WEBVTT

1
00:00:00.000 --> 00:00:03.520
<v Speaker 1>All right, let's get started with this deep dive. Today.

2
00:00:03.560 --> 00:00:07.120
<v Speaker 1>We're tackling network forensics with wire Shark. We've got wire

3
00:00:07.120 --> 00:00:10.000
<v Speaker 1>Shark for Network Forensics as our guide, and you know

4
00:00:10.039 --> 00:00:12.960
<v Speaker 1>this tool is a powerhouse. But we're going deeper than

5
00:00:13.039 --> 00:00:15.480
<v Speaker 1>just the basics. We're going to unlock the secrets this

6
00:00:15.519 --> 00:00:19.280
<v Speaker 1>book holds, like decrypting what's hidden in those secure apps

7
00:00:19.920 --> 00:00:22.839
<v Speaker 1>and even capturing those whispers between your Bluetooth devices.

8
00:00:22.920 --> 00:00:25.000
<v Speaker 2>It's like we're getting a backstage pass to how our

9
00:00:25.039 --> 00:00:26.039
<v Speaker 2>network really works.

10
00:00:26.120 --> 00:00:29.839
<v Speaker 1>Okay, you got me hooked. So packet capture right. The

11
00:00:29.839 --> 00:00:33.200
<v Speaker 1>book starts with how wire Shark grabs these tiny data packets.

12
00:00:33.759 --> 00:00:36.280
<v Speaker 1>But there's more to it than just grabbing any data,

13
00:00:36.320 --> 00:00:38.039
<v Speaker 1>isn't there. It seems like you've got to be strategic

14
00:00:38.039 --> 00:00:38.479
<v Speaker 1>about it.

15
00:00:38.600 --> 00:00:40.840
<v Speaker 2>You hit the nail on the head. Wire Shark for

16
00:00:40.920 --> 00:00:43.920
<v Speaker 2>Network Forensics lays out a few different capture methods. Think

17
00:00:43.960 --> 00:00:47.439
<v Speaker 2>of port mirroring, like setting up a hidden camera on

18
00:00:47.479 --> 00:00:50.200
<v Speaker 2>a mailbox. You're not messing with anything, just watching all

19
00:00:50.200 --> 00:00:51.200
<v Speaker 2>the mail going in and.

20
00:00:51.119 --> 00:00:53.560
<v Speaker 1>Out, gotcha, And for those times when you need a

21
00:00:53.560 --> 00:00:54.159
<v Speaker 1>closer look.

22
00:00:54.200 --> 00:00:57.320
<v Speaker 2>What then that's where taps come in. They actually split

23
00:00:57.399 --> 00:01:01.079
<v Speaker 2>the network connection physically, so you can capture every single

24
00:01:01.079 --> 00:01:04.000
<v Speaker 2>bit of data going through. Imagine being able to read

25
00:01:04.040 --> 00:01:06.200
<v Speaker 2>every letter passing through a specific route.

26
00:01:06.239 --> 00:01:09.799
<v Speaker 1>Wow, talk about access. But what happens when the data

27
00:01:09.840 --> 00:01:12.319
<v Speaker 1>is all locked up with encryption? Like those messages only

28
00:01:12.359 --> 00:01:15.719
<v Speaker 1>the sender and receiver can decode. The book mentions decrypting

29
00:01:15.799 --> 00:01:19.680
<v Speaker 1>secure application traffic, specifically HTTPS.

30
00:01:19.760 --> 00:01:22.079
<v Speaker 2>Okay, so imagine you're trying to crack a secret code.

31
00:01:22.560 --> 00:01:24.840
<v Speaker 2>That's kind of what HTTPS is like. It scrambles the

32
00:01:24.879 --> 00:01:28.920
<v Speaker 2>data for protection, but with the right key, Wireshark can

33
00:01:28.920 --> 00:01:31.760
<v Speaker 2>help you break that code and see what's inside.

34
00:01:31.319 --> 00:01:33.760
<v Speaker 1>So it's not actually breaking the encryption itself, more like

35
00:01:33.840 --> 00:01:36.480
<v Speaker 1>having the key to unlock it. Does the book explain

36
00:01:36.560 --> 00:01:37.439
<v Speaker 1>how to get those keys?

37
00:01:37.480 --> 00:01:39.760
<v Speaker 2>It absolutely does. It gives you the step by step

38
00:01:39.760 --> 00:01:44.280
<v Speaker 2>process for capturing and decrypting HTTPS traffic. It's really useful

39
00:01:44.319 --> 00:01:48.319
<v Speaker 2>for troubleshooting applications or if you're looking into potential security threats.

40
00:01:48.560 --> 00:01:51.480
<v Speaker 1>I'm really fascinated by how these protocols have evolved, Like

41
00:01:51.599 --> 00:01:54.799
<v Speaker 1>HTTP two and HTTP three. They sound way more advanced

42
00:01:54.799 --> 00:01:56.000
<v Speaker 1>than the old HTTP.

43
00:01:56.359 --> 00:01:59.200
<v Speaker 2>Oh, they definitely are. HTTP two is like giving web

44
00:01:59.200 --> 00:02:02.079
<v Speaker 2>traffic a turbo boost, making things fast or more efficient.

45
00:02:02.239 --> 00:02:04.799
<v Speaker 2>It's like streamlining the whole postal system to deliver mail

46
00:02:04.879 --> 00:02:09.360
<v Speaker 2>super fast. Then there's HTTB three, which uses a completely

47
00:02:09.400 --> 00:02:13.599
<v Speaker 2>new transport protocol called QUIC. Think of it like switching

48
00:02:13.599 --> 00:02:16.199
<v Speaker 2>from mail trucks to high speed drones for delivery.

49
00:02:16.400 --> 00:02:19.199
<v Speaker 1>So with wire Shark we can actually see how these

50
00:02:19.199 --> 00:02:22.719
<v Speaker 1>protocols work in the real world, not just in theory exactly.

51
00:02:22.960 --> 00:02:25.919
<v Speaker 2>By analyzing the packets, we can see the differences between them,

52
00:02:26.360 --> 00:02:30.080
<v Speaker 2>how they exchange data, how they establish connections, and all

53
00:02:30.080 --> 00:02:31.319
<v Speaker 2>the security measures they use.

54
00:02:31.560 --> 00:02:33.800
<v Speaker 1>This leads right into a topic that's on everyone's mind

55
00:02:33.840 --> 00:02:37.240
<v Speaker 1>these days, secure DNS. The book explains how it adds

56
00:02:37.280 --> 00:02:39.520
<v Speaker 1>that extra layer of privacy to browsing.

57
00:02:39.759 --> 00:02:41.560
<v Speaker 2>Think of it like sending your mail requests in a

58
00:02:41.599 --> 00:02:44.879
<v Speaker 2>secret language that only the right post office can understand.

59
00:02:45.080 --> 00:02:48.479
<v Speaker 2>Secure DNS encrypso's requests, so no one can snoop on

60
00:02:48.479 --> 00:02:49.840
<v Speaker 2>your online destinations.

61
00:02:49.919 --> 00:02:51.560
<v Speaker 1>A So it's not just about what you're sending, but

62
00:02:51.639 --> 00:02:53.759
<v Speaker 1>also keeping those browsing habits private.

63
00:02:54.159 --> 00:02:58.479
<v Speaker 2>Right Wireshark for Network Forensics shows you how to analyze

64
00:02:58.520 --> 00:03:01.879
<v Speaker 2>even this encrypted traffic, giving you that complete picture of

65
00:03:01.879 --> 00:03:05.159
<v Speaker 2>your network. And speaking of networks, the book also goes

66
00:03:05.199 --> 00:03:07.960
<v Speaker 2>deep into wireless lands. Have you ever thought about the

67
00:03:08.000 --> 00:03:10.159
<v Speaker 2>wireless spectrum and how it all works?

68
00:03:10.520 --> 00:03:12.719
<v Speaker 1>To be honest, it's always felt a bit mysterious to me.

69
00:03:13.039 --> 00:03:16.759
<v Speaker 2>Imagine the wireless spectrum as radio frequencies, like channels on

70
00:03:16.800 --> 00:03:20.080
<v Speaker 2>an old school radio. Devices use these frequencies to talk

71
00:03:20.120 --> 00:03:23.520
<v Speaker 2>to each other, and Wi Fi uses specific bands within

72
00:03:23.560 --> 00:03:26.639
<v Speaker 2>this spectrum. Think of them like different neighborhoods, each with

73
00:03:26.680 --> 00:03:28.240
<v Speaker 2>its own quirks and advantages.

74
00:03:28.479 --> 00:03:31.120
<v Speaker 1>So two point four gutter hurts, five gigaherts and six

75
00:03:31.159 --> 00:03:34.879
<v Speaker 1>getter herts are they like different postal codes within those neighborhoods.

76
00:03:34.960 --> 00:03:37.960
<v Speaker 2>That's a great analogy. Each band has a different range

77
00:03:38.039 --> 00:03:41.240
<v Speaker 2>and works best for different types of wireless communication. Two

78
00:03:41.240 --> 00:03:43.639
<v Speaker 2>point four gigaherts might be like a crowded city center,

79
00:03:43.879 --> 00:03:46.479
<v Speaker 2>while five gigaherts is more like the suburbs, quieter.

80
00:03:46.639 --> 00:03:48.919
<v Speaker 1>And of course we've got Wi Fi security protocols to

81
00:03:49.000 --> 00:03:50.199
<v Speaker 1>keep everything secure right.

82
00:03:50.199 --> 00:03:52.479
<v Speaker 2>The book goes into the history of these protocols, from

83
00:03:52.520 --> 00:03:54.879
<v Speaker 2>the early wp which was like a flimsy lock on

84
00:03:54.919 --> 00:03:58.560
<v Speaker 2>a mailbox, to the much stronger WPA twenty three. Using

85
00:03:58.560 --> 00:04:00.240
<v Speaker 2>tough encryption algorithms to protect your.

86
00:04:00.240 --> 00:04:03.520
<v Speaker 1>Data, like upgrading your mailbox to a fortress exactly.

87
00:04:03.960 --> 00:04:06.080
<v Speaker 2>And what's cool is that wire Shark lets you capture

88
00:04:06.080 --> 00:04:09.879
<v Speaker 2>and decrypt this wireless traffic, giving you insights into network

89
00:04:09.879 --> 00:04:12.439
<v Speaker 2>performance and any potential security problems.

90
00:04:12.639 --> 00:04:15.159
<v Speaker 1>So with wire Shark, we can actually see how a

91
00:04:15.240 --> 00:04:19.160
<v Speaker 1>device joins a Wi Fi network. It's like watching someone

92
00:04:19.199 --> 00:04:21.920
<v Speaker 1>register at the post office and getting their mailbox and key.

93
00:04:22.279 --> 00:04:24.560
<v Speaker 2>That's a great way to picture it. The book walks

94
00:04:24.600 --> 00:04:27.759
<v Speaker 2>you through the whole process, step by step, showing you

95
00:04:27.839 --> 00:04:31.079
<v Speaker 2>how wire Shark captures each exchange between the device and

96
00:04:31.120 --> 00:04:34.439
<v Speaker 2>the router, which lets you troubleshoot any connection issues and

97
00:04:34.480 --> 00:04:36.000
<v Speaker 2>spot potential security risks.

98
00:04:36.399 --> 00:04:39.480
<v Speaker 1>It's amazing how much information is hidden in plain sight,

99
00:04:39.720 --> 00:04:41.000
<v Speaker 1>just waiting to be uncovered.

100
00:04:41.240 --> 00:04:43.560
<v Speaker 2>That's the beauty of wire Shark. It gives you the

101
00:04:43.600 --> 00:04:45.800
<v Speaker 2>power to see what's really going on behind the scenes.

102
00:04:46.160 --> 00:04:49.399
<v Speaker 2>And the book doesn't stop there. Wireshard for Network Forensics

103
00:04:49.600 --> 00:04:52.120
<v Speaker 2>takes us even further into cloud and virtualization.

104
00:04:52.360 --> 00:04:55.360
<v Speaker 1>Now this is where things get really interesting. The cloud

105
00:04:55.399 --> 00:04:59.079
<v Speaker 1>has completely changed how we think about computing. I'm excited

106
00:04:59.079 --> 00:05:01.360
<v Speaker 1>to see how Wireshark fits into this new world.

107
00:05:01.720 --> 00:05:05.199
<v Speaker 2>Imagine if we swapped all the traditional mailboxes for virtual ones.

108
00:05:05.240 --> 00:05:10.160
<v Speaker 2>In the cloud. Virtual machines or vms are like individual mailboxes,

109
00:05:10.360 --> 00:05:12.560
<v Speaker 2>each with its own operating system and apps.

110
00:05:13.000 --> 00:05:15.920
<v Speaker 1>And what about containers They've become so popular lately.

111
00:05:16.040 --> 00:05:18.639
<v Speaker 2>Containers are even lighter and easier to move around. Think

112
00:05:18.639 --> 00:05:21.199
<v Speaker 2>of them like those little temporary lock boxes you can

113
00:05:21.199 --> 00:05:25.079
<v Speaker 2>get to the post office. Wireshark for Network Forensics shows

114
00:05:25.120 --> 00:05:28.240
<v Speaker 2>us how to capture traffic in these cloud environments, giving

115
00:05:28.319 --> 00:05:31.560
<v Speaker 2>you the tools to troubleshoot networks in AWS and GCP,

116
00:05:32.319 --> 00:05:35.680
<v Speaker 2>or even inside containerized apps using Docker and Kubernetes.

117
00:05:35.920 --> 00:05:38.240
<v Speaker 1>So we're not just limited to the physical world anymore.

118
00:05:38.360 --> 00:05:41.279
<v Speaker 1>Wire Shark lets us explore these virtual spaces too.

119
00:05:41.399 --> 00:05:44.720
<v Speaker 2>Exactly, and we're just scratching the surface here. Wire Shark

120
00:05:44.800 --> 00:05:47.120
<v Speaker 2>for Network Forensics takes you on a journey through the

121
00:05:47.279 --> 00:05:50.519
<v Speaker 2>entire network, from the physical cables to the virtual clouds.

122
00:05:50.920 --> 00:05:54.319
<v Speaker 1>Before we move on, we can't forget about Bluetooth. It's everywhere,

123
00:05:54.360 --> 00:05:57.560
<v Speaker 1>and I'm really curious what secrets wire Shark can unlock

124
00:05:57.600 --> 00:05:58.920
<v Speaker 1>in this web of connections.

125
00:05:59.199 --> 00:06:01.519
<v Speaker 2>You know, most people don't realize how much data their

126
00:06:01.560 --> 00:06:06.839
<v Speaker 2>Bluetooth devices are sending and receiving. Headphones, smart watches, even

127
00:06:06.879 --> 00:06:10.120
<v Speaker 2>your car. They're all constantly transmitting data.

128
00:06:10.360 --> 00:06:12.560
<v Speaker 1>So we're talking about a huge amount of information just

129
00:06:12.680 --> 00:06:13.360
<v Speaker 1>waiting to be.

130
00:06:13.319 --> 00:06:17.279
<v Speaker 2>Analyzed exactly, and with the right setup, wire Shark can

131
00:06:17.319 --> 00:06:21.079
<v Speaker 2>capture this Bluetooth traffic, giving you insights into how devices

132
00:06:21.120 --> 00:06:25.839
<v Speaker 2>pair up, fine services and exchange data. Imagine being able

133
00:06:25.879 --> 00:06:27.959
<v Speaker 2>to see what your fitness tracker is telling your phone,

134
00:06:28.600 --> 00:06:31.800
<v Speaker 2>or the command sent from your Bluetooth keyboard to your computer.

135
00:06:32.240 --> 00:06:34.800
<v Speaker 1>Wow, that's incredible. It's like we can eavesdrop on the

136
00:06:34.800 --> 00:06:36.600
<v Speaker 1>conversations between our devices.

137
00:06:36.759 --> 00:06:40.480
<v Speaker 2>Wire Shark for Network Forensics even explains the Bluetooth protocol

138
00:06:40.480 --> 00:06:42.360
<v Speaker 2>stack and how each layer works.

139
00:06:42.519 --> 00:06:44.560
<v Speaker 1>So it's not just about capturing the data, it's about

140
00:06:44.639 --> 00:06:45.360
<v Speaker 1>understanding what it.

141
00:06:45.319 --> 00:06:48.319
<v Speaker 2>All means precisely. It's like learning the language of Bluetooth.

142
00:06:48.720 --> 00:06:51.439
<v Speaker 2>This book gives you the power to analyze and troubleshoot

143
00:06:51.480 --> 00:06:52.680
<v Speaker 2>those connections like a pro.

144
00:06:53.000 --> 00:06:55.720
<v Speaker 1>We've covered so much ground already, from the basics of

145
00:06:55.759 --> 00:06:59.360
<v Speaker 1>packet capture to the intricacies of secure apps and the

146
00:06:59.399 --> 00:07:02.240
<v Speaker 1>world of why y list and Bluetooth communication. Wire Shark

147
00:07:02.279 --> 00:07:05.839
<v Speaker 1>for Network Forensics is a gold mine of information and.

148
00:07:05.800 --> 00:07:08.720
<v Speaker 2>We're only just getting started. There's still so much more

149
00:07:08.720 --> 00:07:12.600
<v Speaker 2>to explore. From finding network attacks to uncovering the secrets

150
00:07:12.600 --> 00:07:15.800
<v Speaker 2>of malware. Stay tuned for Part two, where we'll dive

151
00:07:15.879 --> 00:07:20.399
<v Speaker 2>even deeper into the world of network forensics. Welcome back,

152
00:07:20.639 --> 00:07:22.079
<v Speaker 2>Ready to dive back in? You bet?

153
00:07:22.279 --> 00:07:24.720
<v Speaker 1>I'm eager to see what other secrets wire Shark for

154
00:07:24.759 --> 00:07:26.519
<v Speaker 1>Network Forensics has in store.

155
00:07:26.720 --> 00:07:29.079
<v Speaker 2>Well. In this part, we're shifting gears a bit. We're

156
00:07:29.120 --> 00:07:32.000
<v Speaker 2>going to explore the darker side of networks. We're talking

157
00:07:32.000 --> 00:07:33.199
<v Speaker 2>about security attacks.

158
00:07:33.360 --> 00:07:36.920
<v Speaker 1>Ooh, sounds intriguing. So we'll be using wire Shark to

159
00:07:37.000 --> 00:07:40.040
<v Speaker 1>analyze those shady things happening beneath the surface exactly.

160
00:07:40.120 --> 00:07:42.920
<v Speaker 2>Think of those data packets like digital fingerprints left at

161
00:07:42.920 --> 00:07:45.720
<v Speaker 2>a crime scene. Wire Shark helps us find the culprit

162
00:07:45.759 --> 00:07:47.079
<v Speaker 2>and understand how they operate.

163
00:07:47.439 --> 00:07:49.800
<v Speaker 1>I like that analogy. The book starts by talking about

164
00:07:49.800 --> 00:07:52.519
<v Speaker 1>spoofing attacks. What exactly are they spoofing?

165
00:07:52.720 --> 00:07:56.120
<v Speaker 2>Okay, imagine this. Someone sends you a letter, but they

166
00:07:56.120 --> 00:07:59.079
<v Speaker 2>fake the return address to trick you into thinking it's

167
00:07:59.120 --> 00:08:01.839
<v Speaker 2>from someone you trust. That's spoofing in a nutshell.

168
00:08:02.199 --> 00:08:05.319
<v Speaker 1>So in the digital world, it means attackers are pretending

169
00:08:05.399 --> 00:08:09.560
<v Speaker 1>to be legitimate senders to gain access or steal information.

170
00:08:09.759 --> 00:08:12.560
<v Speaker 2>You got it. The book goes into a few types

171
00:08:12.600 --> 00:08:15.519
<v Speaker 2>of spoofing, each targeting a different part of the network.

172
00:08:16.000 --> 00:08:19.519
<v Speaker 2>There's ARP spoofing, which messes with the system that maps

173
00:08:19.560 --> 00:08:23.160
<v Speaker 2>IP addresses to physical devices. It's like changing the address

174
00:08:23.240 --> 00:08:25.279
<v Speaker 2>label on a package so it ends up at the

175
00:08:25.279 --> 00:08:25.879
<v Speaker 2>wrong house.

176
00:08:26.160 --> 00:08:28.360
<v Speaker 1>And what about DHCP spoofing.

177
00:08:28.519 --> 00:08:31.000
<v Speaker 2>That one's a bit more complex. It's like taking control

178
00:08:31.000 --> 00:08:33.960
<v Speaker 2>of the post office itself. Attackers set up a fake

179
00:08:34.039 --> 00:08:37.960
<v Speaker 2>server to give devices the wrong information. This can redirect

180
00:08:37.960 --> 00:08:40.320
<v Speaker 2>traffic or set the stage for even more attacks.

181
00:08:40.600 --> 00:08:44.120
<v Speaker 1>And then we have DNS spoofing, which sounds particularly sneaky.

182
00:08:44.399 --> 00:08:46.720
<v Speaker 2>It is. It's like tampering with the address book, so

183
00:08:46.759 --> 00:08:48.440
<v Speaker 2>when you try to visit a website, you're sent to

184
00:08:48.480 --> 00:08:50.559
<v Speaker 2>a fake version controlled by the attacker.

185
00:08:50.720 --> 00:08:54.240
<v Speaker 1>That's scary. So knowing all of this ken wire Shark

186
00:08:54.320 --> 00:08:56.519
<v Speaker 1>actually help us detect these attacks in action.

187
00:08:56.879 --> 00:09:00.639
<v Speaker 2>Absolutely. Wire Shark for Network Forensics shows you what these

188
00:09:00.679 --> 00:09:03.480
<v Speaker 2>attacks look like. When you're looking at wire Shark captures,

189
00:09:03.639 --> 00:09:07.399
<v Speaker 2>it's like learning to spot forged handwriting or a tampered seal, and.

190
00:09:07.360 --> 00:09:09.960
<v Speaker 1>By knowing the signs, we can take steps to protect

191
00:09:10.000 --> 00:09:11.279
<v Speaker 1>ourselves exactly.

192
00:09:11.879 --> 00:09:14.279
<v Speaker 2>The book goes into detail about security measures that can

193
00:09:14.320 --> 00:09:18.120
<v Speaker 2>help prevent these attacks. Think of it like installing security

194
00:09:18.159 --> 00:09:21.399
<v Speaker 2>cameras and alarms at your house. You're making things much

195
00:09:21.440 --> 00:09:22.960
<v Speaker 2>harder for those digital thieves.

196
00:09:23.360 --> 00:09:26.519
<v Speaker 1>Makes sense. Okay, so we've talked about spoofing. What other

197
00:09:26.559 --> 00:09:28.720
<v Speaker 1>sneaky tricks do Attackers have up their sleeves.

198
00:09:29.000 --> 00:09:31.879
<v Speaker 2>Well before launching a full on attack, they often do

199
00:09:31.960 --> 00:09:36.279
<v Speaker 2>some recon work. They scan and gather information. Imagine someone

200
00:09:36.360 --> 00:09:41.159
<v Speaker 2>scoping out a neighborhood, watching people's routines and looking for weaknesses.

201
00:09:40.679 --> 00:09:43.279
<v Speaker 1>So they're basically gathering intel before they make their move.

202
00:09:43.480 --> 00:09:46.159
<v Speaker 2>Right, they might scan ports, looking for open doors into

203
00:09:46.200 --> 00:09:51.120
<v Speaker 2>a system, or probe for vulnerabilities. Wireshark for Network Forensics

204
00:09:51.440 --> 00:09:54.679
<v Speaker 2>explains how to recognize these patterns in the traffic. It's

205
00:09:54.720 --> 00:09:57.519
<v Speaker 2>like spotting someone taking pictures of your house or testing

206
00:09:57.559 --> 00:09:59.320
<v Speaker 2>the locks. It's a red flag.

207
00:09:59.480 --> 00:10:01.919
<v Speaker 1>And once they've on a weakness, what happens next?

208
00:10:02.200 --> 00:10:05.960
<v Speaker 2>One common tactic is the brute force attack. Imagine someone

209
00:10:06.000 --> 00:10:09.440
<v Speaker 2>trying every key on a giant key chain just to

210
00:10:09.440 --> 00:10:10.840
<v Speaker 2>see which one unlocks your door.

211
00:10:11.159 --> 00:10:14.080
<v Speaker 1>So they're trying to guess passwords or encryption keys by

212
00:10:14.120 --> 00:10:16.159
<v Speaker 1>just throwing tons of combinations at it.

213
00:10:16.240 --> 00:10:19.120
<v Speaker 2>You got it, And with powerful computers they can try

214
00:10:19.519 --> 00:10:21.720
<v Speaker 2>millions of possibilities really quickly.

215
00:10:21.879 --> 00:10:24.080
<v Speaker 1>But wouldn't all those attempts leave a trace in the

216
00:10:24.120 --> 00:10:25.000
<v Speaker 1>network traffic?

217
00:10:25.120 --> 00:10:27.600
<v Speaker 2>You bet? And that's where wire Shark comes in handy.

218
00:10:28.120 --> 00:10:31.440
<v Speaker 2>Wire Shark for Network Forensics shows us how to spot

219
00:10:31.480 --> 00:10:35.879
<v Speaker 2>the patterns of repeated log in attempts with incorrect credentials.

220
00:10:36.399 --> 00:10:38.639
<v Speaker 2>It's like seeing the scratches on your doorknob from all

221
00:10:38.679 --> 00:10:39.679
<v Speaker 2>those failed attempts.

222
00:10:39.879 --> 00:10:41.840
<v Speaker 1>So we can use wire Shark to not only detect

223
00:10:41.879 --> 00:10:44.159
<v Speaker 1>these attacks as they happen, but also understand how they're

224
00:10:44.159 --> 00:10:45.559
<v Speaker 1>being carried out precisely.

225
00:10:46.159 --> 00:10:48.720
<v Speaker 2>And knowing that helps us take steps to protect ourselves,

226
00:10:49.000 --> 00:10:53.039
<v Speaker 2>like setting stronger passwords, using multi factor authentication, or even

227
00:10:53.080 --> 00:10:54.320
<v Speaker 2>limiting log in attempts.

228
00:10:54.360 --> 00:10:56.600
<v Speaker 1>Okay, I'm starting to feel like a real digital detective.

229
00:10:56.799 --> 00:10:58.759
<v Speaker 1>But what happens when the attackers aren't trying to be

230
00:10:58.799 --> 00:10:59.559
<v Speaker 1>stealthy at all?

231
00:10:59.759 --> 00:11:02.559
<v Speaker 2>A you're talking about denial of service attacks or DOS.

232
00:11:02.919 --> 00:11:04.399
<v Speaker 2>It's more of a smash and grab.

233
00:11:04.159 --> 00:11:07.399
<v Speaker 1>Approach, the kind of attacks that try to completely shut

234
00:11:07.440 --> 00:11:08.919
<v Speaker 1>down a network or service.

235
00:11:09.480 --> 00:11:11.919
<v Speaker 2>Right. Think of it like someone flooding your mailbox with

236
00:11:11.960 --> 00:11:15.240
<v Speaker 2>so much junk mail the legitimate letters can't get through.

237
00:11:15.600 --> 00:11:18.159
<v Speaker 1>So the goal is to disrupt rather than to be

238
00:11:18.279 --> 00:11:19.639
<v Speaker 1>sneaky exactly.

239
00:11:20.279 --> 00:11:23.919
<v Speaker 2>Wire Shark for Network Forensics shows us what these attacks

240
00:11:23.919 --> 00:11:26.919
<v Speaker 2>look like in the data. You see these huge spikes

241
00:11:26.919 --> 00:11:30.240
<v Speaker 2>in certain types of traffic. It's like watching mountains of

242
00:11:30.320 --> 00:11:33.320
<v Speaker 2>junk mail pile up, blocking the important stuff.

243
00:11:33.360 --> 00:11:35.559
<v Speaker 1>And d dalls attacks are even worse, right they are.

244
00:11:35.679 --> 00:11:38.240
<v Speaker 2>It's like that junk mail being delivered not by one person,

245
00:11:38.320 --> 00:11:41.399
<v Speaker 2>but by a whole army of people. Distributed denial of

246
00:11:41.440 --> 00:11:44.600
<v Speaker 2>service attacks use a network of hack devices to amplify

247
00:11:44.639 --> 00:11:45.159
<v Speaker 2>the damage.

248
00:11:45.320 --> 00:11:47.080
<v Speaker 1>Yikes, so the impact is much bigger.

249
00:11:47.320 --> 00:11:51.720
<v Speaker 2>Absolutely, But even with these sophisticated attacks, wire Shark for

250
00:11:51.759 --> 00:11:54.720
<v Speaker 2>Network Forensics gives us the tools we need. We can

251
00:11:54.759 --> 00:11:57.559
<v Speaker 2>analyze the traffic, find the source of the attack, and

252
00:11:57.679 --> 00:12:00.360
<v Speaker 2>understand the methods being used. It's a first step to

253
00:12:00.399 --> 00:12:01.679
<v Speaker 2>figuring out how to fight back.

254
00:12:01.759 --> 00:12:04.000
<v Speaker 1>So it's like having the ability to not only see

255
00:12:04.000 --> 00:12:07.360
<v Speaker 1>the attack happening, but also understand the attacker strategy exactly.

256
00:12:07.639 --> 00:12:09.519
<v Speaker 2>And you know what they say, knowing your enemy is

257
00:12:09.519 --> 00:12:10.200
<v Speaker 2>half the battle.

258
00:12:10.360 --> 00:12:12.360
<v Speaker 1>Before we move on, I have to ask about malware.

259
00:12:12.519 --> 00:12:16.120
<v Speaker 1>It's like everyone's worst nightmare, those sneaky programs that can

260
00:12:16.159 --> 00:12:17.799
<v Speaker 1>cause so much damage.

261
00:12:17.879 --> 00:12:20.639
<v Speaker 2>You're right, malware is a serious threat. It's like a

262
00:12:20.679 --> 00:12:25.440
<v Speaker 2>ticking time bomb. It can spread through email attachments, malicious websites,

263
00:12:25.759 --> 00:12:29.320
<v Speaker 2>even infected USB drives, and once it's on your system,

264
00:12:29.360 --> 00:12:32.639
<v Speaker 2>it can steal your data, launch other attacks, or even

265
00:12:32.679 --> 00:12:34.399
<v Speaker 2>hold your files hostage for ransom.

266
00:12:34.799 --> 00:12:37.360
<v Speaker 1>So how does wire Shark help us fight against malware?

267
00:12:37.679 --> 00:12:40.559
<v Speaker 2>Wire Shark for Network Forensics teaches us how to use

268
00:12:40.559 --> 00:12:43.399
<v Speaker 2>wire Shark to become malware hunters. We can use it

269
00:12:43.440 --> 00:12:46.320
<v Speaker 2>to find suspicious patterns in the network traffic. It's like

270
00:12:46.360 --> 00:12:49.080
<v Speaker 2>noticing someone sneaking around your house late at night. It's

271
00:12:49.080 --> 00:12:50.519
<v Speaker 2>a sign that something's not right.

272
00:12:50.600 --> 00:12:53.519
<v Speaker 1>So we're looking for those telltale signs of malware communication

273
00:12:53.840 --> 00:12:55.720
<v Speaker 1>like connections to known.

274
00:12:55.679 --> 00:12:59.039
<v Speaker 2>Bad servers exactly, or maybe there are sudden downloads of

275
00:12:59.039 --> 00:13:02.360
<v Speaker 2>suspicious files. Wire Shark can help us analyze those files

276
00:13:02.519 --> 00:13:05.240
<v Speaker 2>and figure out if they're actually dangerous. It's like having

277
00:13:05.240 --> 00:13:07.519
<v Speaker 2>an X ray machine for your network, so we can

278
00:13:07.519 --> 00:13:08.639
<v Speaker 2>see those hidden threats.

279
00:13:08.919 --> 00:13:12.399
<v Speaker 1>This is incredible. So wire Shark for Network Forensics isn't

280
00:13:12.440 --> 00:13:15.480
<v Speaker 1>just about learning the technical stuff about network traffic. It's

281
00:13:15.519 --> 00:13:18.559
<v Speaker 1>about equipping us with the knowledge and skills to become

282
00:13:18.759 --> 00:13:19.960
<v Speaker 1>digital detectives.

283
00:13:20.200 --> 00:13:23.639
<v Speaker 2>I couldn't have set up better myself. By understanding the patterns,

284
00:13:23.720 --> 00:13:28.000
<v Speaker 2>the techniques, and the tools, we can become proactive defenders

285
00:13:28.039 --> 00:13:31.360
<v Speaker 2>of our digital worlds. And in Part three, we'll explore

286
00:13:31.399 --> 00:13:33.919
<v Speaker 2>even more ways wire Shark can help us analyze and

287
00:13:33.960 --> 00:13:35.159
<v Speaker 2>secure our networks.

288
00:13:35.720 --> 00:13:37.960
<v Speaker 1>And we're back for the final part of our deep

289
00:13:38.000 --> 00:13:41.600
<v Speaker 1>dive into wire Shark for Network Forensics. It's been quite

290
00:13:41.679 --> 00:13:42.879
<v Speaker 1>a journey, wouldn't you say.

291
00:13:42.960 --> 00:13:45.480
<v Speaker 2>Absolutely. We've covered a lot of ground, from those tiny

292
00:13:45.559 --> 00:13:48.519
<v Speaker 2>data packets to uncovering the tricks attackers use.

293
00:13:48.720 --> 00:13:50.840
<v Speaker 1>It's amazing how much we've learned about the hidden world

294
00:13:50.879 --> 00:13:53.679
<v Speaker 1>of networks just using this one book as our guide.

295
00:13:54.159 --> 00:13:57.279
<v Speaker 2>Wire Shark from Network Forensics really does a fantastic job

296
00:13:57.279 --> 00:14:00.200
<v Speaker 2>of making these complex topics understandable even if you're a

297
00:14:00.279 --> 00:14:00.879
<v Speaker 2>tech expert.

298
00:14:01.039 --> 00:14:03.840
<v Speaker 1>I agree. It's not just a dry technical manual. It's

299
00:14:03.840 --> 00:14:05.960
<v Speaker 1>more like a guidebook to a whole new way of

300
00:14:05.960 --> 00:14:07.120
<v Speaker 1>seeing the digital world.

301
00:14:07.279 --> 00:14:09.000
<v Speaker 2>You know, It's like putting on those X ray glasses

302
00:14:09.000 --> 00:14:11.879
<v Speaker 2>and suddenly you can see all these hidden conversations happening

303
00:14:11.879 --> 00:14:13.200
<v Speaker 2>all around us exactly.

304
00:14:13.399 --> 00:14:15.600
<v Speaker 1>And what strikes me is how practical this book is.

305
00:14:15.679 --> 00:14:17.960
<v Speaker 1>It's not just theory. It shows you how to use

306
00:14:18.000 --> 00:14:20.240
<v Speaker 1>wire Shark to solve real world problems.

307
00:14:20.559 --> 00:14:24.919
<v Speaker 2>Whether you're investigating a security breach, troubleshooting a network issue,

308
00:14:25.759 --> 00:14:28.080
<v Speaker 2>or just curious about how things work under the hood.

309
00:14:28.279 --> 00:14:30.159
<v Speaker 1>It gives you the tools to find the answers. And

310
00:14:30.200 --> 00:14:32.240
<v Speaker 1>one thing that really stood out to me was the

311
00:14:32.279 --> 00:14:34.559
<v Speaker 1>focus on real world examples.

312
00:14:34.639 --> 00:14:38.200
<v Speaker 2>Oh. Absolutely. The case studies are fascinating. They show you

313
00:14:38.279 --> 00:14:40.919
<v Speaker 2>how wire Shark has been used to solve real mysteries

314
00:14:41.240 --> 00:14:42.799
<v Speaker 2>and uncover hitting truths.

315
00:14:43.360 --> 00:14:45.000
<v Speaker 1>Can you tell me about one. I love a good

316
00:14:45.039 --> 00:14:45.879
<v Speaker 1>detective story.

317
00:14:46.000 --> 00:14:49.440
<v Speaker 2>Well, there's this one case where a company was having

318
00:14:49.440 --> 00:14:52.480
<v Speaker 2>these weird network slowdowns. They couldn't figure out what was

319
00:14:52.519 --> 00:14:55.279
<v Speaker 2>causing it, so they called in a wire Shark expert.

320
00:14:55.360 --> 00:14:57.080
<v Speaker 1>Okay, I'm hooked. What did they find?

321
00:14:57.519 --> 00:15:00.960
<v Speaker 2>After analyzing the network traffic, the expert discovered a rogue

322
00:15:01.000 --> 00:15:04.200
<v Speaker 2>device that was flooding the network with tons of requests.

323
00:15:04.200 --> 00:15:06.279
<v Speaker 1>A rogue device? What was it?

324
00:15:06.440 --> 00:15:07.559
<v Speaker 2>Get this? It was a printer?

325
00:15:07.879 --> 00:15:10.639
<v Speaker 1>A printer no way, yep.

326
00:15:11.120 --> 00:15:14.000
<v Speaker 2>Apparently it was malfunctioning and causing all sorts of chaos.

327
00:15:14.519 --> 00:15:17.879
<v Speaker 2>Once they isolated the printer, the network problems disappeared.

328
00:15:18.159 --> 00:15:21.559
<v Speaker 1>Wow. I would have never guessed. It's amazing how something

329
00:15:21.840 --> 00:15:25.080
<v Speaker 1>so seemingly harmless can have such a big impact.

330
00:15:25.240 --> 00:15:27.120
<v Speaker 2>It really shows you how important it is to be

331
00:15:27.120 --> 00:15:29.440
<v Speaker 2>able to see what's happening on your network, and that's

332
00:15:29.440 --> 00:15:32.720
<v Speaker 2>what Wireshark for Network Forensics gives you the power to

333
00:15:32.759 --> 00:15:34.000
<v Speaker 2>see those hidden details.

334
00:15:34.639 --> 00:15:37.399
<v Speaker 1>Another thing that impressed me was how the book tackles

335
00:15:37.399 --> 00:15:42.919
<v Speaker 1>some pretty advanced topics. It delves into decrypting secure application traffic,

336
00:15:43.399 --> 00:15:48.080
<v Speaker 1>analyzing multimedia streams, even capturing data from cloud environments and

337
00:15:48.200 --> 00:15:49.200
<v Speaker 1>virtual machines.

338
00:15:49.440 --> 00:15:51.720
<v Speaker 2>It's like they're giving you a toolbox filled with all

339
00:15:51.759 --> 00:15:55.279
<v Speaker 2>these different gadgets for any network investigation you might encounter.

340
00:15:55.360 --> 00:15:58.080
<v Speaker 1>And it doesn't stop there. The book really encourages you

341
00:15:58.120 --> 00:16:01.240
<v Speaker 1>to keep learning, to experiment, and to connect with the

342
00:16:01.279 --> 00:16:02.840
<v Speaker 1>wider wire Shark community.

343
00:16:03.000 --> 00:16:05.720
<v Speaker 2>It reminds you that wire Shark is always evolving and

344
00:16:05.759 --> 00:16:08.279
<v Speaker 2>that there's a whole community of passionate people out there

345
00:16:08.799 --> 00:16:10.720
<v Speaker 2>sharing their knowledge and helping each other.

346
00:16:11.000 --> 00:16:14.279
<v Speaker 1>It's like a global network of digital detectives all working

347
00:16:14.279 --> 00:16:17.600
<v Speaker 1>together to solve mysteries and keep the online world safe.

348
00:16:17.840 --> 00:16:21.480
<v Speaker 2>And wire Shark for Network Forensics is the perfect guidebook

349
00:16:21.519 --> 00:16:23.840
<v Speaker 2>for anyone who wants to join that community and embark

350
00:16:23.879 --> 00:16:25.120
<v Speaker 2>on their own investigations.

351
00:16:25.360 --> 00:16:27.559
<v Speaker 1>Well, as we wrap up this deep dive, I have

352
00:16:27.639 --> 00:16:31.559
<v Speaker 1>to say I'm feeling incredibly inspired. It's amazing how much

353
00:16:31.679 --> 00:16:35.200
<v Speaker 1>power we have at our fingertips to understand and protect

354
00:16:35.360 --> 00:16:39.559
<v Speaker 1>our digital worlds, and wire Shark for Network Forensics has

355
00:16:39.600 --> 00:16:41.759
<v Speaker 1>given us the keys to unlock those secrets.

356
00:16:41.919 --> 00:16:43.840
<v Speaker 2>It's been a pleasure sharing this journey with you.

357
00:16:44.000 --> 00:16:46.279
<v Speaker 1>Likewise, to our listeners, we encourage you to pick up

358
00:16:46.279 --> 00:16:48.480
<v Speaker 1>a copy of the book, fire up wire Shark and

359
00:16:48.519 --> 00:16:51.639
<v Speaker 1>start exploring. You never know what mysteries you might uncover.

360
00:16:52.159 --> 00:16:54.440
<v Speaker 1>Until next time, happy packet sniffing.