Wireshark

Wow.

And then doing a Mac address search on Wireshark's OUI database.

And I basically have a really good list of here's the Macs, the types of devices they are, and the ports they're plugged into in your network.

Absolutely.

Wow.

And then doing a Mac address search on Wireshark's OUI database.

And I basically have a really good list of here's the Macs, the types of devices they are, and the ports they're plugged into in your network.

Absolutely.

I put StreamWanderer.

I put NetSpeeder, Wireshark, with a Google Gemini plugin API that you have free of your Google account.

And to parse that, because, you know, NetShark got a lot of information flying around.

But parsing it

On

Mixbox.

Yeah, I'm doing a chat on my next scan, on my Wireshark scan, and all the data that I'm collecting from this box.

I'm parsing that with Google.

There are three places you can tap traffic, and none of them is a superset of the others.

Packet Capture, so TCP Dump, Wireshark, Tshark.

Intercepting Proxy, so Mittman Proxy, Burp, Fiddler, Charles.

And Browser Internals, which is DevTools HAR Export, the Chrome DevTools Protocol, NetLog.

The tooling ecosystem around this exploded this year.

It did.

There's a project called CC Proxy 347 Stars, which is a transparent interceptor built on Mitman Proxy plus WireGuard with full TLS inspection and Wireshark keylog export.

It jails a process in a rootless WireGuard namespace and intercepts at the network layer, so the process doesn't know it's being watched.

This this.

Some of the scans are intrusive, and I would never run them, and the same is for Wireshark.

Whatever kind of tool you want to use, yes, there are ways to do it if you know how to do it, and what is the thing that you want to scan.

But if you blindly do stuff in a network that you don't know, the chances are high that you harm something.

I'd like to know kind of what it can find and if it can find everything that I did on my own and maybe some more things that I don't know about.

Many of our users will come to us at the point where they've probably tried something like Wireshark or maybe some other mechanisms by which they can solve a problem.

Same story here.

it's a lot of people's first introduction to OptiGo VN is just uploading a Wireshark capture or just trying to see like, did we find something that they didn't? So that's kind of the context.

It's a school district, as I said, in Western Canada.

And, you know, it's a similar story to what we hear all the time, right? Comms issues, controllers going offline, points not coming back, slowness, all the comms issues that folks on this, who are watching this will be very familiar with.

So, With that in mind, the customer uploaded a Wireshark capture, which I've got here under one of our sites here called a school district so that we can keep this anonymous.

And you can see right off the bat that the network health score on this file is really low, right? So for folks who are listening to this podcast, Optigo VN's health score is kind of the easiest way to know right off the bat how the system is performing.

This this.

Some of the scans are intrusive, and I would never run them, and the same is for Wireshark.

Whatever kind of tool you want to use, yes, there are ways to do it if you know how to do it, and what is the thing that you want to scan.

But if you blindly do stuff in a network that you don't know, the chances are high that you harm something.

There's a couple, right? So one is really being aware that these typos, [chuckles] these typos can persist in a lot of ways that we, that we don't even think about, right? And not only in an accidental way but, you know, if they're actually, uh, selling ads and trying to sell traffic.

Really need to make sure that when you go to download some sort of utility like 7-Zip or, or all the other ones that we would wanna get access to, like we might want, we might want Wireshark, right, in, in the cyber world, make sure that we're getting it from the right, uh, the right location.

And then putting in policies, putting in policies within your enterprise and enforcing them of not allowing, uh, free VPNs, for example.

Like, all of that stuff is residential proxies, and it means that those devices are utilizing, from an enterprise perspective, utilizing the enterprise's IP addresses and their bandwidth and their reputation in order to act on someone else's behalf, um, which, yeah, is no bueno.