Wireshark Crash Course For beginners

Filter packets by a specific IP using IP.src or IP.dst, and combine with end-to-end using and/or to constrain source and destination.

Set filters in Wireshark to display http and dns traffic, using http or dns protocols; see source and destination, http version 1.1, and responses, while HTTPS requires SSL or TLS.

Learn how to set filters for tcp traffic by a specific source or destination port, using tcp port equals 80 for http and test with port 888.

Learn to filter TCP packets in Wireshark by a specific term, whether in request or response, including HTTP requests and identifying the host such as google.com.

Filter all http get and post requests in wireshark using http.request, selecting the method and uri to capture get or post traffic, including curl examples and live verification.

Filter out specific protocols in Wireshark using not operator with brackets and or to exclude DNS and ARP, noting case sensitivity, then verify by inspecting captured protocols.

Learn how to capture insecure connections with Netcat and Wireshark, see plaintext passwords in TCP streams, and understand why Netcat is a versatile networking tool but not for secure communication.

Demonstrate how ftp transmits passwords in plain text and can be captured with Wireshark. Install and start vsftpd, then advocate using sftp or ssh for security.

Learn how to extract files from ftp traffic with wireshark by following tcp streams, retrieving file content from ftp data, and recognizing the security risks of plaintext ftp.

observe how passwords are captured over http and why http is dangerous compared to https, showing credentials appear in plain text in http requests and can be intercepted.

Learn to capture and export images and other files from http traffic with Wireshark. Understand that http traffic is plain text, so avoid http for logins or sensitive sites.