WEBVTT

1
00:00.000 --> 00:06.440
In this challenge, we're asked to get a little bit of experience here with W

2
00:06.440 --> 00:07.880
ireshark doing

3
00:07.880 --> 00:12.280
some packet capturing just here on our local workstation.

4
00:12.280 --> 00:16.350
So the first thing we need to do, of course, is make sure we have Wireshark

5
00:16.350 --> 00:17.200
installed.

6
00:17.200 --> 00:22.040
I'm on a workstation here in my lab where I do have Wireshark installed.

7
00:22.040 --> 00:26.000
So the first thing we're going to do is go ahead and launch Wireshark.

8
00:26.000 --> 00:29.920
The next thing we have to do is choose the appropriate interface.

9
00:29.920 --> 00:33.320
In my case, that is my lab management interface.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:29.920 --> 00:33.320
In my case, that is my lab management interface.

10
00:33.320 --> 00:36.480
And it'll start a packet capture automatically.

11
00:36.480 --> 00:41.760
Now as you can see here, I'm getting a lot of traffic, mostly from RDP.

12
00:41.760 --> 00:42.760
But that's okay.

13
00:42.760 --> 00:44.880
We're going to go ahead and do our capture.

14
00:44.880 --> 00:47.280
And then we'll filter through this later.

15
00:47.280 --> 00:51.280
So the next thing we want to do is actually generate some traffic.

16
00:51.280 --> 00:55.000
So for this, we're simply going to switch over to the command prompt.

17
00:55.000 --> 01:00.990
So the first command we're going to do here is ARP minus D, and then the IP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:55.000 --> 01:00.990
So the first command we're going to do here is ARP minus D, and then the IP

18
01:00.990 --> 01:02.120
address of

19
01:02.120 --> 01:05.640
your default gateway on your LAN.

20
01:05.640 --> 01:10.920
Now the reason we want to do this is so that we can see your workstation do an

21
01:10.920 --> 01:12.120
ARP to resolve

22
01:12.120 --> 01:16.160
the layer two address of your default gateway.

23
01:16.160 --> 01:20.320
Now that we've done that, we also want to flush our DNS cache.

24
01:20.320 --> 01:23.760
That way if we have any of these names that we're going to ping already saved,

25
01:23.760 --> 01:24.160
we want

26
01:24.160 --> 01:28.600
to make sure that we don't get those here on the Windows platform.

27
01:28.600 --> 01:33.520
That's going to be the command IP config forward slash DNS.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:28.600 --> 01:33.520
That's going to be the command IP config forward slash DNS.

28
01:33.520 --> 01:35.840
This will flush the DNS cache.

29
01:35.840 --> 01:38.720
And now let's do our two pings.

30
01:38.720 --> 01:42.040
I'm just going to start with a ping to Cisco.com.

31
01:42.040 --> 01:45.220
You can of course ping your favorite websites, whatever they are.

32
01:45.220 --> 01:50.510
We just really want to see the name resolution and the ping traffic and the ARP

33
01:50.510 --> 01:51.440
traffic.

34
01:51.440 --> 01:53.200
That's what we're after looking for.

35
01:53.200 --> 01:55.760
So I'll just ping another site as well.

36
01:55.760 --> 01:58.520
We'll just go ahead and ping CBT nuggets.

37
01:58.520 --> 02:03.600
Now that we've generated some traffic, let's go back over to wire shark.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:58.520 --> 02:03.600
Now that we've generated some traffic, let's go back over to wire shark.

38
02:03.600 --> 02:06.040
So here we are back in wire shark.

39
02:06.040 --> 02:10.900
And just so you know, if you are watching really close, this is actually not

40
02:10.900 --> 02:11.520
the same

41
02:11.520 --> 02:14.240
capture that I started originally.

42
02:14.240 --> 02:16.360
There was just a ton of traffic.

43
02:16.360 --> 02:18.560
The capture got way too big.

44
02:18.560 --> 02:23.080
So I actually shut down a few interfaces on my lab machine.

45
02:23.080 --> 02:27.700
I consoled into it instead of being remote desktop into it to try to cut down

46
02:27.700 --> 02:29.160
on the traffic.

47
02:29.160 --> 02:32.840
So I actually made this capture off camera.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
02:29.160 --> 02:32.840
So I actually made this capture off camera.

48
02:32.840 --> 02:36.480
However, it is the exact same traffic.

49
02:36.480 --> 02:38.960
You'll see as we go through here.

50
02:38.960 --> 02:42.750
Also since this is a much smaller capture, I'm going to make this capture

51
02:42.750 --> 02:43.680
available below

52
02:43.680 --> 02:45.220
this video.

53
02:45.220 --> 02:49.140
Just in case you had trouble doing your capturing, you can at least still

54
02:49.140 --> 02:51.100
download this file and

55
02:51.100 --> 02:56.800
open it in wire shark yourself and take a look at my packet capture.

56
02:56.800 --> 03:00.160
So what we're supposed to do for our challenge once we have our capture done is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
02:56.800 --> 03:00.160
So what we're supposed to do for our challenge once we have our capture done is

57
03:00.160 --> 03:00.960
we're supposed

58
03:00.960 --> 03:02.680
to do some filtering.

59
03:02.680 --> 03:07.870
Now we didn't cover filtering specifically in our capturing section up above in

60
03:07.870 --> 03:09.120
the skill,

61
03:09.120 --> 03:12.760
but this being a challenge, I thought I'd throw it in here and see if you can

62
03:12.760 --> 03:14.380
figure it out.

63
03:14.380 --> 03:19.480
You can see this field right up here is to apply a display filter.

64
03:19.480 --> 03:22.080
And that's exactly what we're trying to do.

65
03:22.080 --> 03:26.880
Notice before we apply the filter, we have all sorts of things in our display

66
03:26.880 --> 03:27.640
window.

67
03:27.640 --> 03:31.680
We have our protocols such as spanning tree protocol.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
03:27.640 --> 03:31.680
We have our protocols such as spanning tree protocol.

68
03:31.680 --> 03:33.500
We have some UDP traffic here.

69
03:33.500 --> 03:37.670
We have some ARP requests, some DNS requests, which actually are the things we

70
03:37.670 --> 03:38.280
're going

71
03:38.280 --> 03:39.600
to filter for.

72
03:39.600 --> 03:44.690
But the way we do that is we simply click up here in the display filter and you

73
03:44.690 --> 03:45.180
can get,

74
03:45.180 --> 03:47.700
of course, super fancy with these filters.

75
03:47.700 --> 03:49.620
This is just an introduction.

76
03:49.620 --> 03:53.180
If you're just trying to do something simple, you can get away with typing

77
03:53.180 --> 03:53.980
something as

78
03:53.980 --> 03:58.380
simple as ARP hit enter to apply it.

79
03:58.380 --> 04:03.340
And now notice all we're seeing is the ARP requests.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:58.380 --> 04:03.340
And now notice all we're seeing is the ARP requests.

80
04:03.340 --> 04:09.060
This very first packet here is actually, you can see here it's VMware.

81
04:09.060 --> 04:14.080
It's my workstation going to a broadcast destination.

82
04:14.080 --> 04:18.510
If we actually open up our ethernet frame here, we see that the destination is

83
04:18.510 --> 04:19.040
in fact

84
04:19.040 --> 04:22.440
a broadcast of all F's.

85
04:22.440 --> 04:24.400
And again, this is an ARP request.

86
04:24.400 --> 04:28.160
We can see that right here up under the info at the top.

87
04:28.160 --> 04:31.810
We can actually sort of see what it's asking, but we can of course also open it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
04:28.160 --> 04:31.810
We can actually sort of see what it's asking, but we can of course also open it

88
04:31.810 --> 04:32.720
down here.

89
04:32.720 --> 04:37.950
And we can see that the sender, which is my workstation is asking for the

90
04:37.950 --> 04:39.680
target IP address

91
04:39.680 --> 04:45.140
of my default gateway 192.168.10.1.

92
04:45.140 --> 04:50.570
The next packet, of course, here we can see this is the ARP reply where my

93
04:50.570 --> 04:51.620
default gateway

94
04:51.620 --> 04:57.140
is replying with its MAC address as shown right here.

95
04:57.140 --> 04:59.500
Now I have an ARP entry.

96
04:59.500 --> 05:04.130
You see that the second one here that happened on my network and based on the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
04:59.500 --> 05:04.130
You see that the second one here that happened on my network and based on the

97
05:04.130 --> 05:04.940
fact that the

98
05:04.940 --> 05:10.720
source and destination have Amazon technology in the MAC address, I'm going to

99
05:10.720 --> 05:11.580
guess that

100
05:11.580 --> 05:16.910
that is actually an Amazon smart device that I have out on my test lab, which I

101
05:16.910 --> 05:17.260
do.

102
05:17.260 --> 05:20.060
So that's not really related to what we're looking for here.

103
05:20.060 --> 05:24.060
However, we can see there's other things on the network that are ARPing.

104
05:24.060 --> 05:28.550
And of course, my workstation saw that because it goes to the broadcast MAC

105
05:28.550 --> 05:29.380
address.

106
05:29.380 --> 05:31.500
So everybody sees it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
05:29.380 --> 05:31.500
So everybody sees it.

107
05:31.500 --> 05:36.180
My switch is flooding that information on the segment as it should be.

108
05:36.180 --> 05:39.380
Now the other thing we were supposed to filter on is DNS.

109
05:39.380 --> 05:43.920
And that's just as easy as coming back up to the field where we put ARP,

110
05:43.920 --> 05:44.940
changing ARP,

111
05:44.940 --> 05:46.660
putting in DNS.

112
05:46.660 --> 05:53.580
Notice that wire shark has built in two options here, DNS and DNS server.

113
05:53.580 --> 05:59.190
In this case, we just want DNS, that's regular client requests, so we'll hit

114
05:59.190 --> 05:59.980
enter.

115
05:59.980 --> 06:02.980
And here we don't even have to dig into too much detail.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
05:59.980 --> 06:02.980
And here we don't even have to dig into too much detail.

116
06:02.980 --> 06:07.480
We can see the very first packet here is the source of my workstation going to

117
06:07.480 --> 06:08.460
a destination

118
06:08.460 --> 06:12.920
of eight dot eight dot eight, which I'm sure you're probably already familiar

119
06:12.920 --> 06:13.660
with is actually

120
06:13.660 --> 06:19.660
Google's public DNS server, which is what I generally point my lab devices to.

121
06:19.660 --> 06:25.560
We see that it's doing a query for www.sisco.com, which was the first thing I

122
06:25.560 --> 06:26.780
requested.

123
06:26.780 --> 06:30.740
Then of course, we see the answer coming back in the second packet.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
06:26.780 --> 06:30.740
Then of course, we see the answer coming back in the second packet.

124
06:30.740 --> 06:35.600
And if we open up our DNS response down here, and if we open the answers, if we

125
06:35.600 --> 06:36.300
scroll down

126
06:36.300 --> 06:42.220
a bit, we can see the last entry here actually replied with an address.

127
06:42.220 --> 06:45.100
So right there is our name resolution.

128
06:45.100 --> 06:50.290
Next if we look at our third packet in our filter, where we did the request for

129
06:50.290 --> 06:52.820
www.cbtnuggets.com.

130
06:52.820 --> 06:56.540
And this is of course going to work exactly the same way.

131
06:56.540 --> 07:02.040
So what we were able to do here is fire up wire shark and have it capture some
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
06:56.540 --> 07:02.040
So what we were able to do here is fire up wire shark and have it capture some

132
07:02.040 --> 07:03.180
art requests,

133
07:03.180 --> 07:04.940
DNS requests.

134
07:04.940 --> 07:07.900
And again, if we kill our filter, which you can do just by clicking on this X

135
07:07.900 --> 07:09.100
over here,

136
07:09.100 --> 07:13.370
we can see that again, it caught a whole lot of other things going on on my

137
07:13.370 --> 07:14.300
network as

138
07:14.300 --> 07:15.300
well.

139
07:15.300 --> 07:19.740
Depending on the size of your network, this could be a rather large capture.

140
07:19.740 --> 07:24.300
So once again, feel free to use the one attached to this skill.

141
07:24.300 --> 07:29.210
If you want to use this smaller, more focused capture that I captured off of a

142
07:29.210 --> 07:30.100
lab machine
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
07:29.210 --> 07:30.100
lab machine

143
07:30.100 --> 07:32.380
in a much more calm network.

144
07:32.380 --> 07:37.430
We then did our filtering based on ARP and DNS and took a closer look at each

145
07:37.430 --> 07:38.140
of those

146
07:38.140 --> 07:39.220
packets.

147
07:39.220 --> 07:42.220
So that concludes this challenge.

148
07:42.220 --> 07:45.980
If you weren't able to perform this challenge successfully, I would suggest

149
07:45.980 --> 07:47.020
possibly spending

150
07:47.020 --> 07:52.120
a little more time with wire shark playing around with it and getting used to

151
07:52.120 --> 07:52.580
it.

152
07:52.580 --> 07:59.100
This is an incredibly helpful and powerful tool for troubleshooting networking.

153
07:59.100 --> 08:04.960
All of that said, this concludes performance and redundancy technologies part
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

153
07:59.100 --> 08:04.960
All of that said, this concludes performance and redundancy technologies part

154
08:04.960 --> 08:05.260
one.

155
08:05.260 --> 08:08.700
I'll see you in part two coming up next.

156
08:08.700 --> 08:12.720
But until then, I hope this has been informative for you and I'd like to thank

157
08:12.720 --> 08:13.660
you for viewing.