Wireshark from Scratch for Ethical Hacker & Security Analyst

Install Parrot OS security edition by downloading the ISO and creating a virtual machine in VirtualBox. Configure VM settings, boot the installer, and complete the initial user setup.

Explore Parrot Linux basics for ethical hacking, including privacy settings, changing your IP address to mask identity, and prepping a secure lab with Wireshark installed for security analysis.

Wireshark overview explains how to use Wireshark to capture and analyze network traffic, showing how to open the tool, start captures, and observe traffic from a browser and terminal.

Configure wireshark by creating custom profiles, adjusting privacy and display settings, starting and stopping captures, and customizing time, columns, and color schemes for the analysis.

Upgrade Wireshark on Parrot Linux, configure a less privileged user for packet capture, update firewall settings, and download Wireshark for Windows.

Learn to create a less privileged user and grant just enough privileges to run Wireshark without root access, reducing security risks from memory corruption liabilities and remote code execution.

Learn to install Wireshark for Windows, sniff network traffic on your own machine or a controlled virtual machine, and connect Wireshark on Windows to a VM while following legal guidelines.

Configure virtual machine networking in VirtualBox, learn bridge vs NAT vs host-only, understand security implications, and sniff all traffic with Wireshark in promiscuous mode.

Learn how TCP establishes and maintains a connection, how IP routes packets to a server, and how MAC addresses identify devices, with port numbers guiding access.

Explore how the TCP three-way handshake works to establish a connection and how TCP FIN terminates the session, with sequence numbers and synchronization.

Explore how tcp keep-alive keeps a client-server connection open while a file transfer unfolds, including requests for file chunks, size negotiation, and handling delays, failures, and misconfigurations.

Explore how TCP reset handles connectivity issues and packet loss, including firewall blocks and retransmissions that close the client–server connection.

Explore tcp spurious retransmission and tcp duplicate concepts by tracing how lost packets trigger retransmissions and how duplicates arise when acknowledgments lag.

Explore UDP, DNS, HTTP, SMTP, and FTP in Wireshark, highlighting UDP’s unreliability and DNS name-to-IP mapping, plus HTTP web access and SMTP and FTP for email and file transfer.

Explain how tls secures client-server data with a handshake and key exchange, and contrast it with quic, a udp-based, faster protocol with its trade-offs.

Master Wireshark packet capture setup, including capture factors, display filters, and using a less privileged profile, interface selection, and ring buffer rotation to manage large captures.

Learn to configure capture filters in Wireshark, selecting interfaces and capturing only traffic from a specific website or domain, with DNS translation to its IP address.

Learn to use capture filters in Wireshark to target traffic from or to your virtual machine, using IP and MAC addresses, and refine captures by destination, port, or protocol.

Master Wireshark by capturing all traffic with capture filters, then apply display filters to focus on a specific source IP address, protocol, or conversation for troubleshooting.

Learn to configure Wireshark from scratch, set up a new profile, apply display filters, and adjust time and color layouts for analyzing captured data.

Explore how to analyze TCP handshakes and troubleshoot networks in Wireshark by following a connection’s sequence numbers, window size, fragmentation, and out-of-order packets, including encrypted sessions.

explains tcp troubleshooting with secure client-server data exchange, including certificate and key exchange, encrypted communication, and keep-alive, retransmissions, and sequence tracking.

Investigate TCP traffic in Wireshark by spotting retransmissions and out-of-order events, using expert information for quick troubleshooting, and tracing connections to sites like Google and Amazon, even with encryption.

Explore Wireshark statistics to analyze protocols, conversations, and addresses, using capture file properties, mac address, ip address, and packet details to understand what was involved in our capture.

Download and install GeoIP databases for Wireshark, then set the database path. View traffic origins by country and city on the map, using a default browser.

Learn to monitor your network with Wireshark by scanning to identify devices connected to the network, along with their IP and MAC addresses, using net discover and map tools.

Learn to configure router port mirroring to capture traffic from devices on your network with Wireshark, including verifying service provider allowances, enabling mirroring, and checking router access and firewall settings.

Deploy a dedicated tap between two network points to sniff and capture packets for analysis, using port mirroring to monitor bidirectional traffic and detect infections.

Learn how a man-in-the-middle attack intercepts and reads traffic by spoofing a MAC address and relaying data, using Wireshark to monitor the technique, and defend with VPN and encrypted websites.

Demonstrates a man-in-the-middle attack using Ettercap on Parros Linux, performing sniffing and spoofing, ARP poisoning, and capturing traffic with Wireshark to observe redirected connections.

Learn how to use Wireshark to detect a man-in-the-middle attack by spotting duplicate IP addresses and mismatched MAC addresses, and create a filter to highlight these indicators.

Learn to detect log4j attacks using wireshark and map attacker sources. Update software to the latest versions, patch vulnerabilities, and verify indicators with cyber chef and virus total.

Understand how hackers conduct DDoS attacks by flooding targets with traffic from zombie machines using tools like Goldeneye, and how defenders counter with firewalls and updated antivirus.

Explore ethical hacking fundamentals by using hping3 to generate controlled DoS flooding and analyze traffic with Wireshark, observing UDP and ICMP packets and firewall responses.