Decoding Packets with Wireshark

In this live event I will be playing with Wireshark. I'll go through where to capture, what to capture, and the basics of decoding the traffic. It will be a fun and interactive event!

[@rongliao9255]

Great tutorial especially on DNS troubleshooting! Thanks a lot!

[@chrishubalek7068]

Very impressive

[@matthewjon4477]

Got a link to that amazon page?

[@trenholmelodge1820]

as with a lot of these videos you know it so well you just scoot around the screen and say things like "go here and then here" etc. Please slow down and explain what to you is obvious. For a newbie, we do not know most of the basics and that is why we are watching. for the most part good explanations but show us how you got there. ie now we send the trace again. th anks

[@bobbyb42]

I thought this whole video was great, but my favorite part may have been at the end when you made yourself way bigger to emphasize the importance of capturing packets and learning everything before actual issues happen. I actually laughed out loud from seeing you become giant all of a sudden. Thank you for that.

[@AvinashKumar-pw3bd]

The way you are teaching is great, I am new to Wireshark, but the way you conveyed the topic is great. Sir, please let me your another video. I want to start learning Wireshark from scratch till end means as a beginner till a fresher expert needed in Companies. I have worked as Network Engineer for two years and switching to Cyber Security. Currently a student at University. Your guidance would be of great help.

[@dankwaclark3133]

the content in the hex needs to be decoded and converted into messageFrame

[@dankwaclark3133]

Please can you elaborate on how to decode the hex in each frame.

[@xanvong1501]

Thank you so much ! very informative video !

[@JohnSmith-ds7oi]

He used a 15 year old trace file because everything is compressed and https now.

[@MikePennacchi]

That and it has some good examples of packet loss and the TCP retransmission timer in action. I probably should update some of those. Good news is that TCP hasn't changed much in the last 15 years.

[@samthesplatt]

Thank you. Really nicely explained. Liked the DNS server tip.

[@iforwms]

Very interesting and well made. Thanks a lot!

[@qzorn4440]

nice info.. i am interested in checking PLC packets in controllogix, automationDirect, HMI-touch-screens, Modbus, ethernet, etc. like some of the Fluke pricey stuff. thanks

[@hughhodges5924]

Very well done practical presentation of Wire Shark .Will you be attending the Cyber Symposium in Sioux Falls, SD on Aug 11,11,12?

[@touchthesky9657]

Great work an information... Thank you very much Mike

[@tahersadeghi6773]

Hi Mike. God bless you, man. This is the video I have been searching for quite some time. It is so clear and so easy to understand. Especially the fact that you dismiss the color which has been an annoyance in almost all the rest of the videos on Wireshark. Many thanks

[@itdirector8526]

Great video. Understanding the significance of the capture was exactly what I was looking for. Good work!

[@yt_legend_papa]

Hi, I know long time agoi since the video was provided but is it possible to get the PCAP Files? the link below does not have it

[@LarryH2]

Great video! Very easy to watch and understand. This was a great refresher for me.

[@rono7993]

how should one analyse captured wireshark and give report

[@kedabro1957]

This guy's speech has shades of Jeff Goldblum.

[@gyt7504]

great video; learnt so much in short time. thanks.

[@r3dbullweiss488]

Hi, I'm really new to wireshark (got it about two days ago)... and for some reason I can't decrypt the packets, I've already entered a WPA-pwd (in a valid format, checked it multiple times) , yet only some packets seem to be decrypet, while most stay encrypted.... I well aware of the 4 way handsahke and wireshark needing to capture the device connect to the internet in order to decrypt it.. Which I've tried doing waayyy to many times (probably spend more than 6 hours trying) I'm really confused on how wireshark is supposed to capture the 4 way handshake, am I supposed to connect to the internet with my laptop, start wireshark and then boot up the device I want to analysis/watch it's traffic or am I supposed to capture my laptop connecting to the internet ( btw my laptop is connected via wifi and the target device it connected via lan cable). Don't mind the run on sentence and typos, I'm in quite a hurry... ^_^

[@TriEdgeGaming]

Ive never worked with a tap before much less a fault tolerant tap. So its basically a small switch that has redundant Ethernet connections to the source. Do these types of taps have redundant power somehow? like a battery? I imagine having two power supplies connected to the same wall is pointless since the 2 wall outlets you're connecting to for power probably aren't redundant at all.

[@MikePennacchi]

These taps have relays in them that are held open by the power. When they lose power, the relay closes and bypasses the electronics in the tap. It will pass data, but can't be used for monitoring, when power is lost.

[@satisfieduser2696]

why wouldn't you just use some 18650's

[@rajstudying6450]

can you explain what is protected payloads

[@johnbrandt2167]

AT about 27:00, I don't understand how we can definitively conclude that the problem is with the server. How can we assume that the 4.8 seconds it took to get the packet back is due to server processing time? What about the network path, can we be sure that the path back is the same as the path to?

[@MikePennacchi]

John, good point. Since we received the ACK back, we have a pretty good idea of the round trip time of the circuit. While it is possible that it took a different path to get back, we would not expect a significant increase in the latency added by the network. If it were a few milliseconds different, that could be explained by network path. Once we start getting into seconds, it will be on the server side. I've always joked there is no Packet Lounge on the network. There really isn't a place that could buffer up packets for 4.8 seconds on the Internet.

[@sadboisushi]

GOLDBERG sure does know a lot

[@pankajjain493]

wow its a great video and trouble shooting thanks

[@kieran.stafford]

No waffle, straight into real world usage examples. Finally a great Wireshark tutorial from someone who clearly knows their stuff and can communicate it well. Thank you.

[@876inc]

I'm trying to find free host site webpages for my cellphone isp can you help me?

[@elisavetkonstantopoulou5386]

Hi! When I click 'Follow TCP Stream' instead of showing me the info it shows you, it shows me some gibberish... Do you know what that is? I'm using Ubuntu.

[@MikePennacchi]

Follow TCP Stream creates a filter on the TCP conversation and reassembles the data portion of the packets. In the case of protocols such as HTTP and SMTP, we can often see the clear text contents of the packets. Unfortunately, when we are assembling protocols such as HTTPS, the traffic in the packets is encrypted and comes out as gibberish. In that case, I just close the packet contents window and work on analyzing the flow of packets. As time goes on, more and more traffic is encrypted and that window serves less of a purpose. Which is a big bummer.

[@elisavetkonstantopoulou5386]

@@MikePennacchi got it, thank you very much!!!

[@malabatikhoisnam3435]

sir pls tell me the procedure for extracting RTP or SIP streams from USBPCAP..

[@huanluo9074]

Can you provide data packets?

[@LifeGeneralist]

Excellent video Mike.

[@johnmcook1]

where is the ( Decoding ) lol

[@deejay7339]

Did you not watch the video? This is basic level information, but highly valuable.

[@andyz1157]

Thank you for keeping this video on You Tube...very nicely explained.

[@dhiahhadi]

two forty five //// 34:13

[@hartobie3667]

Nice deep dive on Wireshark.

[@ravithushara]

Thanks a lot. Very

[@jimjulian4443]

How did you set up a "fault tolerant tap?"

[@muaamaraltaweel3403]

Thank you very much

[@wedontforgetwedontforgive5838]

Thanks sir

[@jamesgiaquinto3907]

Top shelf as always.

[@paulmorrey733]

Great Video New to wire shark so a great start for me

[@brunoagostinho7204]

Where can I find pcap files to download and analyze?

[@MikePennacchi]

Here is a great source for sample capture files - wiki.wireshark.org/SampleCaptures

[@ravindrap7962]

Great Video

[@ramchhabra5694]

23:45

[@Juancholoco710]

20:11 after i follow TCP i get to that window but mine looks encrypted

[@rob7328]

On the bottom of that window try changing, "Show and save data as" to Hex dump or something else. Otherwise make sure you have added the WEP and WPA decryption keys under preferences>protocols>IEEE 802.11>"Decryption keys: Edit...". There are videos on here about how to do this that explain in more detail.

[@atzilut540]

how did you rip off your thumb nail?

[@socrates_the_great6209]

The first part is useless. Since when did the power suddenly go off? We live in 2019 man.

[@abde999]

easy for u to say, u don't live in a 3rd world country

[@dionjeremy1711]

@@abde999 it's called a generator it's not rocket science.

[@rob7328]

power never went out in 1700 but its going out now... smh