Decoding Packets with Wireshark

แชร์
ฝัง
  • เผยแพร่เมื่อ 25 ม.ค. 2025

ความคิดเห็น • 64

  • @kieran.stafford
    @kieran.stafford 5 ปีที่แล้ว +2

    No waffle, straight into real world usage examples. Finally a great Wireshark tutorial from someone who clearly knows their stuff and can communicate it well. Thank you.

  • @tahersadeghi6773
    @tahersadeghi6773 ปีที่แล้ว

    Hi Mike. God bless you, man. This is the video I have been searching for quite some time. It is so clear and so easy to understand. Especially the fact that you dismiss the color which has been an annoyance in almost all the rest of the videos on Wireshark. Many thanks

  • @bobbyb42
    @bobbyb42 3 ปีที่แล้ว +3

    I thought this whole video was great, but my favorite part may have been at the end when you made yourself way bigger to emphasize the importance of capturing packets and learning everything before actual issues happen. I actually laughed out loud from seeing you become giant all of a sudden. Thank you for that.

  • @rongliao9255
    @rongliao9255 4 ปีที่แล้ว +7

    Great tutorial especially on DNS troubleshooting! Thanks a lot!

  • @itdirector8526
    @itdirector8526 2 ปีที่แล้ว

    Great video. Understanding the significance of the capture was exactly what I was looking for. Good work!

  • @LarryH2
    @LarryH2 6 ปีที่แล้ว +2

    Great video! Very easy to watch and understand. This was a great refresher for me.

  • @dankwaclark3133
    @dankwaclark3133 ปีที่แล้ว

    Please can you elaborate on how to decode the hex in each frame.

  • @iforwms
    @iforwms 4 ปีที่แล้ว +3

    Very interesting and well made. Thanks a lot!

  • @JimmyVrais
    @JimmyVrais หลายเดือนก่อน

    Very helpful, thank you!

  • @AvinashKumar-pw3bd
    @AvinashKumar-pw3bd 6 ปีที่แล้ว +2

    The way you are teaching is great, I am new to Wireshark, but the way you conveyed the topic is great. Sir, please let me your another video. I want to start learning Wireshark from scratch till end means as a beginner till a fresher expert needed in Companies. I have worked as Network Engineer for two years and switching to Cyber Security. Currently a student at University. Your guidance would be of great help.

  • @touchthesky9657
    @touchthesky9657 5 ปีที่แล้ว +1

    Great work an information... Thank you very much Mike

  • @johnbrandt2167
    @johnbrandt2167 4 ปีที่แล้ว

    AT about 27:00, I don't understand how we can definitively conclude that the problem is with the server. How can we assume that the 4.8 seconds it took to get the packet back is due to server processing time? What about the network path, can we be sure that the path back is the same as the path to?

    • @MikePennacchi
      @MikePennacchi  4 ปีที่แล้ว +1

      John, good point. Since we received the ACK back, we have a pretty good idea of the round trip time of the circuit. While it is possible that it took a different path to get back, we would not expect a significant increase in the latency added by the network. If it were a few milliseconds different, that could be explained by network path. Once we start getting into seconds, it will be on the server side. I've always joked there is no Packet Lounge on the network. There really isn't a place that could buffer up packets for 4.8 seconds on the Internet.

  • @xanvong1501
    @xanvong1501 3 ปีที่แล้ว +1

    Thank you so much ! very informative video !

  • @jamesgiaquinto3907
    @jamesgiaquinto3907 3 ปีที่แล้ว

    Top shelf as always.

  • @samthesplatt
    @samthesplatt 7 ปีที่แล้ว +3

    Thank you. Really nicely explained. Liked the DNS server tip.

  • @LifeGeneralist
    @LifeGeneralist 6 ปีที่แล้ว +1

    Excellent video Mike.

  • @andyz1157
    @andyz1157 5 ปีที่แล้ว

    Thank you for keeping this video on You Tube...very nicely explained.

  • @gyt7504
    @gyt7504 2 ปีที่แล้ว

    great video; learnt so much in short time. thanks.

  • @qzorn4440
    @qzorn4440 3 ปีที่แล้ว

    nice info.. i am interested in checking PLC packets in controllogix, automationDirect, HMI-touch-screens, Modbus, ethernet, etc. like some of the Fluke pricey stuff. thanks

  • @hartobie3667
    @hartobie3667 4 ปีที่แล้ว

    Nice deep dive on Wireshark.

  • @hughhodges5924
    @hughhodges5924 3 ปีที่แล้ว

    Very well done practical presentation of Wire Shark .Will you be attending the Cyber Symposium in Sioux Falls, SD on Aug 11,11,12?

  • @rajstudying6450
    @rajstudying6450 3 ปีที่แล้ว

    can you explain what is protected payloads

  • @ravindrap7962
    @ravindrap7962 3 ปีที่แล้ว

    Great Video

  • @paulmorrey733
    @paulmorrey733 6 ปีที่แล้ว

    Great Video New to wire shark so a great start for me

  • @rono7993
    @rono7993 4 ปีที่แล้ว

    how should one analyse captured wireshark and give report

  • @kedabro1957
    @kedabro1957 4 ปีที่แล้ว

    This guy's speech has shades of Jeff Goldblum.

  • @chrishubalek7068
    @chrishubalek7068 5 ปีที่แล้ว +1

    Very impressive

  • @yt_legend_papa
    @yt_legend_papa 4 ปีที่แล้ว

    Hi, I know long time agoi since the video was provided but is it possible to get the PCAP Files? the link below does not have it

  • @pankajjain493
    @pankajjain493 4 ปีที่แล้ว

    wow its a great video and trouble shooting thanks

  • @TriEdgeGaming
    @TriEdgeGaming 4 ปีที่แล้ว

    Ive never worked with a tap before much less a fault tolerant tap. So its basically a small switch that has redundant Ethernet connections to the source. Do these types of taps have redundant power somehow? like a battery? I imagine having two power supplies connected to the same wall is pointless since the 2 wall outlets you're connecting to for power probably aren't redundant at all.

    • @MikePennacchi
      @MikePennacchi  4 ปีที่แล้ว

      These taps have relays in them that are held open by the power. When they lose power, the relay closes and bypasses the electronics in the tap. It will pass data, but can't be used for monitoring, when power is lost.

  • @r3dbullweiss488
    @r3dbullweiss488 6 ปีที่แล้ว

    Hi, I'm really new to wireshark (got it about two days ago)... and for some reason I can't decrypt the packets, I've already entered a WPA-pwd (in a valid format, checked it multiple times) , yet only some packets seem to be decrypet, while most stay encrypted.... I well aware of the 4 way handsahke and wireshark needing to capture the device connect to the internet in order to decrypt it.. Which I've tried doing waayyy to many times
    (probably spend more than 6 hours trying) I'm really confused on how wireshark is supposed to capture the 4 way handshake, am I supposed to connect to the internet with my laptop, start wireshark and then boot up the device I want to analysis/watch it's traffic or am I supposed to capture my laptop connecting to the internet ( btw my laptop is connected via wifi and the target device it connected via lan cable).
    Don't mind the run on sentence and typos, I'm in quite a hurry... ^_^

  • @matthewjon4477
    @matthewjon4477 4 ปีที่แล้ว

    Got a link to that amazon page?

  • @malabatikhoisnam3435
    @malabatikhoisnam3435 5 ปีที่แล้ว

    sir pls tell me the procedure for extracting RTP or SIP streams from USBPCAP..

  • @jimjulian4443
    @jimjulian4443 4 ปีที่แล้ว

    How did you set up a "fault tolerant tap?"

  • @muaamaraltaweel3403
    @muaamaraltaweel3403 3 ปีที่แล้ว

    Thank you very much

  • @ravithushara
    @ravithushara 3 ปีที่แล้ว

    Thanks a lot. Very

  • @elisavetkonstantopoulou5386
    @elisavetkonstantopoulou5386 4 ปีที่แล้ว

    Hi! When I click 'Follow TCP Stream' instead of showing me the info it shows you, it shows me some gibberish... Do you know what that is? I'm using Ubuntu.

    • @MikePennacchi
      @MikePennacchi  4 ปีที่แล้ว +1

      Follow TCP Stream creates a filter on the TCP conversation and reassembles the data portion of the packets. In the case of protocols such as HTTP and SMTP, we can often see the clear text contents of the packets. Unfortunately, when we are assembling protocols such as HTTPS, the traffic in the packets is encrypted and comes out as gibberish. In that case, I just close the packet contents window and work on analyzing the flow of packets. As time goes on, more and more traffic is encrypted and that window serves less of a purpose. Which is a big bummer.

    • @elisavetkonstantopoulou5386
      @elisavetkonstantopoulou5386 4 ปีที่แล้ว

      @@MikePennacchi got it, thank you very much!!!

  • @huanluo9074
    @huanluo9074 4 ปีที่แล้ว

    Can you provide data packets?

  • @Juancholoco710
    @Juancholoco710 5 ปีที่แล้ว

    20:11 after i follow TCP i get to that window but mine looks encrypted

    • @rob7328
      @rob7328 5 ปีที่แล้ว +1

      On the bottom of that window try changing, "Show and save data as" to Hex dump or something else. Otherwise make sure you have added the WEP and WPA decryption keys under preferences>protocols>IEEE 802.11>"Decryption keys: Edit...". There are videos on here about how to do this that explain in more detail.

  • @brunoagostinho7204
    @brunoagostinho7204 5 ปีที่แล้ว

    Where can I find pcap files to download and analyze?

    • @MikePennacchi
      @MikePennacchi  5 ปีที่แล้ว +1

      Here is a great source for sample capture files - wiki.wireshark.org/SampleCaptures

  • @sadboisushi
    @sadboisushi 4 ปีที่แล้ว

    GOLDBERG sure does know a lot

  • @876inc
    @876inc 6 ปีที่แล้ว

    I'm trying to find free host site webpages for my cellphone isp can you help me?

  • @dankwaclark3133
    @dankwaclark3133 ปีที่แล้ว

    the content in the hex needs to be decoded and converted into messageFrame

  • @dhiahhadi
    @dhiahhadi 3 ปีที่แล้ว

    two forty five //// 34:13

  • @wedontforgetwedontforgive5838
    @wedontforgetwedontforgive5838 6 ปีที่แล้ว +1

    Thanks sir

  • @ramchhabra5694
    @ramchhabra5694 4 ปีที่แล้ว

    23:45

  • @JohnSmith-ds7oi
    @JohnSmith-ds7oi 4 ปีที่แล้ว +1

    He used a 15 year old trace file because everything is compressed and https now.

    • @MikePennacchi
      @MikePennacchi  4 ปีที่แล้ว

      That and it has some good examples of packet loss and the TCP retransmission timer in action. I probably should update some of those. Good news is that TCP hasn't changed much in the last 15 years.

  • @trenholmelodge1820
    @trenholmelodge1820 10 หลายเดือนก่อน

    as with a lot of these videos you know it so well you just scoot around the screen and say things like "go here and then here" etc. Please slow down and explain what to you is obvious. For a newbie, we do not know most of the basics and that is why we are watching. for the most part good explanations but show us how you got there. ie now we send the trace again. th anks

  • @johnmcook1
    @johnmcook1 5 ปีที่แล้ว +1

    where is the ( Decoding ) lol

    • @deejay7339
      @deejay7339 4 ปีที่แล้ว

      Did you not watch the video? This is basic level information, but highly valuable.

  • @satisfieduser2696
    @satisfieduser2696 4 ปีที่แล้ว

    why wouldn't you just use some 18650's

  • @atzilut540
    @atzilut540 5 ปีที่แล้ว

    how did you rip off your thumb nail?

  • @socrates_the_great6209
    @socrates_the_great6209 5 ปีที่แล้ว

    The first part is useless. Since when did the power suddenly go off? We live in 2019 man.

    • @abde999
      @abde999 5 ปีที่แล้ว +4

      easy for u to say, u don't live in a 3rd world country

    • @dionjeremy1711
      @dionjeremy1711 5 ปีที่แล้ว

      @@abde999 it's called a generator it's not rocket science.

    • @rob7328
      @rob7328 5 ปีที่แล้ว

      power never went out in 1700 but its going out now... smh