Cyberstudy
Supplementary — not from your PDF Intermediate ~40 min

Capture and read your own traffic in Wireshark

Capture your own computer's traffic while you browse, then use display filters to find DNS lookups and TLS handshakes, and see what encryption hides and what it doesn't.

Environment

Wireshark on your own computer (free, wireshark.org).

Before you start

  • Read Packet Captures (p.322), Network Data Sources (p.321) and Transport Layer Security (p.278).

You will

  • Start and stop a capture
  • Use display filters
  • Identify what is visible in encrypted traffic

Steps

  1. 1

    Start Wireshark, choose your active Wi-Fi or Ethernet interface, and click Start.

  2. 2

    In your browser, visit two or three HTTPS sites, then stop the capture.

  3. 3

    Apply the display filter dns and find the lookups for the sites you visited.

  4. 4

    Apply tls.handshake.type == 1 to see Client Hello messages. Expand one and find the Server Name Indication (SNI) and the offered TLS versions.

  5. 5

    Apply tls.handshake.type == 2 (Server Hello) and note the chosen version and cipher suite.

  6. 6

    Right-click a TLS packet → Follow → TLS Stream. The application data is unreadable, because it's encrypted.

  7. 7

    Write down what a network observer can still learn (sites via DNS and SNI, timing, volume) and what they can't (page contents).

Check your understanding

  • ?Why does DNS reveal browsing even when the pages are HTTPS?
  • ?What does the Server Hello's cipher suite tell you?
  • ?When would an organization need full packet capture instead of just flow data?