Wireshark: Packet Analysis and Ethical Hacking: Core Skills

Follow along practically by downloading Wireshark, opening the provided PCAP files, and observing traffic between two Windows PCs and a server to learn frames, packets, and segments with Wireshark.

Capture and analyze network traffic with Wireshark, observing frames, packets, and segments across Ethernet, IP, and TCP, including HTTP GET requests and 200 OK replies.

Discover how to capture the right traffic with Wireshark, analyze DNS and HTTP visibility, and learn about switch behavior, port mirroring, and capturing at the correct network location.

Learn to capture network traffic with port span or mirroring, configure a monitor session between source and destination interfaces, and analyze http traffic with Wireshark across a switched network.

Explore the osi model's purpose, layers, and how traffic moves between hosts, then observe real-world usage by sniffing traffic with Wireshark.

Explore the seven-layer OSI model and its layered approach to development, where independent layers enable multi-vendor interoperability and open standards across networks and applications.

Explore how the OSI model splits concerns between upper and lower layers, and why developers focus on layers 7 through 5 while network engineers handle 1 through 4.

Explore the OSI model's layer seven, the application layer, which provides network services to applications via protocols, not specific apps, and handles authentication and resource access.

Explore how the presentation layer formats data for readability across systems. Convert to machine-independent formats like ASCII and Unicode, enabling cross-platform use with JPEG, MP3, and MPEG, including encryption.

Explore the session layer's role in interhost communication by establishing, maintaining, and terminating sessions between applications, coordinating RPCs, NFS, ZIP, NetBIOS, and PPTP.

Explore the OSI model's top layers versus lower layers, focusing on the transport, network, data link, and the physical layers, contrasting roles of developers and network engineers.

Explains how the transport layer provides end-to-end communication, reliability, and flow control using TCP and UDP, with segmentation, the TCP three-way handshake, and session multiplexing.

Route data across the network layer using routers and layer 3 switches, selecting paths with OSPF, BGP, or ISIS, IPv4/IPv6 addressing, and subnet masks.

Delve into the data link layer, which provides physical addressing via 48-bit mac addresses and formats data for transmission across ethernet, ppp, and dsl links, with error detection.

Explore the OSI model’s physical layer, which defines how data is transmitted through electrical, mechanical, and media specifications, enabling interoperability across vendors with standardized copper and fiber cabling.

Explore host-to-host traffic using the OSI model, illustrating encapsulation and de-encapsulation across layers with a live Wireshark demonstration. Demonstrate how each OSI layer communicates only with its peer.

Demonstrate encapsulation and de-encapsulation across the OSI model, stripping headers at each layer from physical to application, with frames, packets, and segments.

Explore how the OSI seven-layer model vs the TCP/IP four-layer suite maps in practice, and how the type field, protocol numbers, and port numbers differentiate IPv4 and IPv6 traffic.

Master Wireshark display filters to isolate traffic by source or destination IP, or by protocol and subnet, such as SMTP (tcp port 25) or ICMP, including RFC 1918 private addresses.

Explore practical Wireshark display filters to isolate traffic by source ip, protocol, or destination, and examine icmp echo requests and replies, arp exchanges, and dns queries across router interfaces.

Discover how Wireshark uses two filtering languages—capture and display—to limit traffic in promiscuous mode, filter by port, host, source, destination, and ethernet addresses.

Learn to use wireshark to capture usernames and passwords from clear text protocols such as Telnet, TFTP, FTP, and HTTP, and note the need for SSH and HTTPS.

Explore capturing router to server traffic with Wireshark and following the UDP-based TFTP transfer of startup config, revealing passwords and full router configurations.

Capture FTP traffic with Wireshark and follow the TCP stream to see username and password transmitted in plain text, demonstrating how a router backs up configurations to FTP.

Capture http traffic with Wireshark to reveal browser and server details, view images, and extract cleartext data from an Ubuntu nginx server. Learn why cleartext protocols risk exposing passwords.

Enable the Cisco router's http service, capture and view http traffic with Wireshark to reveal running configurations and clear-text passwords; avoid unencrypted protocols and use encrypted access.

Learn to capture and analyze voice over IP traffic with Wireshark using two virtual and physical phones, decode as RTP, and examine codecs like G.711 U-law.

Learn how to capture and replay voice calls between virtual and physical IP phones using Wireshark, decode RTP streams, and analyze telephony traffic.

Capture VoIP calls between two phones, replay traffic with Wireshark, and explore network tap and Kali Linux man-in-the-middle techniques using a FreePBX VM.

Capture and analyze VoIP traffic with a network tap and Wireshark, filtering SIP and RTP streams between phones and a free PBX server, replaying calls to observe unencrypted traffic.

Capture and analyze SIP call flows and RTP streams in Wireshark, from invite to teardown, including codecs and SIP messages.

Demonstrate arp poisoning with Ettercap on a Kali Linux VM to capture voip traffic by poisoning arp caches, discovering hosts, targeting phones, and inspecting sip and rtp streams.

Capture voice traffic between two voip phones with a hub or network tap, replay RTP streams in Wireshark on Kali Linux, and analyze ulaw codecs.

Freepbx routes call traffic to the pbx, exposing unencrypted sip and rtp streams. Encrypt sip and rtp, beware arp poisoning, network taps, port mirroring that capture traffic.

Analyze the attached Wireshark captures to determine if trunks form between switch one and switch two and between switch two and switch three, and whether DTP is used.

Analyze dynamic trunk protocol (DTP) negotiation between switches, comparing auto and desirable modes. See how .1Q encapsulation forms trunks while ISL and .1Q choices affect trunking outcomes.

Explore analyzing a Wireshark capture to identify CDP and LLDP status, switch names, device types, operating systems and iOS versions, Cisco Catalyst models, VTP domain, and IP addresses.

Verify CDP and LLDP are enabled on three switches SharkS1, SharkS2, and SharkS3 using Wireshark and CLI, map interfaces, and confirm the VTP domain is sharks on switch1.

Explore packet analysis with Wireshark to interpret an OSPF topology, uncovering version, authentication type and password, area, router priorities, and the designated router from captured traffic.

Analyze an OSPF version 2 lab capture with Wireshark to trace hello packets, DR/BDR election, and LSAs in backbone area 0, highlighting simple password use and MD5 recommendations.

Review the running OSPF configuration on both routers, verify area 0 authentication with matching passwords, and use show run pipe section OSPF and show IP OSPF interface brief.

Analyze the Wireshark capture to diagnose why OSPF is not working between switch one and router two, and why PC1 cannot ping PC2 with destination host unreachable.

Analyze a Wireshark capture to diagnose OSPF issues such as area ID mismatches and password mismatches, fix authentication and area, and verify with show commands, and switch to MD5 passwords.

Troubleshoot OSPF connectivity in a lab by analyzing a Wireshark capture to uncover why PC1 (10.1.1.1) cannot ping PC2 (10.1.2.1) and explore network fixes.

Diagnose OSPF neighbor formation issues using Wireshark by comparing router configurations and matching subnet masks, then verify neighbors and routes are up.

Tackle an OSPF troubleshooting lab by analyzing a Wireshark capture to diagnose why PC1 cannot ping PC2. Download the attached ospf.ts3 to work out the issue.

Diagnose OSPF adjacency issues by comparing hello and dead intervals and network type, then reconfigure the interface to broadcast to form a neighbor relationship and exchange routes.

Analyze the attached Y shock capture to determine the EIGRP version, authentication type, autonomous system number, K values, and the routes advertised by Router 1 and Router 2.

Analyze a Wireshark eigrp lab to identify version 2 and md5 authentication, with as 100 and default k values. Note routes 2.2.2.2/32 and 10.1.2.0/24 advertised.

Analyze an EIGRP troubleshooting lab by examining a Wireshark capture to determine why 10.1.1.1 cannot ping 10.1.2.1 and why 10.1.2.1 cannot ping 10.1.1.1.

Identify EIGRP k-value mismatches with Wireshark to prevent neighbor termination. Reset metric weights to default, then verify adjacency and routes with show ip EIGRP neighbor and show ip route.

Analyze a Wireshark capture to troubleshoot EIGRP connectivity, filter for EIGRP, and identify why 10.1.1.1 cannot ping 10.1.2.1 in the lab topology.

Identify mismatched autonomous system numbers in a wireshark-based EIGRP lab and fix by configuring the same AS (for example, EIGRP 100) to restore neighbor formation and route exchange.

Analyze a Wireshark capture of a BGP topology to identify autonomous system numbers, BGP router IDs, relationships, and how router four learns and advertises routes, including redistribution and network statements.

Analyze a Wireshark BGP capture to identify autonomous system numbers, router IDs, AS paths, and which devices form BGP relationships via update messages and next hops.

Analyze a BGP troubleshooting lab to diagnose why PC1 and PC2 cannot ping each other despite BGP routers using public IPs and port 179.

A BGP troubleshooting lab demonstrates diagnosing a bad peer AS mismatch and missing network statements with Wireshark, then verifying connectivity using show commands and ping.

Learn to use Wireshark profiles to tailor preferences for different protocols such as ospf and eigrp, and to preconfigure searches, columns, fonts, colors, and authentication details per profile.

Apply conversation filters in Wireshark, filtering by ethernet MAC addresses and IP version four, and customize time formats to date and time or UTC date and time.

Use Wireshark statistics to view network endpoints, including ethernet mac addresses, ipv4/ipv6 addresses, and protocol activity (icmp, tcp, udp, ospf, eigrp) across http, multicast, and router traffic.

Explore the protocol hierarchy in Wireshark to identify traffic types, including ICMP and IP. Observe fragmentation and reassembly, large pings, and protocol distribution including Spanning Tree and EIGRP.

See how Wireshark exposes who talks to whom on a network by analyzing conversations, IPs, and multicast traffic between a web term client, toolbox client, router, and switch.

Use the Wireshark flow graph to visualize dhcp transactions and network topology. Filter for dhcp to see discovers, offers, requests, and acks, plus the tcp handshake between client and server.

Master command-line packet capture with tshark and termshark on systems without graphical interfaces, capturing on ethernet and saving to a pcap file for console viewing.

Install and use Termshark from GitHub to read Wireshark PCAPs in a terminal, filter OSPF, EIGRP, and STP, and schedule TShark captures with cron.

Learn to capture network packets with Tshark and Pyshark on an Ubuntu host, using Python to automate Tshark for real-time OSPF, EIGRP, and DTP, CDP, SDP messages.

Learn to capture network traffic with tshark and write it to pcap files, then perform basic PyShark testing in Python to inspect EIGRP, OSPF, and spanning tree headers.

Build a python script with pyshark to live capture on ethernet 0, print source and destination ip addresses, and reveal eigrp and ospf updates with the autonomous system number.