wireshark tutorial for beginners youtube

Do you know how devices such as hubs, switches and routers treat traffic? Do you know what port span is? Make sure you know where to capture packets or frames in a network. 👊👊👊support the mission, join thisisIT: Make sure you disable spanning tree or any other noise you might have going out the bridge port.This is a complete Wireshark and Ethical hacking course. If you have a NIC with 2 ports, you can set a no IP address linux bridge, and run the capture on the bridge, sit in the middle, and watch stuff go thru. When you find an event, trekking thru another machines log files is much easier with accurate clock. It’s nice to have NTP set on all your stuff, including your capture machine. Learn tcpdump, t-shark, or comparable CLI for your hostOS. Learn how to filter by source or destination MAC, and source, destination IP. Disable IP on your port so it’s just a raw Eth port, and wireshark off of that. If at all possible, get a trunk port off of a switch with a lot of VLANs.

If you get a “sawtooth” transfer, probably dropping a packet somewhere, and the receive window is resetting. Capture the whole thing, and then look at the TCP negotiations as it ramps up. DNS, http, tftp, snmp, routing protocols possibly.ĭo a speedtest. Then looking at different ports, decode by conversation. And see what various hosts use for MSS values. Ping with packet sizes that approach, and then exceed MTU and watch the decode. Look for fragmentation, check MTU everywhere.

Hint, learn if you have OSPF in your network.

Then boot something on the network, and filter for everything to/from that device. Learn how to filter spanning tree if it’s too much. Then ARP, gratuitous ARP, LLDP and other broadcasts. Then verify layer 2 and layer 3 priority (p-bit and DSCP).

Wireshark tutorial for beginners youtube