16:40
2025-04-22 09:23:11
5:01
2025-04-22 09:42:41
3:06:56
2025-04-22 10:08:58
3:52
2025-04-22 13:53:28
2:14:18
2025-04-23 09:04:44
7:38
2025-04-23 13:15:25
Visit the Basic Network Troubleshooting using Wireshark course recordings page
United Arab Emirates - Basic Network Troubleshooting Using Wireshark
WEBVTT
-->
Okay so I can see your desktop so please double check the time display format is the one that
-->
I selected here second since first capture packet. Okay good. So okay this is actually
-->
this is a default measurement of time that I just want to make sure we are absolutely on
-->
packet page. So I believe I've always selected this selection and I want to see my running total
-->
of time. So it's like I start at stopwatch at first package 0.0 and then as the packets come
-->
in I can gradually see those came into to our other packet. So in total how much time of
-->
actually I can put it in here 156 seconds. Okay so this is the total time that's spending
-->
in this conversation. All right okay so let's jump into here.
-->
Ah okay but before that can you help me to um maybe
-->
okay maybe we can do it later. No worries we can do it later. So from here first packet
-->
I'm seeing our client send us in request and then with the HTTP GET and then server responded
-->
but inside here I can see client send another GET request we ask the client is sending
-->
to this sls-client-opportunity.asps file for whatever that is in that application but
-->
I think right now it's not very important. Let's see the client connected over the TCP
-->
and able to send the request to the server but did the server get the response?
-->
Did the server get the response? Okay let's see. If we look at the packet number five
-->
why is continuation? What is that means? Actually this is a continuation packet that
-->
means the packet size limited during capture so that means the client the request from
-->
the client was so large so it will span in two okay it will span in two
-->
packets. It's not uncommon to see but sometimes a GET is so much in it
-->
okay so there's a lot of information and from the client to the server so it just simply
-->
spans more than one packet going from the client to the server. Okay let's go down to
-->
this packet six so I can see the server got the response server got the response with the
-->
knowledge all right so if I got it I come over to the link here is the link it's just a 60
-->
wow okay that means it's a very small packet coming back from the server is it full enough
-->
no I don't think it's a full response just yet because the server may be saying I got
-->
but wet how long do we wait okay so maybe some notice that um okay let's continue
-->
in the next packet we can see 20 seconds right 20 seconds to receive a packet so that means
-->
how long do we wait is wait until 20 seconds 20 seconds quite a lot so what does tell me
-->
I think that three will handshake work pretty quickly or at least 100 millisecond
-->
network latency but this get was enough to the server it takes 10 20 seconds so from
-->
the previous packet you can see the maximum was only 201 218 milliseconds
-->
and the minimum one is just 105 milliseconds but right now I can see in the packet number seven
-->
eight stacking how many seconds 20 seconds in order to send the response back to us
-->
okay so that was tell us the response was um slow the response was slow from client
-->
to the application sorry from server to the client okay so that means there was something
-->
wrong something wrong in the server side so this is something that I can take a look
-->
and understand what's happening in the packet file okay so for the rest of the um packet
-->
I won't describe right now because we have a first lesson to brief you to about what is
-->
the information in the bottom left corner and the middle pen okay so I will not like
-->
go into a deeper for this pick up for this moment and just get you to warm up to show
-->
some of the things that we can determine at the packet level and maybe stir up some of
-->
your assignment okay so all right so I think okay let me open the camera I want to
-->
uh
-->
all right so I'm not really familiar with um yeah bear with me
-->
okay
-->
okay so from the pre-lab I hope you guys can get some ideas on how
-->
do we know have a first look on the packet file but this was a lesson I think in the
-->
let me think I think maybe we are going to discuss in very deeper in the third day lesson
-->
first day and second day we need to understand from the beginning because
-->
this is a basic training from the very beginning on how to install the virtual
-->
what are the default interface and how do we look into the color um
-->
color filtering and do some filtering color ruling do some filtering on narrow down the
-->
analysis so so on so forth okay so I think let's have a 15 minutes break before we jump
-->
into a first lesson I think first day I don't want to make it very tight schedule
-->
I yeah let's have a short break before we continue into the first lesson is that all right
-->
okay so Alex I'm not sure is there a music or timer in the zoom
-->
okay okay so there's no music like teams we can just launch it no okay all right no worries
-->
just take a short break I think because first day first lesson we are yeah we'll get a bit
-->
warm if we continue yeah talk too much into just the first session all right see you guys
-->
later yes I will launch a timer I will put in the chat see you at 10 30 all right see you
-->
guys
-->
You want to drink some water?
-->
No, I don't want to drink it.
-->
What do you want to drink?
-->
I want to drink it like you do.
-->
No, don't disturb me.
-->
Hello, we are back.
-->
Alright, so I hope you guys enjoy the short break and have a drink, have a water.
-->
Alright, so I think before we go to the first lesson, I want to make sure that my speaking is not that fast.
-->
You are able to catch up what I'm saying.
-->
Or is it too fast for you to understand my talking?
-->
Okay, that's good.
-->
Okay, let me adjust my speaker.
-->
Is it better now?
-->
Okay, thank you.
-->
So I think my first lesson is about starting from installing the workshop from the beginning.
-->
So maybe we go into the first lesson.
-->
I want to have more interaction.
-->
So at first, you both introduce yourself as a network engineer.
-->
So maybe one of you, each of you can take like two minutes to maybe let me know who are the team players?
-->
I mean, who are you working with?
-->
I'm working with software engineers, task engineer, developer, developers, security ops, any product manager, project manager, business analyst, product owner.
-->
So for me to understand what is your daily task and understand like what are you doing every day.
-->
Maybe just a high level introduction about your job.
-->
So who want to raise your hand and go first?
-->
Clients.
-->
So do you have any application?
-->
I mean like software, website, or desktop application like install, for example, Microsoft Word, Office.
-->
So whenever web browser, web application, for example, Google.com.
-->
Or do you have any website or application that used by your client or only internet issue?
-->
So you are not the one who set up the environment, but you are the one who like need to do some troubleshooting on any network issue.
-->
So typically like mostly what are the issues?
-->
Maybe you can give you one example.
-->
What are the common issues that you found in your regular job?
-->
Just any one example of your problem that you mostly encounter from the client side.
-->
So whenever you have some clues after your troubleshooting.
-->
So who is the one who need to communicate with?
-->
I mean you collect the logs, packet files, and do analysis and found some clues.
-->
So able to found the solution.
-->
So are you the one who just fix it and then who need to report to or are you need to communicate with your client?
-->
Or do you need to do a report?
-->
Okay, I see. You are the one.
-->
Deal with client, solve the issue.
-->
I mean collect the issue, solve the issue, and communicate with client.
-->
Okay, I see.
-->
So maybe I can share some demo from the software application perspective.
-->
I'm not sure if you guys are interested to know.
-->
But at least we can integrate with Wireshark to know what we normally do from there.
-->
Let's back to our presentation slide.
-->
Let me minimize.
-->
Hope you don't mind because I just feel some eye drops in my eyes because I cannot really always open it.
-->
So I will turn off the camera sometimes.
-->
So are you guys able to see my sharing screen?
-->
That's good. Let's proceed.
-->
I like to see your face.
-->
So I'm opening the gallery mode.
-->
So first lesson is about the introduction to Wireshark.
-->
I will try to speak slowly.
-->
I hope I'm not too fast. If too fast, just rest your hand or shout to me.
-->
So we're going to talk about how to successfully capture network traffic.
-->
Because if you don't capture it well, you can't analyze it.
-->
So this is the first lesson we're going to go through in the morning session.
-->
So these are the things that I'm going to discuss and share with you.
-->
First, we're going to learn how to install the Wireshark with some default settings.
-->
But some command line trees as well if you are also using it.
-->
And where and how on the network that we should capture the packets.
-->
And then the first packet that captured maybe just some very high-level introduction on the first packet that I'm capturing.
-->
And then the ring buffer that I'm going to share with you on how I collect the log files.
-->
And also some best practice guidelines when you are doing the packet capture.
-->
So before we get into the packet reads, we first have to install the Wireshark.
-->
So I've already installed it for you in the virtual machine.
-->
And I believe because you're the one who uses the Wireshark in your daily tests.
-->
So you're very familiar with the installation.
-->
Just in case you want to look at some extra features that get installed along the actual user interface.
-->
So this is the first lesson it's all about.
-->
Let me copy and open it.
-->
So this is the Wireshark official website.
-->
May I know how often you are using the Wireshark official website to go to ask a question to the developer or go to the documentation or FAQ?
-->
Do you guys go through it in very deeper to get some information while you are doing your daily tests?
-->
No? Okay.
-->
Alright.
-->
So from here actually we can get the installer.
-->
If you want to download it, you can see there are multiple types of installer.
-->
So for Windows, normally I would choose the first one.
-->
So I already installed it in my local.
-->
So I will drive you guys through the installation.
-->
I need to close it first.
-->
Now done.
-->
This is already installed in my machine.
-->
Nope.
-->
Alright.
-->
Where is my Wireshark?
-->
Okay, here.
-->
So just now I downloaded the .exe file.
-->
So now I executed that file.
-->
So it comes down to install the Wireshark.
-->
This is the first UI that you can see.
-->
Oh, it cannot be enlarged.
-->
Okay, never mind.
-->
So this is the installer and the first UI that you can see.
-->
So let's go to the next and agree on the license agreement noted.
-->
Okay, next.
-->
So normally the components that to install, normally I will use the default one.
-->
And you can just go into the next page if I just hit the enter.
-->
But if you expand the tools in here, right?
-->
You can see some other tools, the extra tools and with the command line tools as well.
-->
But I'm not really like use the command line tools in my daily tasks.
-->
So normally I will just skip it.
-->
But if you are familiar with this command line tool that is helpful for you, you can also install it as well as this T-Shark.
-->
Okay, so have you guys used the T-Shark as well?
-->
The terminal shark, this one?
-->
Yes or no?
-->
Okay, have you guys ever used the T-Shark too?
-->
Okay, so normally you won't install it.
-->
How about the command line tools like edit-cap, merge-cap, texture-pcap and the components?
-->
No, okay, so you just use the default one, yes?
-->
Alright, so let's go to the next.
-->
And okay, because okay, let's see.
-->
I think already installed, okay.
-->
So I'm not able to check this install mpcap because I already installed it.
-->
Currently installed version is 1.79.
-->
This is very important.
-->
I have to highlight this because this is the actual packet driver that collects the packets from the wire.
-->
So this is very something that is important to know as well.
-->
We have to install it, otherwise we are not able to capture the packet successfully and properly in the wire shock.
-->
So go to the next and then click install.
-->
So for this one, it's up to you.
-->
Okay, it's optional, right?
-->
So I won't click install because I already installed it.
-->
And this is just to tell you about the installation that normally did by the common user.
-->
If you have extra components that you are going to use like the one that I mentioned,
-->
a list of extra components that you normally use, then you have to manually check and then install it.
-->
Okay.
-->
So once you have installed it, let's launch a wire shock.
-->
Okay, hold on.
-->
Okay.
-->
So let me launch a wire shock now.
-->
Okay.
-->
So now we have, all of us have the wire shock downloaded, right?
-->
So let's go ahead and collect some traffic off the network.
-->
And go ahead and file our wire shock and let's get to the first packet capture.
-->
So you can see that is the history PCAP file that I opened before.
-->
And here are the interface.
-->
Okay.
-->
Here are the interface and the protocol that bound with the protocol driver.
-->
So normally what are the interface that we are going to choose?
-->
So may I know what are the interface that mostly you are analysed on?
-->
Is it Wi-Fi or LAN?
-->
Okay, LAN because you are using the company office, right?
-->
Okay, understood.
-->
So, okay.
-->
So there are a few options here.
-->
If let's say, okay, if let's say here I didn't have the USB connected so I cannot see the USB interface.
-->
But if you have the USB device connected, you can even see a USB interface.
-->
Have you also traversed or analysed the USB traffic?
-->
No, only the LAN.
-->
Okay, okay.
-->
So USB is one of my, I think one of my interface that I use before because like for example,
-->
if we trying to, I'm the hacker.
-->
Okay, I'm the hacker.
-->
I want to spread the wires to the client side.
-->
So I purposely plug in the USB and then download the wires file.
-->
Maybe just a text file, zip file, whatever file.
-->
And then download it to the local machine.
-->
So that is something that I need to try and test it.
-->
But here I didn't plug in the USB so what I can show is the default one.
-->
Wi-Fi, Internet, LAN, whatever.
-->
So normally I would choose Wi-Fi interface because my wires was enabled.
-->
Okay, this is something that the interface that I could go ahead and capture on.
-->
So there are a few options.
-->
As long as you know what other interface and which interface has utilization,
-->
just go into the closet and then we will get some bit information coming in.
-->
All right.
-->
Okay, so let's open it.
-->
Okay, so as you can see, I mouse over to the Wi-Fi interface.
-->
So I can see this is my information, right?
-->
So my IP address is here that you can see, no capture filter.
-->
So let's double click and it was starting to capture all the packets.
-->
So wow, a few thousand is going on and on.
-->
So let me install it.
-->
I think I need to end.
-->
Hold on, let me end the slideshare because I cannot really click on other ways.
-->
Okay, so I just stopped it.
-->
I just stopped the capturing.
-->
So if let's say I reproduce the issues that encounter in the client side,
-->
I'm going to save and give that a file name.
-->
So let me try to do it.
-->
Okay, so I'm selecting as pcap-mg file.
-->
May I know, are you using other file extension as well?
-->
Except apart from this pcap-mg.
-->
What are the other types that you use?
-->
Are you using other options for the file extension as well in your daily job?
-->
Yes or no?
-->
Oh, you are only saved as the pcap-mg file.
-->
Okay, all right.
-->
So let me quickly save it.
-->
Intro.
-->
Okay, let's save it intro.
-->
So from here I can see I already saved it.
-->
Let me go to the desk.
-->
Okay, so this is the packet file that I installed.
-->
So it's just a very simple.
-->
If you only select as a pcap-mg, you just save as and then select a type that you prefer.
-->
So this is the standard pcap-mg file.
-->
So if you come down to netmall, novel, land analyzer.
-->
So this is something that is not a common one.
-->
It's not a popular one.
-->
All right, this is the first packet with Wireshark we already captured.
-->
Okay, now on the other note, before we go to the next part of our training,
-->
I want to show you some of the capture options.
-->
Okay, so let me share the...
-->
Okay, so this is the capture option that I'm going to show you.
-->
All right, here.
-->
So, okay, all right.
-->
So this is the capture option.
-->
You can see all those inputs.
-->
This is the interface that we are seeing in the first UI.
-->
Okay, so just now I selected Wi-Fi.
-->
This is my IP address of my host machine.
-->
And normally when I'm doing the capturing,
-->
so I will always look into the capture option first.
-->
Okay, you can go from here, capture options,
-->
or this is the little icon here.
-->
Send, access.
-->
So this is a little gear which is the capture option.
-->
All right, so just now I mentioned if you have plugged in the USB,
-->
you can also see USB interface showing here.
-->
So if you have another USB option, you can also see different...
-->
I mean, connected to the client or endpoints that install the workshop,
-->
you can see different list of interfaces were showing here.
-->
Okay, let's go to the output here.
-->
Okay, I'm sharing with you about the...
-->
Okay, so just now I set the packet file as intro.pcapmg.
-->
So this is the only one file that I'm capturing and storing.
-->
So let's say I want to do some configuration before I capture the file.
-->
And if I want to monitor over the time, all the time, right?
-->
For example, two hours, three hours.
-->
So if the file getting larger and larger,
-->
it will come to one gig, two gig, three gig, and even 10 gig and 100 gig.
-->
So what is going to happen to my storage, right?
-->
So it will be crazy big, it will be crazy huge.
-->
So this is something that will not happen in our client side.
-->
They will comprehend I cannot use my machine because my local storage already bombed.
-->
Okay, so normally I will use...
-->
Okay, let's say let me choose a location.
-->
I'm using test.
-->
Let's say I'm using test as my file name.
-->
I'm selecting pcapmg.
-->
So I click this, create a new file automatically.
-->
So I can select different option to capture to a permanent file.
-->
Let me end the screenshot.
-->
Okay, here you can see this is a ring buffer, right?
-->
Have you used ring buffer for your capturing?
-->
No, okay.
-->
So maybe this is something interesting for your information.
-->
So normally before I capture the file, I will try to select a location.
-->
I will fill in the name.
-->
For example, it's Tesla.
-->
Then I will try to enable the ring buffer and then fill in some information here.
-->
Okay, because like I mentioned, I don't want to capture a massive pcap.
-->
I don't want to make my system crash and fill my hard drive.
-->
So the ring buffer is very important.
-->
I want to point your attention to.
-->
So what is ring buffer means?
-->
So that's I'm going to share with you.
-->
So for example, I want to store my test pcapmg as 20 here.
-->
I increase to 20 from 2 to 20.
-->
And then I'm going to get this 20 files total of 500.
-->
Okay, let's say 500 megabytes for each.
-->
So that means after the 20th file, that means 21 onwards,
-->
I'm going to go back to the first file and override the first one.
-->
Okay, you get what I mean?
-->
Okay, for example, in this location, you were going to have test 01, 02 up to 20.
-->
And then started from 21, test 21, 22, it will override with 21 with 01.
-->
So I will only always see 20 files with one 500 megabytes for each.
-->
So in total, it will only allocating 10 gigabytes of my hard drive for packet capture.
-->
So that's the ring buffer means.
-->
So as soon as so let's say for file one, as soon as it gets to 500 megabytes,
-->
it will write the next one file 02 and file 03.
-->
So 500 megabytes for each file size in total will be 10 gigabytes.
-->
Okay, so this is my I think this is one of the advantage for long term capture method
-->
because if you are going to monitoring some not always reproducible issue,
-->
for example, the network latency slowness or application slowness,
-->
you are going to digging into the file.
-->
But then sometimes that problem will only happen in different environment.
-->
So this is one of the way that you can use.
-->
Apart from after 500 megabytes, this is focused on the file size.
-->
You can also select this one or you can have multiple choice.
-->
If let's say I after say it's too much for me after let's say 10,000 decades,
-->
it will go to the file two.
-->
So after particular session or one minute, you will go to file two.
-->
So that will depends on the option to create the ring buffer.
-->
I mean the repeated file.
-->
All right.
-->
So normally I will use the file size instead of packet amount or the duration.
-->
All right.
-->
Let's say.
-->
OK.
-->
So I won't show you.
-->
I won't show you the result at this moment.
-->
We are going to proceed.
-->
All right.
-->
So later on, once I have the result, I will show you in the letter moment.
-->
Let's back to the slide share.
-->
OK.
-->
So I'm not sure whether it's helpful for you.
-->
But I think this is the extra knowledge for you guys to know.
-->
Don't feel your hub drive, especially the client side.
-->
If clients like compran, they can't use because the system crashed due to the file package that you captured.
-->
And it will be a serious problem.
-->
OK.
-->
So next, I think you guys are very familiar with the OSI model.
-->
Because this is something that we are going to analyze in a workshop.
-->
OK.
-->
For example, for example, let me stop it.
-->
Let me open the pre lab.
-->
OK.
-->
So just now, we realized that this is the scene packet that's sending by client to the server.
-->
So we can see we have the frame one, layer two internet and layer three IP, layer four TCP.
-->
So if we have the TRS, we have also this one, the layer six.
-->
OK.
-->
If we have HTTP protocol, we have the layer seven.
-->
But we are not capturing the HTTP packet in here.
-->
So these are the layers that we always analyze to.
-->
So I try to make it as simple because for me, it's very hard for me to even understand and always memorize the layers.
-->
OK.
-->
So it's very interesting words.
-->
Have you heard about this word before?
-->
We have seven layers.
-->
P, D, N, T, S, P, A.
-->
So have you heard about please do not throw sausage pizza away to memorize the order?
-->
Have you?
-->
No.
-->
OK.
-->
Because I can't even remember the capital letter.
-->
So please do not throw sausage pizza away.
-->
So this is a very interesting sentence for me to understand.
-->
And I try to use an example, a real world example, to understand what is the application, presentation and each layer means.
-->
OK.
-->
So I give you an example.
-->
So imagine you're sending a handwritten letter to a friend in one city.
-->
So in Bangkok, for example, to Singapore.
-->
And here how it works step by step.
-->
So this is it.
-->
And I try to create a column for computer network example and virtual example for me to understand well about the layers, the OSI models.
-->
So I hope it help you guys as well.
-->
So for imagine, OK, what is the application?
-->
If let's say I try to browse the example dot com in the Chrome browser, Chrome browser and each browser is a very common browser that used by the client.
-->
Right.
-->
So this is application layer.
-->
And in the real world example, this is the letter.
-->
I want to write a letter to my friend.
-->
OK, this is a letter that I'm going to use.
-->
And then workshop is on board.
-->
What is that means?
-->
So for example, I'm using the HPE protocol.
-->
I'm going to see the HPE layer.
-->
But if I'm not using the HPE protocol, like I'm not included using the HPE as I won't see this in the workshop when you click on the particular packet.
-->
OK.
-->
So what is presentation means?
-->
So if let's say I want to write in English, I want to write in Chinese, I want to write in the language as well.
-->
So this is the method that you are trying to form your letter for your friend to understand.
-->
And here in the computer, I'm trying to use HTML, JSON, XML or encoded data.
-->
So if I'm using the encoded data, that means I'm using the HTTP as encoded protocol.
-->
OK.
-->
So I'm able to see the TOS layer that I'm sharing you guys in the workshop.
-->
I am able to see this layer 6, TRS.
-->
OK.
-->
What is session means?
-->
Like the active session.
-->
Are you going to send your friends a letter weekly, monthly or yearly?
-->
So this is a session.
-->
And then what I'm understanding session actually is the one that I'm always using in the browser.
-->
OK.
-->
Let me show you one example.
-->
OK.
-->
Just now I'm using example.com.
-->
OK.
-->
Let me try to since this is not the OK.
-->
Never mind.
-->
So normally I'm using HBS.
-->
Maybe I'm using this one.
-->
Let me see.
-->
OK.
-->
So you can see I'm getting some information in the headers.
-->
If let's say I'm going to send a client request, click a button to this session.
-->
And this is the encrypted HTTPS protocol.
-->
I need to get the better token in this active session.
-->
If let's say I close it.
-->
OK.
-->
This session will gone.
-->
We're gonna.
-->
And if in the back end I'm trying to send.
-->
OK.
-->
Let's say I'm using a tool automation.
-->
I write some script.
-->
I'm using a postman tool.
-->
For example, I tried to use a postman tool to send a request from client to the server.
-->
But that session already closed.
-->
Am I able to connect to the server?
-->
No.
-->
You would definitely know.
-->
It needs to be open and have an active section like what I'm showing just now.
-->
You can get it from the F12 or right click inspect in the browser.
-->
Go to the network.
-->
You will see a lot of conversations there.
-->
It's huge.
-->
But just click on the one that you are going to trace in.
-->
So you will see at this section.
-->
So in here we are actually session is part of the TCP or TR session.
-->
You won't show in the workshop.
-->
OK.
-->
So transport layer.
-->
So I try to divide the letter into pages and number them.
-->
Number one, number two, number three.
-->
If I have three letters.
-->
So just imagine TCP.
-->
I'm going to using like TCP port.
-->
So inside the workshop you can see here.
-->
TCP.
-->
Let's say the first one.
-->
OK.
-->
I will see the port number.
-->
I will see the destination port number of my either server or client.
-->
And I will see some facts as well.
-->
And whether this is the SYN, FRAG, ANALYZE or whatever.
-->
So ANALYZE number, next sequence number, row sequence number or relative sequence number.
-->
That will be helpful for our capturing and analysis.
-->
And network.
-->
So what is your address of a friend?
-->
What is your address for your sender and recipient?
-->
So just now my IP address is 102.
-->
So this is my host address.
-->
And I'm accessing to NeverSSL.com.
-->
And this is the destination and IP address.
-->
So this is the IP address of recipient and sender.
-->
OK.
-->
And the data link.
-->
So this is the ARP and the Ethernet layer.
-->
So this is a MAC address.
-->
And the switches.
-->
OK.
-->
Let me show you.
-->
OK.
-->
Here.
-->
Here.
-->
OK.
-->
Normally, the destination MAC address would be the router or switch MAC address.
-->
So if I'm going to understand.
-->
Let me have a demo and MAC this a bit.
-->
I'm not really open to use this network comment unless I encounter some network issue.
-->
So for example, if I'm going to know what is my MAC address.
-->
Normally, I'll come to here with the wireless or Wi-Fi keyword.
-->
And this is my physical MAC address.
-->
And this is my IP address.
-->
But if I want to know what is my router address.
-->
And this is the comment that I normally use.
-->
So you will see here.
-->
All right.
-->
Because this is not captured from my local.
-->
So you are not able to see the MAC address exactly match with my comment line.
-->
But just for information, this is the MAC address for your endpoint.
-->
That capturing wire shop packet and the router or switch MAC address.
-->
OK.
-->
So that means the POP office address sorting backwards.
-->
For example, you are sending to Singapore or you are going to send to your bank code.
-->
So you will know the postcode.
-->
So physical.
-->
Which server transfer are you going to use?
-->
It's whether by truck, plant or extra extra.
-->
So in the computer network example.
-->
Are you going to send over the cables or Wi-Fi?
-->
So here.
-->
Actually, I'm not really like looking into the first layer in here.
-->
I'm not really like for kind of use.
-->
But then from here I will I will try to understand.
-->
For example, the capture length.
-->
And what is the.
-->
For example, this one.
-->
So capture length is 74 bytes.
-->
And this is the number one packet.
-->
And time.
-->
Another thing that I'm usually looking into is the delta time.
-->
From the first previous capture frame or the first previous display frame.
-->
And what's the arrival time as well.
-->
So this is something that I'm looking into the first layer.
-->
But sometimes and mostly I won't use frame one for my analysis.
-->
I will go in directly into the TCP or IP layer.
-->
All right.
-->
So that's basic information on the OSI layer.
-->
Any questions or any interesting experience that you are going to share?
-->
If no, then we are going to the next slide.
-->
All right.
-->
So I think this one you are more familiar with me.
-->
Where to capture on the network.
-->
Before I jump into the next slide.
-->
Maybe.
-->
OK.
-->
OK.
-->
Maybe I share you guys with this.
-->
What is the definition of where to capture?
-->
Maybe you can tell me where to capture.
-->
It's in the endpoint or it's in the network or using workshop.
-->
But here what I mean is where to capture on the network.
-->
OK.
-->
Before I explain my understanding and my knowledge.
-->
I hope.
-->
Yeah.
-->
Maybe Ham or Tanen.
-->
You can share.
-->
Based on experience.
-->
Normally where you put the workshop.
-->
Where you install the workshop endpoint.
-->
OK.
-->
Here the current site.
-->
So let's say imagine.
-->
Hey Ham.
-->
Current A got a problem.
-->
It cannot load the page.
-->
It keeps loading.
-->
So after click a button.
-->
So where how to capture the packet.
-->
So you will normally install the PowerPoint in the client side machine.
-->
Is that what you mean?
-->
OK.
-->
Good.
-->
How about Tanen?
-->
OK.
-->
Are you in the same team?
-->
Are you the same team members?
-->
Oh no.
-->
But most of the ways that you are capturing the packet is more or less the same.
-->
OK.
-->
All right.
-->
No worries.
-->
Back to the site.
-->
OK.
-->
This is just a very simple diagram of a network.
-->
I'm going to show you like what is the.
-->
Common way or better way of the best way to capturing a sorry to install the workshop and capturing the traffic in the network.
-->
So just I mentioned normally you will you will install the endpoint and workshop in your client site endpoint the machine right.
-->
So this is the I think this is the easiest way.
-->
Normally I would use as well.
-->
You will use you will install the workshop physically on that device and you keep capture and you stop it.
-->
And you are able to collect the packet the p cap file is very quick.
-->
Even though it's dirty but it's free and easy.
-->
Right.
-->
So however there are some downsides to Louis to doing this.
-->
Have you think about this.
-->
This.
-->
What are the downside if you install the workshop in our endpoint you know what is the limitation or the bad things.
-->
If you install the workshop in the endpoint site.
-->
OK.
-->
All right.
-->
Never mind.
-->
OK.
-->
For example what I experienced with my clients that previously I know some of my clients are from a huge enterprise.
-->
Maybe for example for example Panasonic.
-->
They have the like more than a few for example 30 companies in close countries.
-->
If they are in point they are using a very very old OS platform which are not which are already obsolete that are not maintaining at all.
-->
For example Windows 7 XP Windows 8 whatever.
-->
Or they are using very less RAM memory for example less than 80.
-->
Just forget.
-->
Crazy.
-->
So in that very bad environment they will always encounter some network latency issue.
-->
Right.
-->
Because less resource.
-->
So if I still install the workshop to capture the packet in the environment it will load adding the load to the client that's already loaded down.
-->
So this is one of possibility.
-->
So this is something that we want to consider.
-->
But I think when I'm consulting and helping people to fix their problems this is one of the common option that I might use because at least out the gate and until we get a better idea on how the application is running.
-->
So normally I will still install the endpoint in the client side.
-->
But what would be the more ideas to actually capture a packet from the network somewhere is from here.
-->
So this is the second one of the best way to do that is congregate a span port of a switch or router.
-->
For example when I install the workshop.
-->
What is span means?
-->
Span means for the switch port analyzer.
-->
It's a feature on many network switches that allow you to monitor network traffic just on that particular traffic path.
-->
So you won't see anything unless you are part of the conversation.
-->
It's a specific device and in the particular network path.
-->
So with a span port you can tell the switch, hey, I'm able to copy all the traffic from this port to all multiple ports with this end point and then send over and copy all the traffic conversation into here.
-->
So I'm able to see all the copied traffic from the selected ports that's super helpful for troubleshooting or even the security monitoring.
-->
And what is the downside?
-->
Actually this, even though this is a better way, but span switch will also be loaded with other traffic.
-->
So this is something that we need to take into consideration.
-->
So this is so-called, we always call it over-provisioning because we are given more to the span port that span port is able to handle.
-->
So what are the consequences?
-->
It might make the span port to get too busy and keep up with the total traffic stream.
-->
So it will cause some of the packets might get lost and maybe will cause some of the packets need to be retransmitted.
-->
So this is more problem will be capturing.
-->
So another best way is to buy a tap, but this is the best way, but it is not free of charge.
-->
It's the most expensive option because the taps are free.
-->
It's a physical device to install in here to break the connection somewhere along the way that allows you to just
-->
like into the feed that send it over to a laptop or server that's running the wire shock.
-->
So I won't say which method is the best or worst because it depends on the requirement.
-->
I can even install a tap in the virtual tap in the cloud or server, or I can install the wire shock in the server.
-->
Let's say here from this example, I have three servers, one, two, three.
-->
If I'm going to install wire shock in each server, that means I have three wire shock in different servers
-->
and I can always like capturing all the clients, like a few thousand clients, traffic to this client and this server A
-->
and what is the downside? It will cause the server A overloaded as well.
-->
So honestly, tap is the best solution, but it's charged.
-->
So span port is the second option, but it's also overloaded span, so it depends on the configuration.
-->
And one is the quick and easiest way is to install into endpoint.
-->
If your endpoint machine is not like using the obsolete or not maintaining OS platform,
-->
the resource, the hardware spec is still quite good enough.
-->
So that's something you have to consider.
-->
OK, all right, so let's go to the next.
-->
I won't, OK, I won't go into deep in the network traffic,
-->
but just give you some information on normally where the wire shock installed in.
-->
All right, first package, we already captured the first packet, right?
-->
And what is the best practice? What is the best practice or guidelines that normally you use?
-->
OK, before I review the next slide, maybe show me some idea, some idea.
-->
What is your guideline on capturing a packet?
-->
Or what is your best practice like, hey, please be highlighted and be noted.
-->
Normally when capturing a packet, you have to do this, you have to be aware of this,
-->
and different notes you have to be aware of.
-->
So share with me what is your guidelines that you are normally following with.
-->
Any best practice you're going to.
-->
OK, how about turning maybe you have some.
-->
OK, so normally the client side are actually not the I mean, not having a heavy traffic, right?
-->
Just a small packet.
-->
Normally how many packets that you are normally analyzing in a PCAP entry file.
-->
Maybe let me know the packet size.
-->
Then I have I will have an idea about 100 or more than about 100.
-->
OK, so it's not that huge, but not that complicated environment.
-->
OK, so let me go into the next slide and you will know.
-->
OK, let me back into the slide.
-->
OK, here.
-->
I'm using the word capture filter at start, but I don't I'm not going to explain what is a capture filter in deeper right now.
-->
Maybe just a very high level explanation for this capture filter is one of the filtering before you capture your traffic.
-->
And we can try to narrow down and specify which port, what IP range or what is a protocol you are going to capture.
-->
So it will limit the packet size for your PCAP entry file.
-->
So why I said don't use a capture filter at start.
-->
Do you know why I'm not recommended this?
-->
Any any ideas why I'm not recommended to use capture filter at the first beginning?
-->
OK, how about Dunin?
-->
What is the understanding about capture filter?
-->
Why I don't recommend to use it in the first start?
-->
OK, all right.
-->
OK, let me explain it to you.
-->
OK, let me cross it here.
-->
So let me start capturing.
-->
OK, so when I start capturing, you can see the packet size is keep increasing.
-->
Now, 10 seconds, 11, 12.
-->
So you're already up to 6000.
-->
So let me stop it.
-->
OK, so let's say.
-->
I'm opening capture filter.
-->
So this is the default filtering.
-->
I'm not modifying yet.
-->
You can see it will capture best on the filtering rules here.
-->
OK, so I'm not limited with 443 or I'm not limited at port 0 only.
-->
I'm capturing with all the traffic by default.
-->
So I can see UDP.
-->
I can see TRS and I can see what?
-->
Let me see.
-->
No, maybe I'm not triggering something.
-->
OK, so I have different protocol.
-->
OK, so I can.
-->
Let me see.
-->
So let's say, OK, let's say from here, I'm capturing 6,680 packets.
-->
And then I'm filtering TCP.fragstats and knowledge equal to 2 or 1.
-->
OK, let's say 1.
-->
So my display packet is reduced 3000.
-->
So I only have 3046.
-->
It's not more than 50%.
-->
So I'm only able to see 3000 means it reduces the size of the packets.
-->
So it's easier and quick for me to analyze.
-->
But this is the display filter.
-->
This is not the capture filter.
-->
So if I remove it, I can see 6,680 packets are displaying here.
-->
It's a whole lot of packets, right?
-->
So I want to limit the size.
-->
I put in some capture filters in here.
-->
But let's say if I put the wrong filtering, if I put the wrong one,
-->
I specify it to somewhere.
-->
And then I'm not able to see UDP.
-->
I'm not able to see TRS or even the HTTP.
-->
For example, let's say I might miss out some important packets.
-->
I might not able to.
-->
OK, for example, I just want to look for a certain IP address,
-->
certain port number or certain application.
-->
And I'm taking a guess as to what we think the problem is.
-->
I guess, oh, maybe 20 seconds is the one in the pre-lab slow network PCAP file.
-->
It takes 20 seconds because the packet size is too huge.
-->
And it's split into two packets.
-->
And the client takes 20 seconds to respond to the server.
-->
So I guess, OK, if the network connection is not stable, there's a latency issue.
-->
So I try to narrow down the capture filter to what I assume.
-->
OK, for example, I'm having a problem with web pass application.
-->
OK, just show me only HTTP.
-->
But what if I'm using HTTPS?
-->
OK, that's the way.
-->
OK, let's say, OK.
-->
So for example, I am OK.
-->
I'm using HTTP never SSL.com as a sink here.
-->
OK, let me stop it.
-->
And OK, capture again.
-->
Stop it.
-->
I'm still seeing the protocol with TRS.
-->
I'm able to see HTTP or not? No.
-->
So this is something that is not matched with what we expect.
-->
So we will miss out a lot of packets that are important.
-->
If the traffic being dropped by the network, let's say, because the packet size is too huge.
-->
And the client getting ICMP message back from the switches and routers telling me of a problem of the network.
-->
Well, but I'm able to capture the packet only for HTTP.
-->
So am I able to see those packets in the capture file? No.
-->
Right. So because I already made an assumption on what I thought on the application was.
-->
But in fact, it was a different port or it was a different conversation.
-->
Use different protocols in both different protocols like ICMP, HTTP, TRS, whatever.
-->
So on and so forth.
-->
So as a best practice, I don't want to use a packet captures or capture filters at the very beginning of our dress.
-->
Unless you are very, very confident on what are the port application IP that you are going to capture.
-->
OK. For example, in the server side, I only want to capture the packets from this machine.
-->
I mean, my machine with the IP address one zero two.
-->
So I can I can just put a filter that fix the limit, the packets from the IP address.
-->
But if not, please don't do it.
-->
OK. OK, so second one capture on client end.
-->
OK. Why when we begin capture, we want to start by capturing on the client side.
-->
That's why I said that a lot of downside, right?
-->
If your client and points is already overloaded, you will the wire shock capturing traffic will add the load to the client.
-->
But then why now I'm saying, OK, we begin capture on the client side.
-->
OK. Maybe you can guess why I'm.
-->
I'm saying this. Any ideas trying to no brainstorm.
-->
OK. Let me OK.
-->
Go ahead. Yeah. Yeah. Yeah.
-->
OK. Yeah. You get the right answer.
-->
So I give one example. OK, let's say let me think.
-->
OK. So one of the reason why we want to start this start on the client side is because, look,
-->
these things can get very large packet captures can get huge.
-->
Right. So we want to have things be as simple as possible.
-->
So if you are beginning to troubleshoot an issue, you can just go ahead, go to the client, particular client that you know.
-->
Who is encountered a problem, which end point are having that issue and have them shut down everything.
-->
For example, you can try to their own issue by cross out the mail, cross out the browsers, cross out that streaming audio or that podcast that they are listening to.
-->
Or you want to add more static or more background noise to important packets that you are going to looking for.
-->
OK. So look, this is already hard enough because you want to make it less hard on yourself.
-->
Right. So we can start on the client side.
-->
So once you start on the client side, you can get a good picture of what system does the client communicate with.
-->
So, for example, OK, let's just talk to DNS space or does it go and talk to an authentication server?
-->
For example, just now I show you the network tab. We do have the active section.
-->
If that is using HBS protocol, it will have authentication token.
-->
Is the client using a valid token to communicate with the server?
-->
Or does it go to the cloud or does it go to our local data center?
-->
So we are able to determine that by starting out looking at the client to see what the system actually communicate with.
-->
So that's why I strongly recommend to use a ring buffer for long term capture.
-->
So this is one of the best practice.
-->
OK. Do you still remember what is the ring buffer is?
-->
OK. Maybe share with me on what you understand about ring buffer.
-->
A ring buffer actually just imagine is a repeated storing mechanism applying to the rules here that you configure with.
-->
And you will override the file started with the number one numbering.
-->
Yeah, up to no. This process that I already fixed.
-->
So you won't fill up the system drive.
-->
You won't make your client platform crash.
-->
OK. It won't make the file size become huge until it's very hard for you to troubleshoot on.
-->
OK. Get it.
-->
All right. So come back to here.
-->
So OK.
-->
So I highlighted for long term capture.
-->
But if this is a quick capture, don't need to use ring buffer is fine.
-->
But if the long term capture for monitoring in specific problem that is not always reproducible,
-->
very tricky problem that only happen in specific environment or network or resource.
-->
So just use ring buffer.
-->
OK. Because of you don't have a clear picture on exactly when the problem occurs and what time.
-->
Yeah. And then we are not able to reproduce on our environment or our team members environment.
-->
So make use of the long term capture that I show you just now that is ring buffer to collect traffic over time.
-->
So doing so, you can collect smaller files instead of one huge file that we have to dig through later.
-->
OK. All right. Next.
-->
Make sure the problem happens while capturing.
-->
OK. What is that means? Maybe any one of you can try.
-->
Make sure when you're capturing the problem is happening. Is it possible in the real case?
-->
OK. OK. So I think this practice.
-->
OK. For example, I give you one real case, one use case, one use case.
-->
The client sent me 10 log files, 10 picket files.
-->
OK, 10. So for me, while we stand, I need to know open up all the files and analyze one by one.
-->
But do you believe that all the files having the specific problems?
-->
Don't write. I won't. I don't think so.
-->
It might happen in specific packet file. Right.
-->
So OK. And then the remember the methodologies.
-->
I will try to reproduce on my end.
-->
So I found some clues. I will try to reproduce.
-->
So that is the practice that tell me make sure the problem happens while capturing.
-->
I will start to capture while I'm reporting reproduced that particular reproduced steps that provided by my client.
-->
For example, when I click login button, it felt OK.
-->
When I click, then before I click, I try to capture.
-->
After I click, OK, maybe wait for a few seconds. I try to stop.
-->
So that is the idea on make sure the problem happens while capturing.
-->
OK, so this is something wrong with those big gaps.
-->
If you're capturing from beginning when you open the browser and type in the URL and then until you log out.
-->
So actually that particular problem only occur in a particular step.
-->
So all the problem never actually occur when we are watching because you never hit the login button.
-->
Maybe you just access to the browser website and then go to check your amount and doing some other transaction.
-->
But actually you are not performing that step with the problem.
-->
So make sure that you already confidently capture the problem, not just in the time, but in the place where you are physically capturing from.
-->
OK, so in last, the tab that I mentioned is expensive.
-->
It's not free of charge, but it's something that if your environment is too complicated,
-->
maybe it's a good idea to recommend to your company to invest in the network tab.
-->
Maybe it's not super expensive, but any protocol analyst is going to want to have one of these in their backpack.
-->
Even just 100 megabit per second or gigabyte copper on one tab.
-->
But that's something we can ever find on Amazon if we have to.
-->
So maybe in the next level or maybe in future,
-->
you have more complicated environment or more problems that encounter in the client side.
-->
Maybe that's another thing that you are going to considering.
-->
All right, I think let me double check.
-->
OK, so before we end the lesson 1, I'm going to share a link to you.
-->
Let me open next slide.
-->
OK, I have prepared a quiz that helps you to recall some of the lessons.
-->
We only have lesson 1 and basic network chart,
-->
but I think it helps you to recall some of the memories and basic knowledge that we learned just now.
-->
I'm trying to use different quiz macros, but then I found that Google for me is the best one to use.
-->
So just a few quiz questions.
-->
When you try to answer it, there are multiple options.
-->
You can select our answer and click next.
-->
Think about it properly, don't make it very fast.
-->
Just read one by one, select the option, click next.
-->
And then until the end, when you completed and submit, you can view your score.
-->
You can view your score and you can view the correct answer with the explanation.
-->
Just for your fun.
-->
OK, I'm going to share the link to you in the chat.
-->
Copy link.
-->
OK, I send the link in the chat.
-->
Can you try to open it in your desktop?
-->
I want to ensure that you are able to access it and see the question, but please don't start.
-->
I will connect the link in the desktop.
-->
Let me refresh.
-->
OK, I'm opening in my machine as well.
-->
Don't know it's a bit like it.
-->
Yes, I'm sharing the link.
-->
OK, OK, all right.
-->
OK, so as per Alex, so you can use our laptop for the quiz.
-->
It's just a Google phone.
-->
OK, so OK, don't don't don't look on the question first, please.
-->
So let me minimize it.
-->
So I think now is eleven fifty.
-->
So we take ten minutes for the quiz answering and then we come back.
-->
So we are going to have a lunch break after the quiz.
-->
Is that OK?
-->
So maybe we can discuss after the lunch.
-->
So I'm not sure.
-->
Alex, normally how long for the lunch break time?
-->
Is it flexible for us to decide?
-->
OK, OK, so I think we can after the quiz, we can go directly for your lunch.
-->
All right, so we will meet up at one p.m.
-->
All right, OK.
-->
All right.
-->
See you later after lunch.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Oh, I'm so sorry.
-->
Oh, I'm so sorry.
-->
Oh.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
Thank you.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.
-->
.