Question

ScreenShots

Answer 1

@e.mccormick

Answer 2

Yep. Pretty typical.

Answer 3

I think the general transfer of files between 2 computers would be easier

Answer 4

You can see the actual HTTP streams mized in with the assorted TCP syn/ack messages.

And yes, the more you eliminate "noise" the easier it is to follow. But you can use a filter to help with that.

Answer 5

Is there a filter option in Wireshark?

Answer 6

There are 2 options:1) Capture filters 2) Display filters

Answer 7

When I clicked Capture Filters, this appeared:

Answer 8

Yes. A capture filter can help ignore things before they go into the capture file. For example, if you relay from a router and only want the relay to get recorded, that is good. In contrast, a display filter only shows less of what has been captured.

Answer 9

Oh. Now what to do after clicking Capture filters? The screenshot is above

Answer 10

Lets say you only wanted to capture unsecured web traffic. That TCP or UDP port 80 one would get it down to just that.

See, a capture is a recording. A capture filter means record less.

Answer 11

If I have done a google search or went to some website. Then which port does it use?

Answer 12

I mean which protocol

Answer 13

Lets say you just wanted to display less, but still capture it all. That is a display filter.

You could right click an aspect of a frame and make a filter that is specific to that.

The web you see in a browser is basically http and https. The difference is the s ones are secured.

Answer 14

Okay. Go it. Just a second. Trying it out

Answer 15

Here are some examples:
http://www.maketecheasier.com/use-display-filters-in-wireshark/

Answer 16

It worked. Here are the screenshots:

Answer 17

You see...The 4th screenshot has your name in the log data

Answer 18

Yep. So that has drilled down to where you are seeing some web page lookup of OpenStudy. Following that stream would/could then let you rebuild the HTML of the page. When you follow a stream it takes all the packets that say they are for a particular session and puts them back together. So for viewing a web page it is the HTTP session that loaded that one page.

Answer 19

Yes. Thanks for the help again

Answer 20

np. I hope that helps you understand what a lan analyzer is and can do. A related topic is packet sniffing or a packet sniffer. It is basically the same thing.

Answer 21

Oh. I will look into it

Answer 22

When you do research, people call it one or the other. If you think about it, a network analyzer detects (sniffs) packets and allows you to take them apart to look at their protocols, etc. So they call it a network analyzer, protocol analyzer, wireless sniffer, packet sniffer, etc. Sometimes one term will get you slightly different information than another, but they are very closely related.

For example, Snort: https://www.snort.org/

That is a packet sniffer that looks at network activity to find intrusions. So it is a packet sniffer that has a very specific focus to find malicious activity.

In contrast, Kismet is taylored to work with Wireless networks:
https://www.kismetwireless.net/

Answer 23

How are kismet and snort different from wireshark? Because wireshark also detects packets and tell the protocol they use

Answer 24

Wireshark is very raw and does little work other than get the data and display it. Kismet I have looked at a little but never tried. Snort does things based on what it sees.

Think about oranges. Wireshark gets an orange and hands it to you. Next orange comes along, it hands it to you. Snort would look at the orange, see it is an orange, and let it go. Next one comes along and Snort smells it and says, "This is a LEMON that someone has painted orange! WARNING, WARNING! LEMON CODE!"

That is a bit allegorical, but it is the difference between a basic capture tool and one that does a specific job.

Answer 25

Oh okay. So we specify some certain computers with the IP addresses connected to a network. If a computer whose IP address is not specified connects with the network, it alarms us

Answer 26

It can do that. In general, Snort knows what attacks look like. Think of it as a virus checker for packets.

Answer 27

Oh. Got it

Answer 28

Well, I have to head out, but I hope that helps you understand some different types of network tools.

Answer 29

Yes. I have saved this link: https://www.wireshark.org/docs/wsug_html_chunked/ to learn about WireShark

Answer 30

Thanks for your time