> For the complete documentation index, see [llms.txt](https://davin-hong3.gitbook.io/d/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davin-hong3.gitbook.io/d/walkthroughs/capture-the-flags-ctf/tryhackme-advent-of-cyber/day-9-networking-where-is-all-this-data-going.md).

# Day 9 : Networking - Where is all this data going

Wireshark PCP file analysis

### Introduction

![](https://2068334946-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fow1iM27u7disHeJiSlBC%2Fuploads%2FVLqEoje4hzVbyW0XTtQS%2Fimage.png?alt=media\&token=3a6a690e-b8c9-450e-b13a-6745ab9e8f29)

###  - Filtering techniques 

Let's assume that we are looking for all packets that have been sent or received by the following IP address: 172.21.2.116. Thus, the following filter is helping us to display all network packets that have the IP address 172.21.2.116: ip.addr == 172.21.2.116 

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5d617515c8cd8348d0b4e68f/room-content/e0b374773899e2415d2d8a4f61536b47.png)

As a result, we can see that we were able to show only the packet(s) that we needed.<br>

Next, we can also specify certain protocols, such as HTTP showing all packets for this protocol. We can also specify a domain name to narrow down the search. The following example shows that we are looking for HTTP packets that have the google.com  domain name: http contains google.com&#x20;

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5d617515c8cd8348d0b4e68f/room-content/6e94452efbd9ed1dd36660a51a23ebb4.png)

Next, we can also look at a specific port. Let's try to filter and list all packets for remote desktop protocol. We can do that by using tcp.port : tcp.port == 3389&#x20;

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5d617515c8cd8348d0b4e68f/room-content/422856ce2908da0ad0210829f6b51639.png)

However, assume that you are monitoring the network traffic and you want to exclude the RDP packets. In this case, we can use the not Wireshark rule as shown below.

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5d617515c8cd8348d0b4e68f/room-content/0c91e1a5308ae7dc4392691273458605.png)

Next, we will perform the packet analysis technique using Wireshark on various protocols, including HTTP, FTP, and DNS.&#x20;

### - filter http requests

* command http
* http.request.method == GET / POST
* follow > TCP stream

### &#x20;- DNS (Port 53)

* records URL for IP addresses, links them
* udp.port filter will specify DNS packets, by default they run on UDP port 53, sometimes on TCP port 53
* udp.port ==  53 or dns only

### &#x20;- FTP (port 21)

* tcp.port == 21
* ftp-data for those with content