00:00Hello everyone, welcome to the new video of computer network

00:02In this video, I will be demonstrating about how to use Wireshark software to to capture network traffic and analyze various protocols such as HTTP, DNS, ARP, ICMP, FTP and TCP

00:14So let's start this video

00:14So click on Wireshark software

00:19Then once it open it shows uh the interface available here

00:24I'm having Ethernet as a uh technology through which I am connected to internet

00:28So I can double click in front of Ethernet and start capturing or I having a option of uh start capturing and stop capturing present at the top

00:37So I'm double clicking on in front of Ethernet so that the packets will start capturing

00:42So you can see the packets start started populating here

00:48Wireshark has three three windows

00:48First window shows colorful information where one line information it is showing and this first part is showing uh information such as frame number time in microcond then source and destination addresses protocol length of the packet and one line information

01:06Then the second window shows detail information about the line or the frame on which we are clicking

01:13Let's stop this capturing and analyzing the protocol now

01:16uh so suppose I have click on the frame and in the below you can see uh its information like frame number 80475 then number of bytes that I have captured over internet that is 2974 bytes on a wire and same information is available in the one line information above then once we open that frame then its information it is showing then below that Ethernet 2 uh source and destination MAC addresses it is showing

01:54Then in the third line we can observe that it is showing internet protocol version 4

01:59So this internet protocol version 4

02:03The third field

02:06The third field it is showing information about the uh IP address of source and IP address of destination

02:13You can observe it here

02:13So it is showing my PC's IP address and other PC's IP address

02:17Then transmission control protocol

02:19So in this uh line or in this frame TCP protocol is used

02:22So port number of source and destination it is showing

02:28Then on the right hand side um hexadimal data is available

02:30This data is actually data getting transferred over internet

02:35So on the left hand side if you are clicking on any field then on the right hand side the particular relevant field is getting colored so or highlighted

02:43So this is nothing but the data which is actually getting transferred over a wire in the form of hexadimal number as there are many frames available here

02:54So to analyze a particular frame we need to apply filter in the wireshark

02:59So at the top we have to mention the IO protocol which we are we have to analyze or IP address

03:08So here suppose take example I have enter ARP

03:11So it is showing all ARP packets

03:14Now let's open the command prompt and check the IP address of our own PC

03:19So for that I'm going to write uh IP config and hit enter

03:22So this is the IP address alerted to my computer

03:28So now to analyze DNS uh packets I'm going to ping to the uh one of the website

03:34So here I'm pinging to www.fas.com

03:39So my PC start pinging with one IP address which is IP address of Facebook server

03:46So how come my PC come to know about this IP address? This will is this is possible because of the DNS server

03:50So first of all I will check which is the DNS local DNS server in my network

03:54So using IP config /all I will get DNS information

04:00So this is my DNS address 172.16.0.1 and alternate DNS is 8.8.8.8

04:08So now in the filter I'm going to apply my IP address and a DNS as a filter

04:10So it start showing communication between my PC and a DNS server

04:20So you can observe it here many packets it is showing about DNS and the last two entries it is particularly related to my PC and communication between Facebook server

04:29Last second is a DNS query

04:29So once we open that packet it shows a query

04:35Under that query it is showing uh the query raised by my PC that is what is the IP address for the www.fas.com

04:44This is query raised by my PC

04:44So it is showing under that uh query packet and it is showing information detailed information about that query

04:51So under query we can observe that www.fas.com uh so total 16 characters are available

05:00So name length it is showing 16 and the label count is nothing but uh www is one label then Facebook is another one and so it is showing three labels under that query

05:11Then in the second packet uh that is DNS uh reply from the DNS server

05:14So under answer it is showing the answer for the uh ask query that is my PC asked for the IP address of Facebook server

05:26So it is showing IP address for Facebook server as 163.70.1435

05:32We can observe and we can verify it in the command prompt as well

05:35Now as we have used ping command uh so ping uses ICMP protocol

05:41So uh ICMP protocol is also uh getting captured here

05:44So that we can observe

05:47So in the filter if you are mentioning the IP address of uh Facebook server then it is showing uh the packets of ICMP that are captured here

05:59So there are packet ICMP packets captured in the pair of uh query and or request and reply

06:05So uh for request my uh IP address my PC's IP address is a source and Facebook's IP address is a uh destination and vice versa in case of uh reply

06:18So in the below uh if you open the internet protocol internet control message protocol that is ICMP then it shows the request packets uh and its information and in the second field that is reply it is showing the reply packets

06:34So we can observe as well uh the information about the packets such as uh the my PC's MAC address and Facebook's MAC address as well as my PC's IP address and Facebook's IP address

06:47Then on the right hand side we can observe uh the actual data that is getting transferred in the form of hexadimal message over a wire

06:55So uh in this way we can capture and analyze ICMP packets as well uh with the help of ping command

07:04So now if you open all these packets such as uh reply and request packets

07:09So it is showing information about complete ICMP uh protocol and at the bottom it is showing data which is 32 by data used for pinging

07:19Then uh we can see there are total eight packets of ICMP available here in the pairs uh of request and reply

07:25So four requests four replies are available because during pinging we can observe in the command prompt we are getting four replies because we our PC sends four requests

07:36So we are PC gets four reply from the uh destination

07:39So that's why total eight packets we can observe here in the pairs of request and reply

07:44So in this way we can analyze ICMP uh protocol uh with the help of wireshark

07:52Now let's move on and capture HTTP packets

07:55So in the filter I'm applying a packet uh filter as HTTP and I will hit enter and start capturing the packets

08:09So till now it is not showing anything

08:12Now in the browser I have entered one HTTP website and I have hit enter

08:17So now you can see uh I got certain reply in the form of HTTP packets in the wireshark

08:23So those packets I have captured now uh in the wireshark

08:28So now in the filter if you are mentioning DNS then it is showing DNS packets because HTTP relies on the DNS server to get the IP address of the particular website

08:39Now let us again analyze HTTP uh packets

08:42So you can see the frame number 30108

08:49It is a HTTP request for opening the website homepage and its reply I got in the frame number uh 3056 uh where the whole HTML web page uh designed web page is available uh in the second field of the wireshark

09:07So same you can observe on the website as well with right click on the web page and inspection

09:16So now let us analyze ARP protocol

09:19So I'm writing ARP in the filter

09:21So ARP protocol uh are getting populated here

09:23So ARP packets are used to find the MAC address of particular uh host PC for which IP address is mentioned

09:34So uh there are two packets ARP request and ARP reply

09:37So here in this video we are going to analyze uh ARP uh request which is a broadcast message

09:44It shows uh hardware type, protocol type, hardware size, protocol size, op code for request and sender MAC address, the sender IP address, target MAC address and target IP address

09:56So as it is a broadcast message, it shows target MAC address as all fields mentioned with zeros

10:02This is how we can analyze ARP packet

10:07Now let us analyze file transfer protocol that is FTP protocol and TCP

10:12So for that I'm using Bison FTP as a third party FTP application

10:14So I'm doing it setting first

10:18So I have to mention listen on for the connection on port number 21 because FTP uses port number 21 and 20 for the control connection and data connection

10:27Then general in that enable security uh system and inherit directory right and concurrent users as two then go to uh user group and here I'm just uh checking uh try to delete some of the uh previously created users uh groups uh and uh I will be uh disabling the allow any password and then mentioning the idle timeout as 50 uh minutes uh so that my server will not time out uh uh easily

10:59Uh then in the users I'm going to delete the previously created users and I will generate new user as per my choice

11:07So in this case suppose um I'm creating a user as FTP user and I'm clicking on okay

11:13Uh then by default password will be the same but I'm going to change it to 1 2 3 4 5

11:21Then I am uh clicking on all logging options uh so that server will get all the logs and then I will turn on the FTP server

11:35So these are all settings I'm going to do on the uh FTP server

11:37Uh then I will go to the FTP client

11:43This is FTP client PC

11:45And I will uh open a uh command prompt and I will type FTP space 127.16.7.84 which is a IP address of server

11:54So it will ask me to enter a username as I have created a user as FTP user

11:59So um I have to mention that and then after clicking enter it is showing user is okay enter password

12:06So I'm going to enter password as 1 2 3 4 5 are all commands I can use uh for FTP communication

12:13Now first I will check my IP address uh alerted to my PC

12:15So this is the IP address alerted to my PC that is a client PC

12:26So in the uh now this is the uh log that we can observe on the server PC

12:32So it shows uh the number of users as one and sockets as two and it is also showing the all the logs that activity we have performed on the client PC that is enter username then once username is enter then it is showing the username as well and it is showing uh the password that we have entered

12:52So all the logs it is showing uh which we have performed on the client PC

12:57So now in the wireshark apply filter TCP and IP address of client

13:02So it shows TCP and FTP packets captured over here

13:05So first line it shows the communication between uh client and server

13:12So client initiate a communication with the port number 50,664 and it is received on uh by server on port number 21

13:19Uh so under this uh TCP uh it shows that those both port numbers and it shows the sync packet

13:26So on the next line uh sync packet and acknowledgement uh that is sync and acknowledgement flags are turned on and it is a communication between uh client uh server and a client

13:38So server replies on port number 21

13:44Similarly on the next line uh it is again acknowledgement packet under the TCP protocol

13:49So TCP handshake process happens here and uh communication is established between a client and a server using TCP protocol

13:59So now we will analyze FTP packets

13:59Now to analyze FTP packet click on the fourth packet and in the below we can see uh the the packet uh FTP packet we have to open and inside that we can see response code as 220

14:14So that we can verify on the server log

14:16So if you open a server log on that we can observe that uh it is showing the 220 code

14:22Uh then on the next line uh again uh in the next packet we can see uh the uh O opt response code

14:33So that can also be verified on the uh server

14:35So whatever server log we are getting the same is getting reflected in the uh respective FTP packet which is captured on the uh wire sharkark

14:45So that we can verify

14:45So in the next line uh username has to be entered

14:51So username if we are entering then it is asking uh to enter for the uh password

14:56So username and password we can verify in the uh FTP uh packet capture FTP packets as well as on the server log

15:05Uh whatever server log we are getting the same is getting reflected uh in the capture FTP packet

15:12uh username as a FTP user and password as 1 2 3 4 5

15:16So all these packets which are being uh communicated between the client and server for are getting captured uh in this wireshark and all the information which is available on the server log same is being reflected over here

15:32So username and password is also getting captured uh in this case and the same we can verify with the help of server log

15:40So in this way we can uh capture FTP packets uh and we can also capture TCP packet as FTP uses port uh addresses and these port addresses are nothing but TCP ports

15:54So both TCP and FTP protocols are being used in the FTP communication and that we can verify and analyze using this wireshark software

16:05So we can conclude over here that wireshark is a important uh software which is a network protocol analyzer and uh which is being used to capture network traffic and analyze various protocols and in this video we have analyzed certain protocols like HTTP, DNS, ARP, ICMP, FTP and TCP protocols using Wireshark software

16:25So, uh that's all for this video and thank you for watching.