TechKnowSurge
Cisco CCST Networking 5.2 Cisco CyberOps Associate 4.8 CompTIA Network+ 5.5 Cisco CyberOps Associate 4.6
TechKnowSurge Catalog Videos DEMO: Wireshark, What’s With These Bits
VideoNetworkFree

DEMO: Wireshark, What’s With These Bits

Wireshark is used to capture and inspect live network traffic at the bit level, demonstrating how ARP requests work to resolve IP addresses to MAC addresses on a local network.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Wireshark is a network protocol analyzer that captures the raw data passing through a network interface card, making it possible to examine exactly what is being transmitted at the frame and packet level. Selecting an Ethernet interface and beginning a capture immediately surfaces traffic generated by the switch itself, including discovery and spanning tree protocol messages, which serve as background noise for this exercise. To produce meaningful, controlled traffic for analysis, a ping is issued from a statically assigned IP address to another address on the same subnet, triggering the ARP process. ARP, or Address Resolution Protocol, is the mechanism a device uses to broadcast a request across the local network asking which host owns a given IP address and what MAC address is associated with it. Wireshark captures these ARP frames, and clicking on any captured packet reveals a layered detail view. The middle pane breaks down the frame structure, identifying fields such as the destination MAC address, which appears as all Fs in hexadecimal to indicate a broadcast. Switching the lower pane from hexadecimal to binary display exposes the actual bit pattern sent across the network, where each hexadecimal F translates to four binary ones, confirming the all-ones broadcast signature at the bit level.

What you'll learn

What's covered

Wireshark Network Analysis

Aligned to

Cisco CCST Networking
5.2 Perform a packet capture with Wireshark and save it to a file
Cisco CyberOps Associate
4.8 Interpret the fields in protocol headers as related to intrusion analysis
4.6 Extract files from a TCP stream when given a PCAP file and Wireshark
CompTIA Network+
5.5 Given a scenario, use the appropriate tool or protocol to solve networking issues

Key terms

Address Resolution Protocol
ARP
A protocol used to map an IP address to a physical MAC address on a local network.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Data Link Layer
Layer 2 of the OSI model responsible for node-to-node data transfer and error detection on a single network segment.
Wireshark
Wireshark is an open-source network protocol analyzer that captures and interactively displays packet-level traffic, used by security professionals for network forensics, vulnerability research, and incident investigation.
Broadcast Address
The last address in an IP subnet range, formed when all host bits are set to one, used to send a single packet to every device on that network simultaneously.

Transcript

Capturing on the Ethernet card

So what's with these bits? Let's actually take a look at some of it. I have Wireshark. Wireshark is what allows us to see what is actually being sent through these network cards. I've got a list of the network cards that are available to me. I'm going to choose the Ethernet one. This is connected to a switch, and there's really nothing else that's connected to this switch.

The first thing that we see is that it's capturing some of the data that's going through here, and a lot of it's coming from the switch itself, so we don't really need to be too concerned with it. We're going to learn more about some of these discovery protocols and some of the spanning tree protocols later in future classes, but for now just realize it's capturing the data.

Generating an ARP request

I want to generate some data that's going to go out from this Ethernet card. So I'm going to pull up a command prompt, and within the command prompt I'm going to see what network I'm on. I have a static IP address assigned to this network interface card, which is 192.168.74.12. I need to ping something on this network, and once again there's nothing really on this network to ping. Let's do 45. That's going to send some data out this Ethernet. What it's actually doing is it's trying to discover this device out there and figure out what MAC address belongs to this IP address. It's called the ARP request.

I'm going to stop the capture here. I can scroll through here and I'm going to look for those ARP requests. I click on it and I can see that it is an ARP request. It shows me that right here, and so it's asking who is this. It's trying to discover a MAC address, and it is coming from 192.168.74.12. So it's saying, hey, who is this? I want you to tell me, which is 192.168.174.12, what your MAC address is.

Reading the frame as bits

When we click on these different frames that have gone out, these packets slash frames that have gone out this network card, it's going to show the details down below in these bottom two frames. The middle frame right here shows us details. For instance, I'll scroll up. We see that this is a broadcast address, and we see that it's a broadcast address because it's all Fs.

I can click on here and it's actually going to show me what part of the frame down here. There's two different frames here. In the frame of Wireshark, it's going to show me the part of the frame or packet that was sent out this network card. So I can see that it's all Fs.

And you may say, "Oh, wait a minute. Now where's the bits?" Well, it's showing us this in hexadecimal form. So I actually want to see this in bits form, so we can actually see what bits went out there. So I'm going to right-click on this bottom frame and say "as bits". And now I can actually see all of the bits. And if you're familiar with hexadecimal, you'll notice that each F turned into four ones. And so here, the broadcast, it's all ones across there. I can see the actual bits that went across this.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →