Ettercap, Wireshark, Cain on a Wifi Network

No explicit questions like "how do I hack xxx.com" please!
User avatar
f4Gg0t_43
Fame ! Where are the chicks?!
Fame ! Where are the chicks?!
Posts: 245
Joined: 13 Sep 2008, 16:00
15
Contact:

Post by f4Gg0t_43 »

I think that's a bit to advanced for me right now, it says I need knowledge on tcp/ip which I don't have that much. I do understand what you ment before now though.

When I go into wireshark and capture packets (sent/received for me), and I look at packets (kind of understand the frames now), there is no where in them, my internet IP address.

The ones I send, the destination is the IP address of the server, but wouldn't I be sending my router the packets, and not directly to the server? The source is my 192.168.1.x IP (don't know what to call it).

The ones I receive, the destination is the 192.168.1.x IP, and the source is the server. So does my router modify the packets before sending them to me or something?

It seems like wireshark just skips the routing process or something, and the packets are coming directly to me and not through the router. Sorry if this was a bad explanation.

User avatar
DNR
Digital Mercenary
Digital Mercenary
Posts: 6114
Joined: 24 Feb 2006, 17:00
18
Location: Michigan USA
Contact:

Post by DNR »

Skip TCP/IP for now, and read about network devices, like routers. Then there is the OSI layer bit..

The router is changing the packets on the network level, it has a table of its internal IP=MAC address of machines on the LAN. It will change the IP to the external IP as given by your ISP, the MAC will help it tell the router when it comes back from the internet who to send it to inside the network.
Thus, in general, every packet on your network has an Ethernet MAC address source and destination -- and an IP address source and destination.
Hubs and Switches are also found, but they work on a different level of the OSI layer
A switch works by examining the MAC address (layer 2 address) of incoming frames. Switches learn MAC addresses as traffic is generated, a switching table built, very quickly the switch has enough information to operate effectively. A switch examines MAC addresses of frames. If the frame is local ie: the MAC address on the same network segment as the incoming port of the switch then the frame is not forwarded across the bridge. If the frame is not local ie: with a MAC address not on the incoming port of the switch then it is forwarded to the appropriate network segment. All the decision-making is carried out by the switching circuits based on MAC addresses.
Hubs operate at the Physical Layer of the OSI model and can be generally divided into two types, active and passive.

Passive hubs do not amplify the electrical signal of incoming packets before broadcasting them out to the network, whereas, active hubs retime and regenerate signals in a similar way to a repeater. Some people use the term concentrator when referring to a passive hub and multi-port repeater when referring to an active hub.
Look at the OSI layer and a packet
http://whatis.techtarget.com/definition ... 29,00.html
Image

DNR
-
He gives wisdom to the wise and knowledge to the discerning. He reveals deep and hidden things; he knows what lies in Darkness, and Light dwells with him.

User avatar
DNR
Digital Mercenary
Digital Mercenary
Posts: 6114
Joined: 24 Feb 2006, 17:00
18
Location: Michigan USA
Contact:

Post by DNR »

Quick Note on TCP Packet Field Descriptions

The following descriptions summarize the TCP packet fields:

• Source Port and Destination Port—Identifies points at which upper-layer source and destination
processes receive TCP services.
• Sequence Number—Usually specifies the number assigned to the first byte of data in the current
message. In the connection-establishment phase, this field also can be used to identify an initial
sequence number to be used in an upcoming transmission.
• Acknowledgment Number—Contains the sequence number of the next byte of data the sender of
the packet expects to receive.
• Data Offset—Indicates the number of 32-bit words in the TCP header.
• Reserved—Remains reserved for future use.
• Flags—Carries a variety of control information, including the SYN and ACK bits used for
connection establishment, and the FIN bit used for connection termination.
• Window—Specifies the size of the sender’s receive window (that is, the buffer space available for
incoming data).
• Checksum—Indicates whether the header was damaged in transit.
• Urgent Pointer—Points to the first urgent data byte in the packet.
• Options—Specifies various TCP options.
• Data—Contains upper-layer information.

Begin study on TCP/IP :wink:
http://www.cisco.com/en/US/docs/interne ... o_doc.html
DNR
-
He gives wisdom to the wise and knowledge to the discerning. He reveals deep and hidden things; he knows what lies in Darkness, and Light dwells with him.

Post Reply