Wireshark Tutorial For Beginners (2021): From Absolute Basics To intermediate Level in 2021

so in this detailed tutorial we are going to learn  about a very important tool called a shark we are   going to start from absolute zero after getting  basics out of the way then we will cover a few   intermediate level topics as well so let's look  at the agenda for this tutorial what a shark is   and why it is used then we will explore basics  make few required changes and understand its   core components and functionalities then what  promiscuous mode is and how to enable it then   we will understand what filters are and its  types then we are going to learn the most used   20 or probably more filters to find the exact  packets or information you want Wireshark is   an open source packet sniffer and analysis tool  it captures packets on the local network from   each connected device to the network war shark  is used for monitoring traffic troubleshooting   and network issues inspecting individual packets  and you can also detect the suspicious activities   in your network by analyzing packets Wireshark  is a must note tool for network administrators   and cyber security specialists Wireshark is  pre-installed in Kali Linux and parrot OS you   can download Wireshark for Windows and Mac as well  it's interface and features remain same across all   the operating systems so it makes no difference  in which operating system you use watch our   corner you can download watch shark from this page  link is in the description installation steps in   Windows are very straight after installing start  watch shark so in order to start war shark in kali   linux or other distributions type sudo Wireshark  and hit enter so when you start Wireshark first   thing you have to do is a select your network  interface card meaning how you are connected   to the Internet as you can see I have a lengthy  list of interfaces most of them are created by   my virtual machines so you can ignore them they  are not real physical cards this list is going   to be different for everyone in most cases either  you will be using Internet with Wi-Fi or Ethernet   wireless card is represented by a Wi-Fi in  Windows as you can see in Linux wireless   card is denoted by wlan0 and Ethernet card is  represented by ETH o in a Linux in Windows it   is simply Ethernet all right so I am connected to  internet with the wireless card so selecting Wi-Fi   as soon as you select your interface Wireshark  basically starts capturing the packets as you   can see for now it is probably talking to my  virtual machines so where is the first thing   we are going to do we will understand the core  structure and functionalities of vishakha so go   to the view view menu basically lets you decide  the components that you want to appear in your   display area as you can see all the essential  components are pre-selected for you first three   selected our main filter and status bar this  is the status bar at the bottom it displays   a summary of captured and lost packets this is  the filter bar for filtering packets according   to port numbers or protocols this is the main  toolbar it contains functions that you are going   to use frequently all right so this red button  basically stops the current session first button   starts a new session as you can see it is asking  me to whether I want to see if they currently   capture the packets you can click on save and  give a file name you don't have to write any   extension here and this button he starts a new  session again you can save if you want and you   can also choose to continue without saving and  then we have this capture options button for now   it is not working because our session is running  if you stop the session you can access the button   it basically lists all the interfaces as you  can see in detail we will get back to capture   interfaces option later in the video for now  close it and this button opens an existing file   if you already have a wash arc file then you can  open with this option and this button saves the   current file cross button close is the current  file this button is for refreshing or reloading   as you can see and this a search button basically  lets you find the packets as you can see you can   use different search terms here you can use you  know string hexadecimal or filters okay we will   learn about filters in detail for now this is  not that important click on cancel and then we   have these two left and right arrow buttons these  are just like your up and down arrow keys they are   used for navigation for example if you click  on any packet then you can you know navigate   up and down with these arrows then we have this  go to specific packet button if you click on it   let's say you want to go to the first captured  packet write your number click on go to packet   as you can see the first packet has been you know  I like it with the background color these up and   down arrow buttons take you to the first and the  last captured packet if you want to go to the last   captured packet click on this button as you can  see and for the first captured packet click on   this button this button automatically points to  the last captured packet during live session so   by default this button is enabled and then we have  this colorization button as you can do disguise we   have captured packets in different colors that is  because Wireshark has assigned different color to   each protocol for better readability ok if you  disable this button as you can see now all the   packets are looking the same if you want to find  out which protocol is associated with the which   color go to the view click on coloring rule now  as you can see here guys you can basically find   out the you know or packets color as you can see  UDP UDP has light a blue background you can you   know come browse the rest of the packets here you  can also you know customize the color for example   let's say you want to change background color of  TCP packet then click on the packet and click on   background select your custom color click on  OK in order to change text color or foreground   click on foreground then select color click on OK  then click on OK and then we have these plus and   minus icons plus icon basically increase font  size of your texts as you can see and - icon   decreases the size and this icon sets font size  to the default as you can see let me increase and   then we have this last button it basically helps  you to resize the columns for example let's say   you want to make more space for destination then  then you can basically drag and drop from either   side of your column just like that okay you can  also swap the columns let's say you want to bring   protocol column here then you can you know do  it just like that now go to the view now next   three selected components are packet list packet  details and packet bytes this is the packet list   where Wireshark displays all the captured packets  and this is the packet detail if you click on any   packet then down here it displays a detailed  information about the selected packet and down   here we have packet bytes here information is a  displayed in raw form as you can see for now it   is displaying in hexadecimal you can change  it to let's say binary right click click on   as bits as you can see we have information in  pure binary let me revert back to Exodus Amell   now let's understand what these columns mean so  first column number it displays captured packets   in a serial number as you can see in ascending  order and then we have a time column time column   basically displays timing of captured packet when  it was captured as you can see for now time format   is not readable at all so let's make it readable  go to the view click on time display format from   first half a select time of the day again go to  view click on time display format select seconds   now as you can see guys we have much better  format now and source column displays the   IP address of device who sent the packet or where  packet originated from and the destination column   displays the IP address of device who received the  packet or where packet was delivered and protocol   column displays the type of protocol whether it is  tea CPU TLS or ERP and the length column displays   packet size in bytes and info column displays a  very brief information about the packet all right   now guys let's understand what promiscuous mode  is go to the capture click on options you can   also access this capture interfaces option through  this button directly so this capture interfaces   displays all the interfaces with much better  controls as you can see our current interface   is being highlighted with background color down  here as you can see enable promiscuous mode on   all the interfaces so question is what promiscuous  mode is promiscuous mode captures trafficker going   through all the devices connected to the network  by default our network cards are not designed to   listen the traffic flowing on other devices  your network card only listens traffic which   is specifically directed to your MAC address so  promiscuous mode enables your network card to   listen and monitor traffic on all the devices on  your network all right by default promiscuous mode   is enabled if you disable promiscuous mode then  it will only capture or monitor traffic within   your own computer or let or device so as you  can see here you can decide on which interface   you want to enable from whiskas mode on as you  can see by default it is you know enabled on all   the interfaces you can select accordingly now  click on close so guys before moving forward I   want to explain very briefly what all these  layers mean what information they represent   I will keep it a very brief because if I go  for the detailed explanation then each layer   is going to take at least 10 minutes so this TCP  layer is responsible for establishing connection   between two computers as you can see we have  basic information about the connection this is   the source port that source computer or computer  who initiated the connection used for connecting   with destination computers as you can see in  IP layer this is the IP address of computer who   initiated the connection and source computer  used this port number to establish connection   with destination and this is the IP address of  destination and destination computer used to   port number 443 to accept the connection then  we have this ethernet layer ethernet layer base   displays the MAC address of source computer and  destination so this is the MAC address of source   computer who initiated the connection and this  is the MAC address of destination where packet   was delivered and in frame layer it displays  metadata like when the packet was captured   packet size and all other relevant information  all right so these four layers basically determine   how two computers are connected and how they  are exchanging data all right in most cases   you are likely to see fifth layer as well so if I  select the TLS packet as you can see here we have   this TLS layer so this fifth layer basically  displays the type of data we are exchanging filters allow you to find the exact packets  or information you want to see by default of   a shark captures all types of packets so it makes  it really difficult to find the packets you want   to see so to overcome this problem filters were  introduced filters basically remove unnecessary   packets from your list and only display packets  you want to see obviously we will learn all the   important filters in a few seconds but before  that we need to understand different types of   filters there are two types of filters display  filter and capture filter display filters are   used for filtering through already captured  packets for example here as you can see we   have all these captured packets ii-era you can  apply display filters here to filter the packets   you want to see and capture filters as the names  who just are used for filtering packets during   capturing let me simplify this we already know  that VAR shark by default captures all types of   packets but let's say you only want to capture  TCP packets or HTTP packets and nothing else   that's where capture filters step in so capture  filters let you decide what type of packets you   want to capture so before starting Wireshark a  session you can tell the watch our cover type of   traffic or packets you want to capture once you  set the capture filter then over shark ignores   everything and only captures packets according  to your capture filters we will cover how to set   up capture filters with the two different methods  later in the video after covering display filters   now let's implement filters practically so this is  the filter bar where you can write your filters so   right you d.p you can notice one thing as soon  as you write the correct filter a background   automatically changes to light green if you  write an invalid filter then the background   changes to light pink so all this is happening  in real time so this is a real help now in order   to apply filter either you can press Enter or  simply click on this arrow here as you can see   in a protocol column or all the UDP packets  have been listed here in order to filter TCP   packets right TCP press Enter as you can see now  TCP packets are being shown here basically guys   in this filter bar you can write all the possible  networking protocols for example write arp as you   can see ftp press enter sss basically guys I do  not have SSH and FTP traffic so it is not showing   up anything now let's say you want to combine or  merge multiple filters for example let's say you   want UDP packets and you also want TCP packets  as well so write or operator and TCP now what   basically we are telling we're shark here if you  find UDP packets or TCP packets then fetch them   or press Enter now as you can see all the UDP and  TCP packets have been you know listed here in our   display area you can combine as many filters or  protocols you want for example or ERP or TLS press   ENTER now write HTTP HTTP filter basically filters  HTTP traffic press ENTER for now I do not have any   HTTP traffic because I haven't visited any HTTP  web site so it is not showing up nothing now in   order to filter the HTTP traffic if you write HTTP  then it is going to throw an error because this   is not a valid filter in order to filter the HTTP  traffic right T LS press Enter as you can see now   TLS or HTTP traffic is being listed here basically  this TLS is the extended version of HTTPS only   differences it uses a stronger algorithm to  encrypt the traffic all right in my opinion   the most important filter is IP address filter  IP address filter basically allows you to filter   traffic according to the IP address for example  let's say you only want to check the packets sent   and received by a particular IP address then right  I p dot ad d r right equal to sine two x and right   the IP address so this is my own IP address if I  press ENTER now guys it is only going to display   the packets sent and received by this particular  IP address all right as you can see here also   guys you can use or operator you can basically  chart piano traffic of multiple IP addresses   all you need to do just right our operator and a  different IP address now let's say you only want   to check the packets sent by this particular  address then right SRC press enter now in the   source column as you can see it is showing all  the packets originated from this particular this   particular IP address here and change source to  DST DST basically displays the destination where   all the packets were delivered this a destination  basically displays all the packets are received by   this particular IP address as you can see in the  destination column and these are the IP addresses   where this address received packets from and guys  we also have another method for filtering packets   you can also use both numbers for example right  TC p dot port equal to let's say 4 4 3 press enter   now it is listing all the traffic received by port  number 4 4 3 so let's go for 8 0 which is HTTP   port now we have another very important filter  called contains so write tcp contains youtube   press enter now what this contains filter does it  will go through all the packets and list out only   packets where it finds the word youtube all right  as you can see it has found the a packet where it   found the word youtube so click on packet down  here in our packet byte panel you can find the   word youtube so let me scroll down as you can  see here as you can see w w dot u tube dot-com   is being displayed here if you want to further  investigate who visited this website then you can   check out the detail panel here you can see this  is the IP address who visited youtube.com and this   is the MAC address of computer who visited the  youtube.com so guys contains basically filters   out traffic according to your search at army so  as you can use the multiple port numbers to filter   the traffic for example that's a TCP port sorry  port in inside these curly braces you can write   port numbers let's say twelve port number 443 you  can write as many ports as you like alright press   enter now what it is going to do it will list  out traffic received by the specified odd numbers now guys let's learn how to set up capture  filters there are two methods for setting up   capture filters first one is you can specify  the capture filters at the beginning when you   start watch arc so let me close my current  file now here as you can see enter a capture   filter remember guys capture a filters are  a bit different syntactically from display   filters if you write HTTP this is not going to  work in order to capture HTTP traffic you have   to specify the port number for example TCP port  8-0 alright for HTTP traffic you can write 4 4   3 you can combine multiple filters like this  or let's say port number 8 0 alright so guys   this is the first method of setting up a capture  filter second method is much more convenient so   let's learn how to set up capture filters and  learn more capture filters with second method   so guys at the top you can notice capturing  from Wi-Fi TCP port number four 4 three and   eight zero it is only going to listen traffic  of port number eight zero and four four three   so second method of setting of filter is let me  close my current session go to the capture click   on options here you can specify the filters as  you can see here capture filters let's say you   only want to capture traffic from a particular  IP address you cannot use IP dot ADR you know   filter here this is not going to work you have to  use host then write the IP address just like that   alright now it is only going to capture traffic  from this particular IP address you can you know   combine multiple filters here with our operator  just like we did with display filters ok as you   can see if you click on start then it is now as  you can see add the dog it is going to capture   traffic going through these two IP addresses you  can also specify the port ranger so right port   range and specify the range I want to capture from  port number ten to four number four four three now   it is going to listen trafficker in all the ports  between ten to four four three alright so make   sure to put a hyphen in between port arrange  all right so that's it for this tutorial again   guys thanks for taking your time and watching  the video I'll see you in my next tutorial

Channel: Sunny Dimalu The Cyborg

Views: 108,119

Keywords: wireshark tutorial for beginners 2020, wireshark tutorial 2021, wireshark filters, display filters, capture filters, wireshark tutorial windows, introduction to wireshark, packet analysis, wireshark 2021, wireshark, tcp packet analysis, how to analyze packets, wireshark packet analyzer, ip sniffing, wireshark tutorial linux, wireshark features, how to capture packets, wireshark tips, wireshark tricks

Id: DCqbOhWSFus

Length: 21min 41sec (1301 seconds)

Published: Sat Jun 20 2020