Skip to main content

Fun With Wireshark: Packet Analysis and Ethical Hacking Part 1




This is David Bombal's course on Udemy. Screenshots will be scarcer because, hey, you didn't pay for this. I did. This covers the first 4 sections (Sans the OSI model):

  • Introduction
  • Setting Up
  • Using Filters


Setting Up: 




Setting up Wireshark, and the Npcap setup has an option for "Support raw 802.11 traffic( and monitor mode) for wireless adapters".

It seems like something I'd want to pick, but I will wait and follow the instructions...for now. I could click it, I already set a restore point.

My first thought was untagged VLAN traffic. I don't know enough about WS here to know what it may interfere with.

We now hav Npcap loopback adapter.

Be mindful of where we're telling WS to capture from; check your interfaces.

("Why can't I see http traffic?" ->
https://osqa-ask.wireshark.org/questions/37704/wireshark-not-showing-http-protocols)

"You're probably capturing on a protected network; the 802.11 header isn't encrypted, so Wireshark is able to dissect the encrypted traffic as 802.11 traffic, but the payload is encrypted, so Wireshark can't even dissect it as IP traffic, much less TCP or HTTP, so it shows up as "802.11"."


Ethernet frames are L2.



Those represent the levels of the OSI model from top to bottom - Physical, Data Link, Network, Transport. The last one combines Application, Presentation, and Session. You can open it and see the OS, browser used.

When the source is a server serving a webpage, you can click it and see the page in question the client received (provided it's in cleartext). Very cool.

But what if you're not capturing packets?


Remember; Double check what interface is capturing traffic; Span or Mirror a port on the switch.

Span? Mirror?


ON a Cisco switch:
config t
monitor session 1 source int [interface]
monitor session 1 destination int [int with  monitoring station]





Filters:


When you are using filters, sometimes the bar may turn red. Keep going, it will turn green when you're finished.







These are display filters.

Silly thing; Make sure to hit enter when you've filled out the filter.

Two filtering language

- Capture packets
- Display packets

Primitives: Filtering on a house IP add or name.

Putting in the protocol gives a different output than putting in the display filter (tcp.port == 23)





(Right click a packet and go to Follow > TCP Stream. This doesn't work with every packet)

Comments

Popular posts from this blog

Azure Networking Options - Core Cloud Services

I have done a lot of AWS things on here. Time to give Azure some attention. After all, since employers don't think Cisco or COMPTIA certifications are important, maybe Microsoft ones are?

First, let's really think about why these are the two biggest cloud services providers in the world:

They've been doing internet things for a long time.Amazon launched in 1995, a virtual bookstore.
Microsoft, well, you know. 

They've lived, breathed, and frankly, created, infrastructure that we use today, that they're selling to us today. Of course the Store of Everything and the Company of Everything would encourage us to put everything in their hands.

Also: Azure has a lot less silly names for modules. Important. I appreciate straightforwardness.


I said 'a lot less', not '100% sensible names'

Microsoft has a clear set of Azure Fundamentals that anyone can interact with. Let's talk about networking basics, basically to say, again, "Hi, employers, I have an …

The Updated "What I'm Looking For In A Role" Post (2020)

Thank you for wanting to help with my job search! Here are some parameters.


Ideal:
Part time remote, text based support. It's a little far fetched, but the positions do exist. I enjoy having the flexibility to take on temporary projects from time to time!
Feel free to suggest something full time (still remote) that can fit within the below criteria;


Skills:

AzureCisco routing and switching.Technical writing.UX critiques [See Here]

Volunteering:
Find me on Jumpstart and CareerVillage.
Jobs:
Networking SysAdmin IT SupportTechnical Consulting

I'm not super interested in hardcore Cybersecurity.
Location:
Remote is ideal, however, it's all a case-by-case basis. Temporary (7 days or less) jobs are fine, otherwise, I am not interested in living or working in Panama City, FL or the surrounding areas. Destin is okay.
East Coast preferred.Deep South is a no. Central/South FL is okayCompany I do not have a Security Clearance.
Size:
Preferably under 1000 people worldwide.Multimedia conglomerate…

Grace Hopper Celebration 2019 (GHC19)

From Aicha Evans' speech at the Keynote.
September 6th - I receive an email from Anita B Organization, saying "We read your application, we like your website, and here's a free ticket to GHC 2019 in Orlando, Florida!"


After a few more questions, it seemed everything was on the up and up, and so I accepted - and that's what this post is about!

For those who don't know, Grace Hopper Celebration is the largest gathering of Women in Technology in the world.

On a personal note, This is the first trip I've taken without my parents. Sure, they've left me behind to go on vacations, but I've never left them. I was totally worried! But you know what happened?

I met a lot of cool people in Orlando, learned a lot of neat things, and had a blast just walking around airports for upwards of 8 hours.

New Delta Sky Club on Wikimedia I really, really love airports! And I survived.

I know in the past, I've wormed my way out of jobs despite being interested simpl…