[Day 1] 4. Wireshark

• Creator: Gerald Combs.
• Previous Name: Ethereal (older version of Wireshark).
• Purpose: A packet capturing and analyzing tool.

How Wireshark Works

• Wireshark cannot operate on its own; it requires libraries like
  Copy

  npcap

  to function.

What is a Library in Computer Science?

• A library adds functionalities to your main module or application.
  • Example: Installing different apps on your phone adds specific features to the device.
  • Examples of Libraries:
    • C Headers: Extend the functionality of a C program.
    • Python Modules: Provide additional features like math operations, networking, etc.

Packet Capturing Libraries (pcap)

Packet capturing requires libraries, specific to the platform:

| Type | Libraries | | -------- | ------------------ | | General |

pcap

winpcap

npcap

libpcap

airpcap

• Without
  Copy

  npcap

  , Wireshark won’t display any options in the dashboard.

What is an Interface?

• An interface enables communication between two different zones or namespaces.
  • Example: Connecting a computer to a network.
• Selecting the correct interface is critical for capturing the right traffic in Wireshark.

Wireshark Interface Layout

When capturing packets in Wireshark, you will see three primary windows:

1. Packet List Window: Displays the list of captured packets.
2. Packet Details Window: Shows detailed information for a selected packet.
3. Packet Bytes Window: Displays the raw data of the packet in hexadecimal format.

Packet Filtering in Wireshark

Wireshark provides two types of filters:

1. Capture Filter: Filters traffic during the capturing process. Only the specified traffic is captured.
   • Example: Capture only TCP traffic using
     Copy

     tcp

     .
2. Display Filter: Captures all traffic but displays only what you want to see.
   • Example: Show only HTTP traffic using
     Copy

     http

     .

tcpdump

• Overview: tcpdump is the predecessor of Wireshark, often referred to as the "father" of Wireshark.
• Purpose: Packet capturing tool, similar to Wireshark but without a GUI (command-line-based).
• Significance: It is considered the first Intrusion Detection System (IDS).