Wireshark
I'm studying this book and in this post, I'll write some of the notes that I've made about it!
- Packets are bunches of streaming data in a network.
- Wireshark can capture these packets using a network interface (okay everyone already knows that, just wanted to be clear)
When can we use Wireshark?
To search the reason and the roots of a problem, to search for a protocol or a device stream, and to analyze specific timings, protocols flags, or transmitted bits.
Wireshark user interface: we use a dissector that can parse and decode protocols to present them on the interface.
Wireshark Filters: exhibition filters are all about filtering the protocols that we see on the packet list.
Another interesting thing that I've noticed in the book is the part of IDS that stands for Intrusion Detection System
Detection methods are signature-based or anomalies-based.
Signature-based: detects using what it already knows. The IDS owns a database containing lots of signatures or patterns to be observed. If a captured data match one of the patterns or the signature, it is detected.
Anomalies-based: it is activated when the traffic looks to be suspicious when compared to what is considered normal.
Wireshark is a Signature-based IDS
False-positive occurs when a good event is considered a bad event.
False-negative is when a bad event is detected or is not detected.
Capturing data
Sniffing -> capture of network traffic
----------------------------------------non finished post----------------













