In today's meeting we introduced Wireshark, the industry-standard network protocol analyzer. The session covered the theoretical foundations of network communication through the OSI model, an overview of common protocols, and techniques for capturing and analyzing network traffic.

The OSI Model

We started with a review of the OSI Model, focusing on the layers most relevant to packet analysis:

• •The Data Link Layer: Handled via Ethernet headers containing MAC addresses; data at this layer is referred to as a Frame.
• •The Network Layer: Focused on IP headers containing source and destination IP addresses; data at this layer is a Packet.
• •The Transport Layer: Managed by TCP or UDP headers containing ports and sequence numbers; data here is called a Segment.

Common Protocols

We explored several common protocols and how they appear within Wireshark, namely:

• •ARP (Address Resolution Protocol): Used to map IP addresses to MAC addresses.
• •IP & ICMP: Foundational Layer 3 protocols used for routing and diagnostic tools like ping and traceroute.
• •TCP vs. UDP: Comparing the reliable, connection-oriented 3-way handshake of TCP against the fast, connectionless delivery of UDP.
• •DNS: The system for resolving domain names to IP addresses, typically operating on UDP port 53.
• •The Insecure Trio: We highlighted FTP (Port 21), TFTP (Port 69), and Telnet (Port 23) as legacy protocols that transmit credentials and data in plaintext, making them easy targets for interception.

Wireshark Basics

A significant portion of the meeting focused on Wireshark basics and navigating the interface. We discussed the difference between Capture Filters (applied before recording using BPF syntax) and Display Filters (applied after recording to show specific traffic), and members learned to use the Packet List, Packet Details, and Hex View to inspect traffic at different levels of abstraction. We also practiced "peeling back" the layers of a captured packet, mapping them directly to the OSI layers—from the physical frame metadata up to the Application layer data (HTTP, DNS, etc.).