(Poodle hums) - It's good to read. See, this is good to read. - I'm really happy to announce that I'm going to be giving away my Wireshark Packet Analysis
and Ethical Hacking course. From today, I'm gonna be uploading videos on YouTube for free. So if you can't afford to buy my course, this is your opportunity
to get my course for free. I'm gonna show you practically how to capture packets off of the network, how to capture passwords, how to capture voice calls and replay them and a whole bunch of other things. This is a very practical
Wireshark analysis course. Rather than just showing you
the menus within Wireshark or all the options within Wireshark, which can be very boring and very tedious, I'm gonna show you practically
how to capture packets off the wire and then do things. So to make it more fun, we're going to do some ethical hacking. Rather than just learning
Wireshark by going through menus, we're going to have a bit of fun by capturing packets of the wire. Now you don't have to bold the
same networks as I'm bolding. What I'm gonna do is
give you the PCAP files so that you can download them and follow along if you want to. So use the links below
the videos in this course. Download the PCAP files. Open them up in Wireshark, and then you'll see
exactly what I'm seeing when I'm doing the captures. Now I'm gonna be uploading
at least one Wireshark video per week to YouTube. If you can't wait, so you
want the course right away, use the links below this
video to buy the course. You can either get the course
from various platforms, such as Davidbombal.com, or if you wanna support
both me and Network Chuck, then use the link below to join thisisIT. If you join thisisIT, you support us to create more free content. So it'd be great if you can do that. Okay, so with that being
said, let's get started, and I'm gonna show you how to
practically capture packets, interrogate them, and in this video, I'm gonna show you how
to replay voice calls just to show you what's possible. (upbeat electronic music) Now in this video, I'm gonna show you some of the things that you
can do with Wireshark. Don't worry if you don't
understand what I'm doing in this video. It's just to try and inspire
you and get you started with what's possible and what you'll be able to
do by the end of this course. By the end of this course, you'll be able to capture voice packets and replay voice conversations, you'll be able to capture routing updates, so routing updates from protocols, such as OSPF, EIGRP and others, and then see what's
going on in the network. You'll be able to
troubleshoot network issues by using Wireshark. I've made this course
as practical as I can. Make sure that you download the attached Wireshark PCAP files so
that can do things yourself and try things yourself. But without further ado, let me show you some of the
options available in Wireshark and hopefully inspire
you so that you can see what you can accomplish by
learning how to use Wireshark. Let's get started. Okay, so let's have a
look at this practically. Here's an example. I'm using GNS3 to run a
virtual infrastructure. I've got two PCs, PC1 and PC2. These are Windows computers. So here's PC2. Here's PC1. They're Windows 10 computers, and I'm running IP phones
on these computers. So what I'm gonna do is
capture traffic on this link. So right click, Start capture. GNS3 makes it really easy to
capture packets using Wireshark because GNS3 has Wireshark
integrated with it. So I can specify that I wanna
capture ethernet traffic on this link, and click OK. Wireshark starts automatically, and as you can see here, I'm seeing a bunch of
protocols like STP, DTP. So that spanning-tree. This is Dynamic Trunking Protocol. This is EIGRP, which
is a routing protocol. But what I could do is filter for SKINNY. Skinny Client Control Protocol, or SCCP, is the communication protocol, once again, used between
the phones and the router. So notice Skinny Client Control Protocol. You can see it's a TCP protocol. This is a message from
the router to a phone. So the source port is 2000,
going to a random port number. He has an example from
the phone to the router. So notice source port is this. Destination port is 2000. Okay, but that's probably not what you're interested in seeing. You're probably interested
in seeing UDP traffic. Now here we see some other
traffic, some Dropbox traffic. That's not really what I'm interested in. I'm interested in seeing
telephony traffic. Now, when I go to Telephony,
VoIP Calls in Wireshark, at the moment, I don't
see any voice calls. But when I make a call from
one phone to the other, so let's make a call from 1001. (dial tone) Just make that a bit quieter. To 1000. (phone rings) Call is set up. On this side, I can answer the call. And again, I'm gonna get the feedback. (feedback echoes) Hello? This is David Bombal
speaking, a lotta echo. Bit strange that I'm talking to myself. But there you go. Phone call from one
virtual phone to another. Now what I'll do is mute the lines so we don't get all that feedback. But there's a call set up
between the two phones. In Wireshark, Telephany,
VoIP Calls allows me to see that this is an active call. What I'll do now is end the call. So notice the call has ended. And back in Wireshark,
Telephony, VoIP Calls, notice the call is completed. It's a SKINNY call from 1001 to 1000. So Wireshark is picking up that there was a call
taking place on the network. Scrolling down, I see this UDP traffic. I see Media Independent Network Transport. It's got it listed as MiNT,
but this is actually incorrect. This is an incorrect classification. I know this is a call from this IP address to this IP address because VoIP Calls tells me that I can see the IP address
involved in the call. So I've got these two phones
talking to each other. So what I'm gonna do,
and this is the trick. Right click Decode As, and don't use MiNT in this example. We're gonna use RTP. So scrolling right down,
RTP, Realtime Protocol. I wanna decode this
traffic as RTP traffic, and notice the difference. I can see that this is G.711 U-law. G.711 is a codec used for
encoding analog voice. When I'm speaking, this
is an analog waveform. So I'm sending voice into the air, and that's an analog waveform in the air. So in this example, the IP phone, not the iPhone, but the IP
phone is taking my analog voice, which is sent through the air, and encoding it as zeros and ones. And that uses what's called a codec. We have a coder, a decoder, codec. The codec used here is G.711. We have G.711 U-law. Notice the U or A-law. U-law is what's used in the U.S.A. A-law I like to remember is all of us. So that's not entirely true. It's people like me in the U.K. We would generally use
A-law when making calls on a traditional telephony network like through British telecom. But this is IP. These are Cisco IP phones. So they use U-law by default. So, G.711, U-law. There are different codecs,
such as G.729, G.722. There are other codecs,
but in this example, this is the codec that we're using. Now, you may not be interested
in all of that detail, but notice here we've got
Real-time Transport Protocol. We can see the payload. Once again, notice G.711. But probably what you
wanna do is the following. Go to Telephony, go to RTP, RTP Streams, and notice here we can see the source and destination streams. Now in voiceover IP on
Cisco phones, as an example, they are two unidirectional streams for a two-way conversation. So if I'm talking to you
and you're talking to me, there's a unidirectional
stream from me to you and then a different one from you to me, two different streams. And that's why we see
it as two streams here. When troubleshooting
voiceover IP, as an example, you often need to
troubleshoot one-way voice, and the reason it's one-way voice is because there are two
unidirectional streams. If there's a firewall, as an example, blocking your voice getting to me, you'll be able to hear me but
I won't be able to hear you, again, unidirectional. So I'm gonna select those two streams, and I'm gonna click Analyze. So here's the output of that. We can see as an example
forward and reverse calls, and we get information
such as the maximum jitter, which is the variable
delay in a voice call. If your jitter's too high, the voice quality degrades dramatically. A whole bunch of information, but what I wanna do here
is click Play Streams, and now what I'll be able to
do is play the audio stream. And again I'm going to get the feedback. (feedback echoes) Hello, this is David Bombal speaking. A lotta echo. Bit strange that I'm talking to myself. So notice there are two streams here. We've got two separate streams. The blue one is from Phone 2 to Phone 1. The gray one is from Phone 1 to Phone 2, hence getting a lot of replay. What I could do is just
select one of the streams and click Analyze. So what I've got here is one
stream only rather than two. And again, I'm gonna get the feedback. (feedback echoes) Hello, this is David Bombal speaking. So notice I am able to grab
the audio stream off the wire and then replay it. I can replay both streams. It's a bit weird here because
I'm talking to myself. Okay, so that was a quick overview of some of the things that
you can do with Wireshark. I'm now gonna show you
how to install Wireshark, how to get started and how
you can capture traffic off network and troubleshoot, as well as learn about
what's happening on networks. ♪ We both deserve it all ♪ (upbeat electronic music)
