question regarding analysis in black/red/purple/pink?

asked 2020-01-25 15:23:48 +0000

killerfoxx gravatar image

updated 2020-01-25 15:44:28 +0000

Jaap gravatar image
2091   -11606.495296   DESKTOP-Q4VCO63.local   pf2bn3.activity.windows.com.akadns.net  TCP 1494    [TCP Retransmission] 52894 → https(443) [PSH, ACK] Seq=32864 Ack=32224 Win=132352 Len=1440
2093    -11606.448223   pf2bn3.activity.windows.com.akadns.net  DESKTOP-Q4VCO63.local   TCP 66  [TCP Dup ACK 2092#1] https(443) → 52894 [ACK] Seq=32224 Ack=34304 Win=524800 Len=0 SLE=32864 SRE=34304
2   -11729.665288   mobile-gtalk.l.google.com   DESKTOP-Q4VCO63.local   TCP 86  hpvroom(5228) → 52782 [ACK] Seq=1 Ack=2 Win=258 Len=0 SLE=1 SRE=2
25  -11723.785204   Android.local   Broadcast   ARP 42  Who has 192.168.0.1? Tell 192.168.0.15
121 -11714.701856   DESKTOP-Q4VCO63.local   pf2bn3.activity.windows.com.akadns.net  TCP 1494    [TCP Retransmission] 52894 → https(443) [PSH, ACK] Seq=4415 Ack=6193 Win=132352 Len=1440
126 -11714.607968   pf2bn3.activity.windows.com.akadns.net  DESKTOP-Q4VCO63.local   TCP 66  [TCP Dup ACK 122#1] https(443) → 52894 [ACK] Seq=10886 Ack=5855 Win=524288 Len=0 SLE=4415 SRE=5855
127 -11714.607967   pf2bn3.activity.windows.com.akadns.net  DESKTOP-Q4VCO63.local   TCP 1514    [TCP Retransmission] https(443) → 52894 [PSH, ACK] Seq=9426 Ack=5855 Win=524288 Len=1460
131 -11714.452588   DESKTOP-Q4VCO63.local   pf2bn3.activity.windows.com.akadns.net  TCP 1494    [TCP Retransmission] 52894 → https(443) [PSH, ACK] Seq=5972 Ack=10886 Win=132352 Len=1440
395 -11649.628686   dual-a-0001.a-msedge.net    DESKTOP-Q4VCO63.local   TCP 56  https(443) → 52883 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
438 -11646.802997   DESKTOP-Q4VCO63.local   cs9.wpc.v0cdn.net   TCP 74  [TCP Retransmission] 52885 → https(443) [FIN, ACK] Seq=1 Ack=97 Win=1022 Len=0
439 -11646.193710   DESKTOP-Q4VCO63.local   cs9.wpc.v0cdn.net   TCP 74  [TCP Retransmission] 52885 → https(443) [FIN, ACK] Seq=1 Ack=97 Win=1022 Len=0
442 -11645.192995   DESKTOP-Q4VCO63.local   cs9.wac.phicdn.net  TCP 54  [TCP ACKed unseen segment] 52890 → http(80) [FIN, ACK] Seq=1 Ack=2 Win=513 Len=0
443 -11645.163963   cs9.wac.phicdn.net  DESKTOP-Q4VCO63.local   TCP 56  [TCP Previous segment not captured] http(80) → 52890 [FIN, ACK] Seq=2 Ack=2 Win=288 Len=0
444 -11645.163497   DESKTOP-Q4VCO63.local   cs9.wac.phicdn.net  TCP 54  [TCP ACKed unseen segment] 52890 → http(80) [ACK] Seq=2 Ack=3 Win=513 Len=0
440 -11645.599862   DESKTOP-Q4VCO63.local   2607:fea8:99a0:1805:be4d:fbff:fed0:8922 ICMPv6  86  Neighbor Solicitation for 2607:fea8:99a0:1805:be4d:fbff:fed0:8922 from c8:d7:19:c3:b3:b5
441 -11645.595925   2607:fea8:99a0:1805:be4d:fbff:fed0:8922 DESKTOP-Q4VCO63.local   ICMPv6  78  Neighbor Advertisement 2607:fea8:99a0:1805:be4d:fbff:fed0:8922 (rtr, sol)
458 -11642.796248   DESKTOP-Q4VCO63.local   a-0003.a-msedge.net TCP 54  52897 → https(443) [ACK] Seq=1 Ack=1 Win=262144 Len=0
469 -11642.764991   DESKTOP-Q4VCO63.local   a-0003.a-msedge.net TLSv1.2 271 Client Hello
596 -11642.518104   2607:fea8:99a0:1805:be4d:fbff:fed0:8922 DESKTOP-Q4VCO63.local   DNS 171 Standard query response 0xec95 AAAA ...
(more)
edit retag flag offensive close merge delete

Comments

What have you tried looking at on Youtube? There seems to be lots of Wireshark Beginners Guide videos.

To understand the displays in Wireshark you must have at least a basic understanding of computer networks.

grahamb gravatar imagegrahamb ( 2020-01-25 15:45:11 +0000 )edit

Your question mentions colors and a fair chunk of the packets include messages from the Wireshark Expert Info system.
1. Having all the colors blaring can be a bit distracting. To disable the colors: View->Colorize Packet List
2. Start with menu items under Statistics: Capture File Properties, Protocol Hierarchy, Conversations and Endpoints to get a feel for what was happening during the capture.
3. Info on the Expert Info messages: https://www.wireshark.org/docs/wsug_h...
4. All of the videos from Sharkfest are good: https://sharkfestus.wireshark.org/ret... but perhaps overwhelming where to start. Here is a good beginner video with Jasper:
https://www.youtube.com/watch?v=R3nuu... (The audio improves mid-way through).

bubbasnmp gravatar imagebubbasnmp ( 2020-01-25 18:56:09 +0000 )edit

Thank you will do:)

killerfoxx gravatar imagekillerfoxx ( 2020-01-27 15:49:28 +0000 )edit