Real quick, and don't you worry, we'll go back outside here in a second, but I want to show
you inside of our lab here momentarily, Wireshark, and what exactly I'm talking about as far as
packaging is concerned. I'm going to start up a monitor on the actual lab itself under the
vEthernet lab switch, and that allows us to be able to monitor traffic from not only our host
VM, but all the VMs that you see right above me that we are normally in. I'm going to go ahead
and start this, and I've already been running it. I'm going to just do a quick copy a file over from
Kali into the actual host VM. You can see there that we've created some traffic already. Now,
we're just going to take a look at these three packets here momentarily to get an idea and tie
this beginning together. So, first and foremost, when we take a look at an actual packet,
we know that we're going through the OSI model, and we start off with a to and from address,
and this generally works just like an envelope inside the mail because our to and from is the
source and destination of a packet going from 192.168.0.53, which is the Kali box,
to 192.168.0.1, which is our actual host VM environment where we just did that copy to and
from. Now, that's the addressing. So, as long as the writing on the envelope looks okay and is not
written in ransom letters from those different magazines, we should be able to get this going
to and from across different networks, right? I'm glad you're tracking. Now, the stuff inside of it,
as far as like the protocol and everything else, is just making sure that the contents of the
actual letter are okay. See, at this particular point, we're not really doing deep packet
inspection as the inspector, us here physically. Wireshark is doing it, and I'm going to show you
here in a second how, but as far as like the administration and security goes, we're just
making sure that it has sufficient postage, which is the SMB2 at this point because that tells us
that it's checked off and routed through that particular protocol, and we're starting to go
down the OSI model that we were describing, and the info is basically what happened, what's being
requested here, what's being done. Now, when we go inside of the actual packet itself through
Wireshark, we start getting into that deep packet inspection, and that's because, and we're going to
touch on this here momentarily, that this is not encrypted traffic. This is all plain text
open in the air, so anybody can take a look at it. It'd be like if your envelope was transparent
in the mail, but you could see here that these are SMB, so there was a file connection of some type,
and I can go even further by going into the actual SMB header, and I'm going to zoom in for
you here real quick because this is where we start getting into that deep packet portion of this
inspection, that we're looking further into the actual packet beyond the source and destination
of the actual file itself. Now, can we get any more info because I mentioned I did send a file
to generate this traffic, and through Wireshark, yes, we can. So, we go to File and go to Export
Objects, knowing that the protocol here was SMB. We can just simply go to SMB, and you can see here
that nothing transferred yet. Interesting. I forgot to type in the password for sudo and
Kali, and I started questioning myself here. Let me go ahead and type that in, and you can see,
boom, shakalaka, in Wireshark behind that all the traffic has been generated. Now, let me show you
what I was talking about. Let's stop that capture real quick and go into File, Exports, SMB. You can
see here that I have one line highlighted, and it's that hash challenge file, and yes, that is
the deep packet inspection going through taking a look at the files as they're running through on
Wireshark and being able to save that file to, let's say, the desktop. I'm going to save it,
close, and I'm going to minimize everything here for us real quick.
Down, minimize, minimize, and right here, I just highlighted it, and I'll zoom in for you. See that
file hash challenge starts with a parentheses five? That's the file that came over, and because
we were able to deep packet inspect, we were able to pull that out of the actual traffic itself
and extract it for us to be able to copy to the desktop. Now, I sent it to the actual share folder
I have highlighted right there, but that was just an example of how deep packet inspection works,
and the more that you do this and the more numerous and bigger files that you send,
the more complex this gets because it starts eating up the bandwidth and resources on the
system doing the inspection. So, there's a trade-off, and we're going to get into that too.