Wireshark Query

[TheDevopsGuy]

Hi,

Currently I'm trying to analyse traffic which is originating between two clients using WhatsApp. I would like to determine the originating message from the Client Sender side and capture the traffic from the Client Recipient side.

I installed bluestacks on two virtual machines set them up on different Networks.One is bridged and the other machine is on a separate vmnet.

My query is I can see the data captured and where the data is going and coming from but in my scenario I need to specifically compare two packet payloads. How can I compare two payloads/message contents when
1. Data is encrypted so I need to possibly compare Hash values or hex content.
2. Packets are fragmented so how can I compare 1:1 packet from both sides.
3. I've tried searching for WhatsApp Dissectors for Wireshark but most are outdated.

any pointers would be appreciated

Thanks

 

[Gabriel Pike]

I have always run my pcap files through something like Network Miner to give it a physical diagram to what is happening in the pcap. Not sure if it will help with this or not. Good luck.