Hak5 Cyber Security Education, Inspiration, News & Community since 2005:
____________________________________________
On this HakTip, Shannon Morse breaks out Wireshark for a beginning look at the packet sniffing tool.

Today we're starting a short series on Wireshark! Hopefully, by the end of this series, you'll understand most of the basics of Wireshark and be able to solve many problems.
If you're thinking "Hey Hak5, you've done this already! You're right! Kind of. We have used Wireshark in the past for several segments, and I did a short intro video back on episode 64 of HakTip, but now, we'll really delve into it.
First off, a little bit of review: Wireshark is a network analyzer for Windows, Mac Linux a tool that is used to inspect data passing through a network interface, be it your Ethernet LAN or even Wireless radio. This can also include radios! These bits of data are considered Frames, of which include "packets". Wireshark has the ability to capture all the packets that are sent and received over your network and decode them for analysis.
These packets are made up of all sorts of data, from browsing history to keylogs. Wireshark can find all these packets sent over TCP/IP. Wireshark is available to download for free at Wireshark.org.
For this series, I will be using Wireshark on my Windows 8 laptop an Acer Aspire S7. It runs pretty much the same on all other operating systems. On today's episode, we'll start looking at the graphical user interface and introduce you to what the heck a packet capture is!
Firstly, when you open Wiresark, there's a couple of toolbars at the top, an area called Filter, and a few boxes below in the main window. Online directly links you to Wiresharks site, a super handy user guide, and information on the security of Wireshark. Under Files, you'll find Open, which lets you open previously saved captures, and Sample Captures. You can download any of the sample captures through this webpage, and study the data. This will help you understand what kind of packets Wireshark can capture.
Lastly is the Capture section. This will let you choose your Interface. If I click on mine, you can see each of the interfaces that are available for me to sniff on. It'll also show you which ones are active mine is on WiFi, so it is most active. Clicking details will show you some pretty generic information about that interface.
Under Start, you can choose one or more interfaces to check out. Capture Options allows you to customize what information you see during a capture. Take a look at your Capture Options under here you can choose a filter, a capture file, and more.
Under Capture Help, you can read up on how to capture, and you can check info on Network Media about what interfaces work on what platforms.
Let's go ahead and run our first packet capture. I chose WiFi, and click Start.
You'll see a bunch of weird stuff flying through your Wireshark window. During my capture, I browsed the web a bit and logged on to a few sites. To stop a capture, press the red square in the top toolbar. If you want to start a new capture, hit the green triangle which looks like a shark fin next to it. Now that I've got a finished capture, I can click File, and save, open, or merge the capture. I can print it, I can quit the program, and I can export my packet capture in a variety of ways.
Under edit, I can find a certain packet, with the search options, I can copy packets, I can mark (highlight) any specific packet, or all the packets. Another interesting thing you can do under Edit, is resetting the time value. You'll notice that the time is in seconds incrementing. You can reset it from the packet you've clicked on. I can add a comment to a packet, configure profiles and preferences.
Now, I'm giving you homework! Install Wireshark and run your first capture. It doesn't matter what interface you use, just pick one that you're connected to. Now, look through your packet capture and see if you can distinguish between all the different types that appear.
Let me know what you think. Send me a comment below or email us at [email protected]. And be sure to check out our sister show, Hak5 for more great stuff just like this. I'll be there, reminding you to trust your technolust.

~~~~~~~~~
Please watch: "Bash Bunny Primer Hak5 2225"
   • Bash Bunny Primer  Hak5  2225  
~~~~~~~~~
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.