:07:10.001 --> 00:07:13.000
easier by right clicking
and applying those filters.

00:07:13.001 --> 00:07:14.000
You can do that from anywhere in Wireshark.

00:07:14.001 --> 00:07:18.000
So you can right click in
here and you can apply filters.

00:07:18.001 --> 00:07:21.000
You can follow conversations, which
we're going to look at in a second.

00:07:21.001 --> 00:07:23.000
But just don't be afraid
to use that right click.

00:07:23.001 --> 00:07:26.000
There's a lot of valuable
options from there.

00:07:26.001 --> 00:07:29.000
Now before we go any further, let's
capture a more interesting PCAP so that

00:07:29.001 --> 00:07:31.000
we have some additional
data to work with.

00:07:31.001 --> 00:07:35.000
So what I'm going to do is I'm just
going to go up here and I'm going to go

00:07:35.001 --> 00:07:36.000
to the file menu.

00:07:36.001 --> 00:07:38.000
I'm on Mac on Windows.

00:07:38.001 --> 00:07:40.036
Just click on the drop
down menu and you're

00:07:40.048 --> 00:07:42.000
just going to close
this particular PCAP.

00:07:42.001 --> 00:07:44.000
And it's going to ask you,
do you want to save it?

00:07:44.001 --> 00:07:45.000
You can save your PCAPs.

00:07:45.001 --> 00:07:47.151
You can export them to open
them up and send them to people.

00:07:47.175 --> 00:07:48.000
We don't want to save this.

00:07:48.001 --> 00:07:49.000
This wasn't important.

00:07:49.001 --> 00:07:50.000
So I'm going to hit
continue without saving.

00:07:50.001 --> 00:07:52.000
It brings me back to the initial screen.

00:07:52.225 --> 00:07:54.101
Now I'm going to
start a new capture, but

00:07:54.113 --> 00:07:56.000
I'm going to be
prepared and I'm going to

00:07:56.001 --> 00:08:02.000
load up a couple of websites while I
do that capture so that we have some

00:08:02.001 --> 00:08:04.000
better data in there.

00:08:04.001 --> 00:08:07.000
Okay, so we will double click on Ethernet.

00:08:07.001 --> 00:08:13.000
And now I'm just going
to load this one website.

00:08:13.001 --> 00:08:16.000
And I'm going to load this other website.

00:08:19.650 --> 00:08:21.000
Make sure that one's actually loading.

00:08:21.001 --> 00:08:23.000
Okay, so I've loaded a couple of websites.

00:08:23.300 --> 00:08:26.000
Now let's go ahead and hit stop.

00:08:26.001 --> 00:08:28.000
Now notice that we still
have this filter up here.

00:08:28.001 --> 00:08:31.000
So I'm just going to delete that
out so we can see everything.

00:08:31.001 --> 00:08:35.000
So we can see we captured, if we
look at the bottom, 5,536 packets.

00:08:35.001 --> 00:08:37.000
All of them are currently being displayed.

00:08:37.150 --> 00:08:38.000
So now what?

00:08:38.001 --> 00:08:39.000
Well, it depends what you're looking for.

00:08:39.001 --> 00:08:42.000
But let's talk about looking
for some general stuff.

00:08:42.001 --> 00:08:44.000
So first of all, in this filter bar,
one thing that you can look at is if

00:08:44.001 --> 00:08:45.824
you're kind of afraid
that somebody got

00:08:45.836 --> 00:08:48.000
hacked or phished or
there's something sketchy

00:08:48.001 --> 00:08:51.248
going on, usually that
is done over unsecure

00:08:51.260 --> 00:08:54.000
servers and networks
and connections.

00:08:54.001 --> 00:08:58.000
So you might want to look at HTTP
and not encrypted level HTTPS.

00:08:58.001 --> 00:09:01.000
So in your filter here,
you can just type HTTP.

00:09:01.001 --> 00:09:04.000
And you'll notice when it turns
green, it means that it is an accepted

00:09:04.001 --> 00:09:06.000
equation filter.

00:09:06.001 --> 00:09:07.000
If it's red, it's not going to work.

00:09:07.001 --> 00:09:08.000
So you need to try and figure it out.

00:09:08.001 --> 00:09:10.000
But it's green, so we can hit enter.

00:09:10.001 --> 00:09:13.000
And now we're seeing
all of the HTTP requests.

00:09:13.001 --> 00:09:17.000
Now this happens to be from the
website that I loaded that was insecure.

00:09:17.001 --> 00:09:18.000
It was HTTP.

00:09:18.001 --> 00:09:20.000
I want to show you something
interesting about this.

00:09:20.001 --> 00:09:24.000
So notice, we can just click
on really any of these packets.

00:09:24.150 --> 00:09:27.000
And we start to see this
information down here at the bottom.

00:09:27.001 --> 00:09:29.000
So let's close up some of these.

00:09:29.001 --> 00:09:31.000
I have these all open.

00:09:31.001 --> 00:09:31.950
But I think it'll be
easier if we see

00:09:31.962 --> 00:09:33.000
it from a little bit
of a higher level .

00:09:33.001 --> 00:09:36.000
So you can see within this packet,
we've got a number of different protocols

00:09:36.001 --> 00:09:37.000
that are encapsulated.

00:09:37.001 --> 00:09:43.000
We've got Ethernet, TCP,
and then we've got HTTP.

00:09:43.001 --> 00:09:48.000
So this is the one that we're kind of
looking at when we search for this.

00:09:48.001 --> 00:09:52.000
And if we notice that Wireshark
kind of highlights in blue things that you

00:09:52.001 --> 00:09:54.000
might find interesting
here in Wireshark.

00:09:54.001 --> 00:09:56.001
So if we can drill this
down, we can open this up.

00:09:56.400 --> 00:09:58.098
And you'll notice
that we start to see

00:09:58.110 --> 00:10:00.000
information about what
was happening here.

00:10:00.001 --> 00:10:04.000
So we can see it was accessed
via Macintosh and Intel Mac OS.

00:10:04.001 --> 00:10:05.000
We can see what browser was used.

00:10:05.001 --> 00:10:08.000
So what we can actually do is we
can actually just right click on one of

00:10:08.001 --> 00:10:10.000
these packets up here.

00:10:10.001 --> 00:10:13.000
And we can go to this follow
option, which is used quite a bit here.

00:10:13.001 --> 00:10:15.000
And we want to follow the HTTP stream.

00:10:15.300 --> 00:10:18.076
And this will pop up a new window
for us that essentially shows us all of

00:10:18.100 --> 00:10:21.000
the information that was
sent in these packets.

00:10:21.001 --> 00:10:24.400
Now the reason I'm showing you this
HTTP is because if you were looking at a

00:10:24.401 --> 00:10:25.000
packet sent

00:10:25.001 --> 00:10:28.000
over an encrypted connection, you
wouldn't really be able to read anything.

00:10:28.001 --> 00:10:29.964
A few little things,
you would be able to

00:10:29.976 --> 00:10:32.000
probably see the
computer type that it was

00:10:32.001 --> 00:10:34.000
sent on and all that stuff.

00:10:34.001 --> 00:10:35.000
But notice what we've got here.

00:10:35.001 --> 00:10:37.000
We have this entire web page.

00:10:37.001 --> 00:10:38.000
This is the web page I went to.

00:10:38.001 --> 00:10:39.000
It's here in Wireshark now.

00:10:39.001 --> 00:10:43.000
I could put this into a compiler, an
HTML compiler, and it would print out

00:10:43.001 --> 00:10:44.000
the web page.

00:10:44.001 --> 00:10:45.000
So we've got everything in here.

00:10:45.001 --> 00:10:47.000
So what this means is
this is how phishing works.

00:10:47.001 --> 00:10:49.012
So the way phishing
works is somebody sends

00:10:49.024 --> 00:10:51.000
you a link that maybe
looks like your Bank

00:10:51.001 --> 00:10:54.000
of America link or a social media link.

00:10:54.001 --> 00:10:55.000
Oftentimes they have a reason.

00:10:55.001 --> 00:10:56.000
Maybe they know you're
using Bank of America.

00:10:56.001 --> 00:10:57.000
So they're trying to trick you.

00:10:57.001 --> 00:10:59.000
They're targeting you.

00:10:59.001 --> 00:11:00.000
And you open up that link.

00:11:00.001 --> 00:11:01.755
And that link
happens to look just

00:11:01.767 --> 00:11:04.000
like a Bank of America
page, but it's not .

00:11:04.001 --> 00:11:05.000
It's a page that they built.

00:11:05.001 --> 00:11:07.000
They can build them super fast.

00:11:07.001 --> 00:11:09.000
And it's now over an HTTP connection.

00:11:09.001 --> 00:11:11.000
So you enter your username and password.

00:11:11.001 --> 00:11:13.429
That person who's
phishing you now can go

00:11:13.441 --> 00:11:16.000
in here to Wireshark
if they're tapped into

00:11:16.001 --> 00:11:17.000
the network.

00:11:17.001 --> 00:11:19.012
And they can see your
username and password

00:11:19.024 --> 00:11:21.000
that you entered right
here in W ireshark.

00:11:21.001 --> 00:11:24.000
So that is how an easy
phish hack actually works.

00:11:24.001 --> 00:11:25.376
You do it with
Wireshark, but you can

00:11:25.388 --> 00:11:27.000
also see if it's happening
with Wiresh ark.

00:11:27.001 --> 00:11:28.000
So I just wanted to show you that.

00:11:28.001 --> 00:11:30.000
And so we've got this entire web page here.

00:11:30.050 --> 00:11:32.000
So we can close this out.

00:11:32.001 --> 00:11:35.354
We drilled all the way
down and saw everything

00:11:35.366 --> 00:11:38.000
that was transferred
in that packet.

00:11:38.001 --> 00:11:41.000
And now we're seeing the-- because
we opened that up and we followed that

00:11:41.001 --> 00:11:42.001
stream, we're

00:11:42.250 --> 00:11:46.000
seeing all of the packets that
were exchanged within that stream.

00:11:46.001 --> 00:11:47.000
So that's awesome.

00:11:47.001 --> 00:11:49.000
But how can we look at secure traffic?

00:11:49.001 --> 00:11:53.000
Well, to look at insecure
traffic, we're using HTTP.

00:11:53.001 --> 00:11:57.000
To look at secure traffic, we actually
have to use TCP, but a specific port.

00:11:57.001 --> 00:11:59.000
And that's usually port 80.

00:11:59.001 --> 00:12:02.000
It can also be port like 8000, 8001, 8002.

00:12:02.001 --> 00:12:04.000
But generally, you're going
to be looking at port 80.

00:12:04.001 --> 00:12:11.000
So what you would want to do is you
would type TCP.port and then == 80.

00:12:11.001 --> 00:12:13.000
And then hit Enter.

00:12:13.001 --> 00:12:16.365
And this will show
you all of the packets

00:12:16.377 --> 00:12:20.000
that were sent on TCP
port 80, aka encrypted

00:12:20.001 --> 00:12:21.001
traffic.

00:12:21.225 --> 00:12:24.000
When we start to look at the actual
data within these packets, we can't read

00:12:24.001 --> 00:12:25.000
it because it's encrypted.

00:12:25.001 --> 00:12:26.589
Now, if you had the
encryption key, you can

00:12:26.601 --> 00:12:28.126
actually upload that
in here to Wireshark

00:12:28.150 --> 00:12:29.000
and you can decrypt it.

00:12:29.001 --> 00:12:31.489
So if you're doing
some hardcore security

00:12:31.501 --> 00:12:34.000
on an organizational
network and you want

00:12:34.001 --> 00:12:35.470
to test things and
you want to be able to

00:12:35.482 --> 00:12:37.000
see the data that's
being sent or not sent

00:12:37.001 --> 00:12:40.000
here in Wireshark, you can upload
your encryption codes to Wireshark so that

00:12:40.001 --> 00:12:42.000
you can actually see that.

00:12:42.001 --> 00:12:43.000
That's very advanced, though.

00:12:43.001 --> 00:12:45.000
So we're not going to
look at that in this video.

00:12:45.001 --> 00:12:46.507
Now, since we've been
doing some different

00:12:46.519 --> 00:12:48.000
filters and stuff, I
want to show you how

00:12:48.001 --> 00:12:50.000
to create a button here in Wireshark.

00:12:50.001 --> 00:12:54.000
So we did this filter to
show all the traffic on port 80.

00:12:54.001 --> 00:12:56.000
What we can do is instead of having
to type that every time, we can go over

00:12:56.001 --> 00:12:59.000
here to the right side of the
screen and click on the plus icon.

00:12:59.400 --> 00:13:02.000
Now it allows us to create a filter button.

00:13:02.001 --> 00:13:04.458
So we can just call
this like HTTPS or we

00:13:04.470 --> 00:13:07.000
can just call it port
80, whatever we want

00:13:07.001 --> 00:13:08.000
to call it.

00:13:08.001 --> 00:13:09.000
We can enter some comments.

00:13:09.001 --> 00:13:10.443
We can change
the filter over here if

00:13:10.455 --> 00:13:12.026
we wanted to, but
then we can click OK .

00:13:12.050 --> 00:13:15.000
And now we have this nice
HTTPS button over here.

00:13:15.001 --> 00:13:18.000
So if we were to delete out our
filter and view everything that we've

00:13:18.001 --> 00:13:21.000
captured and click
HTTPS, boom, there we go.

00:13:21.050 --> 00:13:23.000
So we've now created our first button.

00:13:23.001 --> 00:13:26.000
And I'm going to give you a bunch of
filters here towards the end, and you

00:13:26.001 --> 00:13:26.300
should probably

00:13:25.701 --> 00:13:26.949
create a button for
all of them because

00:13:27.561 --> 00:13:29.081
they're really
commonly used filters .

00:13:29.550 --> 00:13:32.000
Okay, let's clear out this filter.

00:13:32.350 --> 00:13:35.000
Let's start to talk about some
coloring rules here in Wireshark.

00:13:35.001 --> 00:13:38.000
You've probably noticed I have
some black lines, purple, green.

00:13:38.050 --> 00:13:39.050
What do they all mean?

00:13:39.100 --> 00:13:41.508
Well, the easy way
to find out is we want

00:13:41.520 --> 00:13:44.000
to go up here to the
view menu and we want

00:13:44.001 --> 00:13:46.000
to go to coloring rules.

00:13:46.001 --> 00:13:50.000
And here you can see and modify
if you want to all of the coloring rules

00:13:50.001 --> 00:13:51.001
here in Wireshark.

00:13:51.100 --> 00:13:54.660
So you can see black
has to do with bad TCP,

00:13:54.672 --> 00:13:58.000
red has to do with
aborted handshakes and

00:13:58.001 --> 00:13:59.000
that sort of thing.

00:13:59.001 --> 00:14:00.000
So you can kind of get an idea.

00:14:00.001 --> 00:14:04.000
I'm going to show you some filters
that might help you kind of see these,

00:14:04.001 --> 00:14:06.000
specifically these on
your own network as well.

00:14:06.100 --> 00:14:08.015
But anytime you're
wondering what exactly

00:14:08.027 --> 00:14:10.000
the coloring stands
for, this is where you

00:14:10.001 --> 00:14:12.126
can find it and where you
can modify it if you'd like.

00:14:12.150 --> 00:14:14.000
So if we scroll down
here a little bit, let's go.

00:14:14.001 --> 00:14:16.000
You'll notice on the right side of
the scroll bar, we can kind of see the

00:14:16.001 --> 00:14:17.000
coloring as well.

00:14:17.001 --> 00:14:19.000
So these are things that
Wireshark is highlighting.

00:14:19.001 --> 00:14:20.000
It's an analysis tool.

00:14:20.001 --> 00:14:23.000
So it captures the information,
which a lot of different tools can do.

00:14:23.001 --> 00:14:26.000
But then Wireshark runs its own
analysis on that information and that's

00:14:26.001 --> 00:14:28.000
where these colored
lines come through.

00:14:28.001 --> 00:14:30.000
These red ones and black ones,
Wireshark is saying, "Hey, there might be

00:14:30.001 --> 00:14:31.000
something here."

00:14:31.001 --> 00:14:33.000
It's not like, "Hey, this
is guaranteed malware.

00:14:33.001 --> 00:14:34.000
You're in trouble."

00:14:34.001 --> 00:14:35.000
This is, you might want
to take a look at this.

00:14:35.001 --> 00:14:36.963
If you're looking for
something on this

00:14:36.975 --> 00:14:39.000
network, these are
good places to start.

00:14:39.050 --> 00:14:44.000
So we can see we've got maybe
some spurious retransmissions.

00:14:44.001 --> 00:14:46.000
This often happens at
the beginning of a capture.

00:14:46.001 --> 00:14:48.000
You'll notice as the capture
went on, it kind of stopped.

00:14:48.001 --> 00:14:49.989
So I wouldn't really
worry about that, but

00:14:50.001 --> 00:14:52.000
I know people do ask
in my other tutorial,

00:14:52.001 --> 00:14:53.000
people asked about that a lot.

00:14:53.001 --> 00:14:56.000
But I'm going to show you how you
can find those a little bit easier later.

00:14:56.001 --> 00:14:59.000
I'm going to show you a filter that
will only pull out the Wireshark flag.

00:14:59.001 --> 00:15:00.041
So we'll get back to that.

00:15:00.300 --> 00:15:04.000
But one thing I want to do is I
want to do two quick things here.

00:15:04.001 --> 00:15:06.000
First of all, is I want to show
you the preferences real quick.

00:15:06.001 --> 00:15:08.000
So in Mac, I'm going to go up to
Wireshark and go to preferences.

00:15:08.001 --> 00:15:09.506
But if you're using
Wireshark, I'm sure you

00:15:09.518 --> 00:15:11.000
can find out how to
get in the preferences

00:15:11.001 --> 00:15:13.000
on Windows too.

00:15:13.001 --> 00:15:14.000
So go into your preferences.

00:15:14.001 --> 00:15:17.000
And then within here, there's a
cool option within the layout section.

00:15:17.001 --> 00:15:20.000
So you can change how
your windows are laid out.

00:15:20.001 --> 00:15:22.000
So by default, we have this one,
two, three, which works pretty well.

00:15:22.001 --> 00:15:25.700
But one thing that is kind of a newer
feature of Wireshark that people like

00:15:26.001 --> 00:15:26.600
to see sometimes

00:15:26.600 --> 00:15:28.555
is instead of in this
third field, seeing

00:15:28.567 --> 00:15:31.000
the packet bytes,
there's actually an option

00:15:31.001 --> 00:15:32.041
to see the packet diagram.

00:15:32.200 --> 00:15:36.000
And if you enable that, you can
actually see how this packet is structured.

00:15:36.001 --> 00:15:39.000
I think this is really good,
especially for educational purposes.

00:15:39.001 --> 00:15:42.000
So you might want to poke around in
Wireshark a little bit to see the actual

00:15:42.001 --> 00:15:43.000
structure of

00:15:43.001 --> 00:15:44.989
the packet, how many
bytes it is, how the

00:15:45.001 --> 00:15:47.000
bytes are structured,
that sort of thing.

00:15:47.001 --> 00:15:49.000
But so yeah, that's a cool option as well.

00:15:49.001 --> 00:15:50.470
Another thing that I
want to show you is

00:15:50.482 --> 00:15:52.000
how to add delta time
here in Wires hark.

00:15:52.001 --> 00:15:54.000
So we have all of these columns up
across the top, but they're completely

00:15:54.001 --> 00:15:55.000
customizable.

00:15:55.001 --> 00:15:58.000
So I can just go to my preferences again.

00:15:58.001 --> 00:16:01.000
And this time I'm going to go to
appearance and then columns.

00:16:01.001 --> 00:16:04.000
You'll notice that we can click
the plus icon to add new columns.

00:16:04.250 --> 00:16:06.000
So I could give this a
name, say, call it delta.

00:16:06.001 --> 00:16:08.000
Well, I'll just call it delta.

00:16:08.001 --> 00:16:12.000
And then we can double click in
this type field and choose the type.

00:16:12.001 --> 00:16:13.000
We want delta time.

00:16:13.001 --> 00:16:15.000
So you can see you've got
a number of different options.

00:16:15.001 --> 00:16:18.000
And then I can just, I can actually
drag this field where I'd like it.

00:16:18.001 --> 00:16:19.000
So I don't want it at the end.

00:16:19.001 --> 00:16:20.001
So we'll click OK.

00:16:20.500 --> 00:16:23.000
You'll notice we now have the delta
field so we can see delta time as well

00:16:23.001 --> 00:16:25.000
here in Wireshark.

00:16:25.001 --> 00:16:28.000
Okay, so now we've gone through
a lot of the user interface and we've

00:16:28.001 --> 00:16:29.000
modified some settings.

00:16:29.001 --> 00:16:32.000
So now I'm going to show
you a bunch of useful filters.

00:16:32.100 --> 00:16:33.992
I'll warn you though,
this section of the

00:16:34.004 --> 00:16:36.000
video is probably more
helpful for advanced

00:16:36.001 --> 00:16:40.000
users or at least once beginner
users have played around a bit and are

00:16:40.001 --> 00:16:43.000
looking for some
specific information.

00:16:43.001 --> 00:16:46.000
So the first filter is a general filter
that will hide less commonly looked

00:16:46.001 --> 00:16:47.001
at protocols.

00:16:47.200 --> 00:16:49.088
So to do this, we're
going to go up here

00:16:49.100 --> 00:16:51.000
and we're going to
do exclamation point.

00:16:51.001 --> 00:16:52.506
Then we're going to do
open parentheses and

00:16:52.518 --> 00:16:54.000
we're going to add
all the filters that we

00:16:54.001 --> 00:16:55.001
don't want to see.

00:16:55.350 --> 00:17:02.000
So ARP or ARP or STP
or LLDP or I guess CDP.

00:17:02.100 --> 00:17:04.000
And then we're going
to close the parentheses.

00:17:04.025 --> 00:17:08.600
And right now, if we look at the bottom
of Wireshark, we're displaying 5,536

00:17:09.001 --> 00:17:09.300
.

00:17:09.301 --> 00:17:13.000
Open that filter and we've taken out,
you know, only 11 because like I said,

00:17:13.001 --> 00:17:14.000
those aren't
looked at that much.

00:17:14.001 --> 00:17:15.471
But this will kind
of clear it up a little

00:17:15.483 --> 00:17:17.000
bit depending on how
long your capture file

00:17:17.001 --> 00:17:18.000
is.

00:17:18.001 --> 00:17:20.000
So you might want to
add that one as a button.

00:17:20.100 --> 00:17:22.480
Now the next one
that we're going to look

00:17:22.492 --> 00:17:25.000
at is to see all of your
TCP SYN flags, aka

00:17:25.025 --> 00:17:27.000
the first part of the three-way handshake.

00:17:27.001 --> 00:17:29.000
So this is when connections
are being opened.

00:17:29.001 --> 00:17:32.000
So we're going to go
up here to the filter field.

00:17:32.001 --> 00:17:36.000
And for this one, we're
going to do TCP.flags.

00:17:36.001 --> 00:17:38.000
And we're going to, we can
actually click and choose it.

00:17:38.001 --> 00:17:39.000
We don't have to type it all out.

00:17:39.001 --> 00:17:42.000
Flags.SYN==1, enter.

00:17:42.001 --> 00:17:45.000
These are all of our, the first
part of our three-way handshakes.

00:17:45.001 --> 00:17:47.000
So again, if you're, if you know what
you're doing with network security,

00:17:47.001 --> 00:17:48.000
hopefully you find this helpful.

00:17:48.001 --> 00:17:51.000
I think you, you know, you know
what I'm trying to show you here.

00:17:51.250 --> 00:17:54.000
So that one might be
another good button as well.

00:17:54.001 --> 00:17:56.000
The next filter is the one
that I told you about earlier.

00:17:56.001 --> 00:17:59.000
How can we see just the
stuff that Wireshark flagged?

00:17:59.001 --> 00:18:00.001
We can go up here.

00:18:00.400 --> 00:18:07.000
And for this one, we can
do TCP.analysis.flags.

00:18:07.001 --> 00:18:08.839
And you'll notice
that now we're only

00:18:08.851 --> 00:18:11.000
seeing the flagged
packets from Wiresh ark.

00:18:11.001 --> 00:18:12.453
For those of you
who like really are just

00:18:12.465 --> 00:18:14.000
using it for the first
time and you're like

00:18:14.001 --> 00:18:16.013
worried that there's
something going on in

00:18:16.025 --> 00:18:18.000
your network or
something, you might want

00:18:18.050 --> 00:18:19.000
to start here.

00:18:19.001 --> 00:18:20.001
There's probably nothing.

00:18:20.250 --> 00:18:23.000
I don't think, you know, looking
through here, I don't, these are just kind

00:18:23.001 --> 00:18:24.001
of dropped packets

00:18:24.450 --> 00:18:26.000
and things like that.

00:18:26.001 --> 00:18:28.000
Retransmissions, fast retransmissions,
spurious retransmissions, but they're

00:18:28.001 --> 00:18:30.000
not like a ton of them at once.

00:18:30.200 --> 00:18:33.000
So you know, this isn't that concerning,
but it's a good place to look if

00:18:33.001 --> 00:18:34.126
that's what you're looking for.

00:18:33.850 --> 00:18:37.400
To see if there are any specific
packets that are from like an abortive

00:18:37.701 --> 00:18:38.000
release, aka one

00:18:38.001 --> 00:18:40.917
of your devices said,
no, I'm not talking

00:18:40.929 --> 00:18:44.000
to you, go away,
which is often a red flag.

00:18:44.001 --> 00:18:51.000
We can use the filter
that is TCP.flags.reset==1.

00:18:51.200 --> 00:18:53.000
You can see it's auto-filling for me.

00:18:53.001 --> 00:18:54.000
So I do have a few of those.

00:18:54.001 --> 00:18:58.000
So you know, this is definitely
something to potentially look at.

00:18:58.150 --> 00:19:01.000
So obviously there are a ton of filters
that you can use and you can even

00:19:01.001 --> 00:19:02.000
get really creative

00:19:02.001 --> 00:19:06.000
with your filters here in Wireshark,
but these filters should help you get

00:19:06.001 --> 00:19:08.000
started in digging deeper.

00:19:08.001 --> 00:19:11.000
Like I said, it all depends
on what you're looking for.

00:19:11.001 --> 00:19:14.000
If you want to see some examples of
malicious network activity, you should

00:19:14.001 --> 00:19:19.000
check out this website,
malware-traffic-analysis.net.

00:19:19.001 --> 00:19:22.000
They have a bunch of PCAP
files available for download.

00:19:22.150 --> 00:19:25.000
So you can just kind of click here
in this traffic technical analysis.

00:19:25.001 --> 00:19:28.000
For each PCAP on the site, they give
you some objectives so you can go in

00:19:28.001 --> 00:19:29.941
and investigate and
try and figure it all

00:19:29.953 --> 00:19:32.000
out, which gives some
structure to the open

00:19:32.001 --> 00:19:33.871
sandbox world of
Wireshark and then they

00:19:33.883 --> 00:19:36.000
provide an explanation
of how they got to the

00:19:36.001 --> 00:19:39.000
answers that are
the correct answers.

00:19:39.001 --> 00:19:42.000
So this is great practice for anybody
looking to get into cybersecurity.

00:19:42.100 --> 00:19:45.000
And I know that there are plenty of
cybersecurity programs that actually

00:19:45.001 --> 00:19:47.000
have their students
use these exercises.

00:19:47.001 --> 00:19:49.000
So that's how good it is.

00:19:49.001 --> 00:19:52.000
I hope that you now have an idea of
how to get into Wireshark, capture some

00:19:52.001 --> 00:19:53.911
network data, and
then start drilling

00:19:53.923 --> 00:19:56.000
down to exactly what
you're looking for.

00:19:56.001 --> 00:20:00.000
If you found this video helpful, I would
really appreciate a thumbs up here

00:20:00.001 --> 00:20:01.000
on YouTube.

00:20:01.001 --> 00:20:03.013
If you want to see
more content like this,

00:20:03.025 --> 00:20:05.000
don't forget to
subscribe to the channel.

00:20:05.001 --> 00:20:08.000
Good luck analyzing the PCAPs
and defending your network.

00:20:08.001 --> 00:20:11.000
I'm <PRESIDIO_ANONYMIZED_PERSON> and I
will see you in the next one.

"چکیده ی متن رو بهم بگو
Assistant: