Speaker 1: Welcome back everyone to the deep dive. Today. We're going
Speaker 1: deep into the world of network security and analysis, like
Speaker 1: some kind of digital detectives. I like that, And our
Speaker 1: main tool for this investigation is going to be wire Shark.
Speaker 2: Ah Sharks.
Speaker 1: There's a fascinating piece of software. You know. When I
Speaker 1: first heard about it, I was like, wait, you can
Speaker 1: actually see all the data.
Speaker 2: It's pretty amazing. Yeah, all those little packets flying around.
Speaker 1: It's mind blowing. So for this deep dive, we're using
Speaker 1: this book wire Shark for security professionals.
Speaker 2: Sounds intense.
Speaker 1: It is. The authors, Jesse Bullock and Jef D. Parker,
Speaker 1: really know their stuff. They go into a lot of
Speaker 1: detail about how security professionals use wire Shark, even getting
Speaker 1: into scripting with Lua.
Speaker 2: Oh wow, yeah, Loua can be pretty powerful for automating things.
Speaker 1: Right, But even if you're not like a hardcore security expert,
Speaker 1: I think there's a lot to learn here, even for
Speaker 1: just like understanding how networks work in general.
Speaker 2: Absolutely, like you can see how websites low, how emails
Speaker 2: get sent, all that stuff. It's all broken down into
Speaker 2: these little packets exactly.
Speaker 1: So to kick things off, let's answer those basic questions
Speaker 1: what exactly is wire shark and why should anyone care?
Speaker 2: Well, you can think of wire shark like a microscope, okay,
Speaker 2: but instead of looking at you know, tiny cells or whatever,
Speaker 2: it lets you look at the data flowing through your network,
Speaker 2: like all those individual packets of information.
Speaker 1: So we're actually seeing the ones and zeros that make
Speaker 1: up everything online.
Speaker 2: Well not exactly the raw ones and zeros. Wire shark
Speaker 2: decodes them into a format that's you know, readable. Ah,
Speaker 2: So you can see where the data is coming from,
Speaker 2: where it's going, what protocols are being used, even actual
Speaker 2: contents sometimes.
Speaker 1: So I could like see the contents of an email
Speaker 1: that I'm.
Speaker 2: Sending potentially yeah, if it's not encrypted of course.
Speaker 1: Okay, starting to see why this could be useful. But
Speaker 1: can you give me like a real world example.
Speaker 2: Sure, let's say your internet is running super slow, oh
Speaker 2: the worst. You can fire up wire shark and see
Speaker 2: which applications are hogging all the bandwidth. Or maybe you
Speaker 2: think you might have malware on your computer.
Speaker 1: That's scary.
Speaker 2: Wire shark can help you spot any suspicious traffic that's
Speaker 2: going out.
Speaker 1: So it's not just for security professionals then not at all.
Speaker 2: It can be a really useful tool for troubleshooting, understanding
Speaker 2: how things work, all sorts of stuff.
Speaker 1: Now, the book mentions the OSI model. I'm vaguely familiar
Speaker 1: with it, but could you refresh my memory a bit.
Speaker 2: Oh, the OSI model. Yeah, it's basically a way of
Speaker 2: describing how networks communicate. It breaks everything down into seven layers,
Speaker 2: each with its own specific function.
Speaker 1: Okay, and how does that relate to wire Shark.
Speaker 2: Well, wire Shark's interface is actually structured around the OSI
Speaker 2: model really, so as you're looking at the data, you
Speaker 2: can see how it moves through each layer.
Speaker 1: I see. So it's like peeling back the layers of
Speaker 1: an onion.
Speaker 2: Exactly, and that can be super helpful for understanding what's
Speaker 2: going on, especially if you're trying to pinpoint a problem.
Speaker 1: Okay, that makes sense. Now. The book also talks about
Speaker 1: different protocols like TCP and UDIB. I always get those
Speaker 1: mixed up.
Speaker 2: Yeah, they're the two main ways of sending data over
Speaker 2: a network, but they work quite differently.
Speaker 1: Okay, so what's the difference.
Speaker 2: Think of TCP, like sending a package through like a
Speaker 2: really reliable career service. Okay, they make sure it gets delivered,
Speaker 2: they track it, the whole way. They make sure everything
Speaker 2: arrives in the right order.
Speaker 1: Sounds like FedEx exactly.
Speaker 2: And UDP is more like sending a postcard.
Speaker 1: A postcard.
Speaker 2: Yeah, it's faster, yeah, but it's not as reliable. There's
Speaker 2: no guarantee that it'll arrive, and things might arrive out
Speaker 2: of order.
Speaker 1: So why would you ever use UDP?
Speaker 2: Well, sometimes speed is more important than reliability, right, Like
Speaker 2: if you're streaming video for example.
Speaker 1: Ah, so if you drop frames here and there, aren't
Speaker 1: a big.
Speaker 2: Deal exactly, But you wouldn't want to use UDP for
Speaker 2: like sending sensitive financial information.
Speaker 1: Definitely not. And wire Shark lets us see which protocol
Speaker 1: is being used.
Speaker 2: Yeah, it shows you all that information. It's pretty cool.
Speaker 1: So if I see a bunch of UDP traffic, I
Speaker 1: know that something's probably streaming most likely. Yeah, this is
Speaker 1: making me think about the Internet in a whole new way.
Speaker 1: I never realized there was so much going on behind
Speaker 1: the scenes.
Speaker 2: It's a whole hidden world. Yeah, and wire Shark gives
Speaker 2: you the keys to explore it now.
Speaker 1: The book also mentioned something called well known ports. What
Speaker 1: are those?
Speaker 2: Okay, So imagine a city with a bunch of different ports, Okay,
Speaker 2: and each port is designated for a specific type of cargo, like.
Speaker 1: One port for oil tankers, one for containerships.
Speaker 2: That kind of thing, exactly well known ports are kind
Speaker 2: of like that. They're specific numbers that are assigned to
Speaker 2: common Internet services.
Speaker 1: So if I'm browsing the Web, my traffic is going
Speaker 1: through a specific port for web traffic. Right.
Speaker 2: Web traffic usually uses Port eighty or Port four forty three.
Speaker 1: If it's encrypted, and wire Shark shows us which ports
Speaker 1: are being used.
Speaker 2: Yep, it's another piece of the puzzle.
Speaker 1: This is starting to feel like a real life CSI episode. Now,
Speaker 1: how do we actually capture this traffic? The book uses
Speaker 1: the word sniffing, which sounds kind of a little creepy. Yeah,
Speaker 1: a little creepy, it is what it is.
Speaker 2: Basically, it means cap shuring the network traffic as it
Speaker 2: goes by, so.
Speaker 1: Like we're eavesdropping on the network pretty much.
Speaker 2: Yeah, and wire Shark gives us the tools to do that.
Speaker 1: Okay, I can see how that would be useful. But
Speaker 1: what about promiscuous mode. The book mentions that and it
Speaker 1: sounds a little uh risque, Yeah, a little bit. What
Speaker 1: does it actually mean?
Speaker 2: So normally your network card only sees traffic that's specifically
Speaker 2: addressed to your computer. Promiscuous mode, let's see all the
Speaker 2: traffic on the network.
Speaker 1: Oh so it's like being able to hear everyone's conversations
Speaker 1: in a crowded room.
Speaker 2: Exactly. It's essential for network analysis because it gives you
Speaker 2: the full picture.
Speaker 1: I'm starting to see how powerful this tool can be. Yeah,
Speaker 1: but I imagine there are different scenarios for sniffing, right,
Speaker 1: Like the book talks about wired versus wireless, hubs versus switches.
Speaker 2: Oh yeah, definitely. The environment you're in makes a big difference.
Speaker 1: Can you unpack that a bit?
Speaker 2: So On a wired network, if you're connected to a hub,
Speaker 2: it's pretty straightfor um, okay, because hubbs broadcast all the
Speaker 2: traffic to every device connected to them. Everything pretty much.
Speaker 2: But switches are different. Also, switches are smarter. They learn
Speaker 2: which devices are connected to each port, and they only
Speaker 2: forward traffic to the intended recipient.
Speaker 1: So sniffing on a switch network is trickier.
Speaker 2: It can be. Yeah, you might only see traffic that's
Speaker 2: meant for your computer, or broadcast traffic.
Speaker 1: Is there any way around that?
Speaker 2: Sometimes the book talks about.
Speaker 1: Span ports span ports.
Speaker 2: Yeah, there's special ports on a switch that let you
Speaker 2: mirror traffic from other ports.
Speaker 1: Oh interesting, So you could like designate a port to
Speaker 1: capture all the traffic from a specific.
Speaker 2: Device exactly, or even from a whole section of the network.
Speaker 1: Wow, that's pretty powerful stuff. I'm already starting to see
Speaker 1: how wire Shark can be used for like serious investigations.
Speaker 2: Oh yeah, definitely, And we're just getting started.
Speaker 1: This is already more than I ever thought i'd know
Speaker 1: about network analysis. And we haven't even gotten to the
Speaker 1: really exciting stuff yet, like analyzing attacks.
Speaker 2: Oh yeah, that's next. Get ready for some digital forensics.
Speaker 1: Yeah.
Speaker 2: Wait, all right, so we've talked about how to capture
Speaker 2: network traffic using wire Shark. Now let's talk about using
Speaker 2: it to identify and analyze attacks.
Speaker 1: Okay, this is where things start to get really interesting.
Speaker 2: It does get pretty interesting. The book talks about all
Speaker 2: sorts of attacks and how wire Shark can help you
Speaker 2: understand how they.
Speaker 1: Work, Like those man in the middle.
Speaker 2: Attacks exactly, mid M attacks. They're pretty scary when you
Speaker 2: think about it, they are.
Speaker 1: Can you explain how they work? I always get a
Speaker 1: little confused about the details.
Speaker 2: Sure, So imagine someone's intercepting your mail, right they set
Speaker 2: up a fake mail box outside your house and they
Speaker 2: start collecting all your letters before you even get them.
Speaker 1: That's sneaky.
Speaker 2: Yeah, and that's kind of what a man in the
Speaker 2: middle attack does. The attacker puts themselves between two parties
Speaker 2: who think they're communicating directly with.
Speaker 1: Each other, so they can eavesdrop on the conversation.
Speaker 2: Exactly, and they can potentially even modify the data that's
Speaker 2: being exchanged.
Speaker 1: That's terrifying. So like, if I'm doing online banking and
Speaker 1: someone's doing a mid am attack.
Speaker 2: They could potentially steal your logging credits, your account numbers,
Speaker 2: all that stuff.
Speaker 1: Oh wow, the book mentioned something called ARP poisoning. Is
Speaker 1: that a type of mid am attack?
Speaker 2: It is, Remember we talked about AARP, the Address resolution protocol.
Speaker 2: It's how devices on a network map IP addresses to
Speaker 2: mac address runing like a phone book for the network exactly.
Speaker 2: And in an ARP poisoning attack, the attacker sends out
Speaker 2: fake ARP messages.
Speaker 1: So they're basically creating false entries in that phone book exactly.
Speaker 2: They're tricking devices into sending their data to the attacker
Speaker 2: instead of the intended recipient.
Speaker 1: That's so devious. He can wire shark help us detect
Speaker 1: that kind of attack.
Speaker 2: It can wire sharp shows you both the MSc address
Speaker 2: and the IP address for each packet, right, So if
Speaker 2: you see conflicting m MASS addresses for the same IP address,
Speaker 2: that's a big red flag.
Speaker 1: Like two different people claim you to have the same phone.
Speaker 2: Number, exactly, Something's not right.
Speaker 1: Okay, So it's all about looking for those inconsistencies. That
Speaker 1: makes sense. Now, what about those denial of service attacks.
Speaker 1: I've heard about those, but I don't really understand how
Speaker 1: they work.
Speaker 2: All right, So imagine a restaurant, right, and they're suddenly
Speaker 2: flooded with phone calls for reservations. Okay, but none of
Speaker 2: those callers actually show.
Speaker 1: Up, so the restaurant is overwhelmed, but it's.
Speaker 2: All fake exactly, And that's kind of what a denial
Speaker 2: of service attack does. They overload the target server with
Speaker 2: so many requests that it can't handle legitimate traffic, so
Speaker 2: it's like crashing the server essentially. Yeah, it makes the
Speaker 2: service unavailable to legitimate users.
Speaker 1: The book mentions syn floods and UDP floods are those
Speaker 1: types of DOS attacks.
Speaker 2: They are, They're different ways of achieving the same goal.
Speaker 1: What's the difference.
Speaker 2: So syn flood is like making a bunch of those
Speaker 2: fake restaurant reservations but never confirming them.
Speaker 1: So you're tying up the phone lines, but you're not
Speaker 1: actually taking up any tables.
Speaker 2: Exactly, you're exploiting the process of establishing a connection.
Speaker 1: Okay, that makes sense. What about a UDP flood.
Speaker 2: A UDP flood is more like throwing a massive party
Speaker 2: outside the restaurant, creating so much noise and chaos that
Speaker 2: it disrupts the normal operations inside.
Speaker 1: So you're just overwhelming the target with a ton of data.
Speaker 2: Exactly, it's a brute force approach.
Speaker 1: Can wire shark help us identify these kinds of attacks?
Speaker 2: Oh? Absolutely. Wire Shark can show you patterns in the
Speaker 2: traffic that might indicate.
Speaker 1: A DOSS attack, Like what kind of patterns.
Speaker 2: Well, you might see a huge spike in traffic from
Speaker 2: a single source or maybe a range of sources.
Speaker 1: So it's all about looking for those unusual spikes.
Speaker 2: And activity, right, And it can also show you the
Speaker 2: type of packets being used, which can help you figure
Speaker 2: out what kind of doss attack it is.
Speaker 1: So it's like having a digital magnifying glass letting you
Speaker 1: see all those tiny details exactly.
Speaker 2: It's a powerful tool for analysis. But it's not just
Speaker 2: DOS and MIM attacks we need to worry about. There
Speaker 2: are more sophisticated attacks out there, like those advanced persistent
Speaker 2: threats you mentioned earlier.
Speaker 1: Yeah, those sound particularly scary. What makes those different?
Speaker 2: Well, imagine a thief breaking into a bank, but instead
Speaker 2: of stealing everything at once, they are more patient. Exactly,
Speaker 2: they install a hidden camera and a back door so
Speaker 2: they can gain access.
Speaker 1: Over time, so they're in it for the long haul, right.
Speaker 2: Atts are often orchestrated by skilled attackers, sometimes even nation states.
Speaker 1: Wow, so they're playing the long game. What are they
Speaker 1: typically after?
Speaker 2: It depends they might be stealing sensitive data like intellectual
Speaker 2: property or government secrets.
Speaker 1: That scary stuff. Can wire shark help us with those
Speaker 1: kinds of attacks.
Speaker 2: Wireshark isn't primarily a threat detection tool, but it can
Speaker 2: be really useful for analyzing suspicious activities.
Speaker 1: So it's like the forensic team coming in after the
Speaker 1: crime has already happened.
Speaker 2: Exactly. It can help you understand how the attack worked,
Speaker 2: how much damage was done, all that stuff.
Speaker 1: Okay, that makes sense now. The book also mentions lua scripting,
Speaker 1: can you tell us a bit more about that.
Speaker 2: Sure, Lua is a scripting language that you can use
Speaker 2: to extend wire sharks capabilities.
Speaker 1: So you can basically write your own custom programs within
Speaker 1: wire Shark.
Speaker 2: Pretty much, it's like adding superpowers to wire shsh The.
Speaker 1: Book mentioned some pretty cool examples, like writing scripts to
Speaker 1: count specific types of packets or even extract files from
Speaker 1: a network capture.
Speaker 2: Yeah, it's pretty amazing what you can do with Lua.
Speaker 2: It turns wire Shark into an even more powerful tool.
Speaker 1: I'm starting to feel like a real cyber detective over here.
Speaker 2: It's definitely a skill that takes time and practice to master,
Speaker 2: but even just understanding the basics can be really helpful.
Speaker 1: Well, this has been incredibly insightful. We've covered so much
Speaker 1: ground today and I feel like I've learned a ton
Speaker 1: me too.
Speaker 2: And we're not even done yet. There's still more to
Speaker 2: explore in the world of wire Shark.
Speaker 1: Can't wait to dive in even deeper. Wow, so much
Speaker 1: to think about learning about those attacks, like how wire
Speaker 1: Shark can help analyze them. It's pretty amazing and kind
Speaker 1: of scary at the same.
Speaker 2: Time, you know, Yeah, definitely, there's a whole world of
Speaker 2: cyber threats out there, but you know, learning how they work,
Speaker 2: that's how we get better at defending against them.
Speaker 1: Speaking of defense, the book also talks about how wire
Speaker 1: Shark can be used well offensively, like by ethical hackers
Speaker 1: penetration testers. It kind of threw me off. How can
Speaker 1: a tool for analyzing traffic be used by someone who's
Speaker 1: actually trying to break into systems?
Speaker 2: Ah, I see where you're coming from. Remember wire shark itself,
Speaker 2: it's not a hacking tool, doesn't like actively exploit vulnerabilities
Speaker 2: or anything, but it's a super valuable tool for ethical
Speaker 2: hackers pen testers, especially during certain stages of their work.
Speaker 1: Okay, so how does that work? Exactly?
Speaker 2: Imagine a detective, right solving a case. They wouldn't just
Speaker 2: barge into a suspect's house without doing some recon first.
Speaker 1: Right, gather some intel first.
Speaker 2: Exactly. Ethical hackers they use wire Shark in a similar
Speaker 2: way for reconnaissance, you know, gathering information about a target
Speaker 2: network before they even try to get in.
Speaker 1: So it's like a digital detective's toolkit, building a profile
Speaker 1: of their target.
Speaker 2: Yeah, pretty much. Wireshark helps identify like active devices on
Speaker 2: the network, open ports, even what operating system services are running.
Speaker 2: It's all about getting a full picture.
Speaker 1: Makes sense. It's like scope out the place before making
Speaker 1: a move. But how else do these ethical hackers use
Speaker 1: wire shark during say a penetration test.
Speaker 2: Another big one is analyzing how effective different attack techniques are.
Speaker 2: Oh interesting, Yeah, by capturing traffic during a test, you know,
Speaker 2: they can see how their attacks are being detected blocked
Speaker 2: by the target's security system. So it's like refine their strategies,
Speaker 2: fine weaknesses.
Speaker 1: So it's not just about getting in, but also about
Speaker 1: learning and proving their methods, helping organizations build better defenses.
Speaker 2: Exactly. Ethical hacking it's all about responsible disclosure, helping organizations
Speaker 2: fix vulnerabilities before the bad guys can exploit them.
Speaker 1: The book even mentions using wier Shark to like verify
Speaker 1: the success of an attack.
Speaker 2: Yeah. So let's say, you know, during appentist, they exploit
Speaker 2: a vulnerability get access to a system. Wireshark can confirm
Speaker 2: that the connection is established. You know, they can actually
Speaker 2: monitor the traffic make sure they achieve their objective.
Speaker 1: It's like proof they actually got in can access that
Speaker 1: sensitive information.
Speaker 2: Exactly. It's important, you know, demonstrating the impact of a vulnerability,
Speaker 2: providing evidence to the client.
Speaker 1: This whole idea of offensive wire shark, it's pretty eye opening,
Speaker 1: you know, shows how the same tools can be used
Speaker 1: for defense, but also to understand improve attack strategies.
Speaker 2: It's all about understanding both sides, the attacker and the defender, right,
Speaker 2: like knowing your enemy exactly. The more we know how
Speaker 2: attackers work, the better we can anticipate their moves and
Speaker 2: defend against them.
Speaker 1: Now about that Lewis scripting, we talked about it a
Speaker 1: bit earlier. I'm really curious about these custom scripts, how
Speaker 1: they're actually used.
Speaker 2: Oh, Lewis scripting is incredibly powerful. It's like, you know,
Speaker 2: having a toolbox where you can build your own tools
Speaker 2: for whatever you need.
Speaker 1: Right, custom made exactly.
Speaker 2: The book is some great examples, like writing scripts to
Speaker 2: automate repetitive tasks, custom filters, even extracting specific data from
Speaker 2: those captured packets.
Speaker 1: Yeah, I remember that, extracting files from a capture. It's
Speaker 1: like a digital archaeology, right.
Speaker 2: It is shows how Lewis scripting can turn wire Sharks
Speaker 2: into this highly specialized investigation and analysis tool.
Speaker 1: So if you're comfortable with a little coding, the possibilities
Speaker 1: are pretty much endless.
Speaker 2: Pretty much The book even walks you through creating a
Speaker 2: die sector, which is basically a plug in teaches wire
Speaker 2: sharp how to interpret a new protocol.
Speaker 1: Wow, so you could basically teach wireshark a whole new language.
Speaker 2: Yeah, shows how extensible, how deep this tool really is.
Speaker 2: You're not just stuck with the built in stuff, customize
Speaker 2: it for your specific needs.
Speaker 1: Well, we've covered a ton in this deep dive on
Speaker 1: wire Shark, from the basics of networks protocols, how it
Speaker 1: analyzes attacks, even ethical hacking, luis scripting. It's been a
Speaker 1: fascinating journey absolutely.
Speaker 2: You know, it's amazing what you can learn when you
Speaker 2: really dive deep.
Speaker 1: If you're listening and feeling that spark of curiosity, definitely
Speaker 1: check out wire Shark for security professionals.
Speaker 2: Yeah, great resource whether you're a cybersecurity pro or just
Speaker 2: starting out.
Speaker 1: And as always, folks, keep exploring, keep learning, and keep
Speaker 1: diving deep.