{"id":247,"date":"2023-09-13T19:56:37","date_gmt":"2023-09-14T03:56:37","guid":{"rendered":"https:\/\/www.dumpsterfirecomputing.com\/?p=247"},"modified":"2023-09-13T19:56:39","modified_gmt":"2023-09-14T03:56:39","slug":"wireshark-workbook-lab-4","status":"publish","type":"post","link":"https:\/\/www.dumpsterfirecomputing.com\/?p=247","title":{"rendered":"Wireshark Workbook &#8211; Lab 4"},"content":{"rendered":"\n<p>Lab 4 is complete, and I&#8217;d probably give myself a passing grade for this round of questions.  The subject this time was TCP SYN analysis.  Now, if I were asked in an interview to &#8220;describe the TCP handshake&#8221; I&#8217;d have been able to answer that no problem.  But the analysis and questions in this lab went a bit deeper than simply filtering for SYN, SYN\/ACK, and ACK packets.<\/p>\n\n\n\n<p>One of the early bits of learning in this lab was identifying Wireshark&#8217;s coloring scheme, what it means, and how to identify the color filters within the frame.  I&#8217;m sure you knew that, but I didn&#8217;t.  For instance:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"511\" height=\"360\" src=\"https:\/\/www.dumpsterfirecomputing.com\/wp-content\/uploads\/2023\/09\/image-4.png\" alt=\"\" class=\"wp-image-248\" srcset=\"https:\/\/www.dumpsterfirecomputing.com\/wp-content\/uploads\/2023\/09\/image-4.png 511w, https:\/\/www.dumpsterfirecomputing.com\/wp-content\/uploads\/2023\/09\/image-4-300x211.png 300w\" sizes=\"auto, (max-width: 511px) 100vw, 511px\" \/><\/figure>\n\n\n\n<p>Here I simply thought green meant good.  No, seriously.  I didn&#8217;t want to Bing this answer, and my poking around didn&#8217;t lead me to the real answer, so when it came time for me to note something&#8230;.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"214\" height=\"83\" src=\"https:\/\/www.dumpsterfirecomputing.com\/wp-content\/uploads\/2023\/09\/image-5.png\" alt=\"\" class=\"wp-image-249\"\/><\/figure>\n\n\n\n<p>Yea&#8230;<\/p>\n\n\n\n<p>There were a few questions that asked to identify how many TCP conversations contained certain flags or options.  I missed quite a few of these, mostly due to how I had interpreted &#8220;conversations&#8221;.<\/p>\n\n\n\n<p>We looked again at things like Window Scaling, Selective ACK, and Maximum Segment Size, with an interesting question around how communication would suffer if one of those weren&#8217;t set.<\/p>\n\n\n\n<p>In some of these cases I wonder what the diagnostic or troubleshooting reason for finding these data point might be (such as locating sequence numbers), but I think the real goal for this early in the workbook is to get comfortable simply &#8220;finding information&#8221;.  Certainly there&#8217;s an emphasis on finding and building filters.  <\/p>\n\n\n\n<p>The nice thing I&#8217;ve noticed with Wireshark is that there&#8217;s actually a lot of contextual help if you know where to look.  For example:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"338\" height=\"318\" src=\"https:\/\/www.dumpsterfirecomputing.com\/wp-content\/uploads\/2023\/09\/image-6.png\" alt=\"\" class=\"wp-image-250\" srcset=\"https:\/\/www.dumpsterfirecomputing.com\/wp-content\/uploads\/2023\/09\/image-6.png 338w, https:\/\/www.dumpsterfirecomputing.com\/wp-content\/uploads\/2023\/09\/image-6-300x282.png 300w\" sizes=\"auto, (max-width: 338px) 100vw, 338px\" \/><\/figure>\n\n\n\n<p>With the SYN: Set highlighted, you get the filter syntax at the bottom of the window.  There&#8217;s tons of this sort of help.<\/p>\n\n\n\n<p>These lab questions were definitely harder (for me) than the prior labs, but that&#8217;s what it&#8217;s all about &#8212; pushing myself, learning new things.  More tools for the toolkit.  <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Lab 4 is complete, and I&#8217;d probably give myself a passing grade for this round of questions. The subject this time was TCP SYN analysis. Now, if I were asked [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[54],"tags":[14,53],"class_list":["post-247","post","type-post","status-publish","format-standard","hentry","category-learning","tag-learning","tag-wireshark"],"_links":{"self":[{"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=\/wp\/v2\/posts\/247","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=247"}],"version-history":[{"count":1,"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=\/wp\/v2\/posts\/247\/revisions"}],"predecessor-version":[{"id":251,"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=\/wp\/v2\/posts\/247\/revisions\/251"}],"wp:attachment":[{"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=247"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=247"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=247"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}