Now that we've understand the basics of making sure that our network
adaptors are set up for passive monitoring, let's take a look inside of our lab
up here and how we
would do this using the ADEP labs. You can see that I already have Kali opened
and I also have the other
cert workstations on here running such as Ubuntu. And one of the easiest ways
to be able to do this
is to identify which interface that we're going to be using, put it in promise
mode and record from
there. So we're going to open up a terminal real quick and just simply do an IF
config.
Now we have two interfaces running here and remember, ETH zero is going to be
the one in
promise. In order to do this, we're simply going to type a pseudo IF config -a
ETH zero promise.
And after we input our password, we should be able to go through and see that
ETH zero is in fact
in promise. Now there's a couple of different ways to do this. The first one is
is if we want a
graphical representation of what's going on, we can open up wire shark and make
sure that we
identify that we're only reporting traffic on the actual ETH zero. Easiest way
to do that is by
the top left on the gear as that's loading up. We can go into capture options,
select our ETH zero,
make sure it's still set in promise mode with the checkbox and you'll start to
see a little bit of
capturing on the actual wire shark itself. Now I'm going to bump this a little
bit and I'm going to
open up my own Ubuntu here for a second, log in with password, move this over a
little bit and I'm
going to right click and go to open terminal. Now I have the wire shark on the
left. You can see
not really much is going on and I'm going to ping Google and you can see that I
'm really starting
to pick up on some of the actual traffic that wire shark is starting to pick up
. This is because we
have wire shark as our actual passive network monitor according to our layout
in receiving the
source and destination traffic inside of Hyper-V and we would apply this to an
actual network
setting like we did in the packet tracer demo or we would just put on a network
tap or some sort of
session monitor configuration inside of a layer two device for let's say an
interface or an actual
VLAN. A lot of this stuff is covered inside of the wonderful CCNA courses here
on CVT nuggets.
But what you see right here is this we're really capturing a lot of data inside
of wire shark
but wire shark has a thing on it called a GUI and it causes a lot of overlay
and there have been
instances where wire shark has missed a packet or two because too much
processing on the part
of the actual monitor itself so the galley box and due to processing and other
forms of resource
intensive things. So we're going to go inside of our wire shark and hit on stop
and go ahead and
close it and we're going to quit without saving and inside of our terminal we
're going to do a
very simplistic TCP dump here. Now when we run TCP dump one thing to keep in
mind is that we need
we're going to manually configure this ourselves and we're going to say pseudo
TCP dump dash i the
actual interface if zero. Now at this point I do want to point out that in wire
shark we can set
things to pro-mask inside the GUI but inside of the actual TCP dump command
there's no option
to do that so we'd have to make sure that we ran the IF config to set that
interface identified
as pro-mask to capture everything that we need or want. Now at this point we
want to add a dash
W for an output. Now I'm on the desktop terminal so whatever file that creates
here is because I'm
just going to type in a file name it's going to save to where the terminal is
being ran at.
So I'm just going to say test.PCAP and it's running already and I still have
the Ubuntu system
running a ping and I can go ahead and double click the test.PCAP and I can say
reload and you'll see
that it is loading up with stuff. Now I opened it up like this on purpose
because it's in a regular
text editor and we're not going to be able to identify everything in that we
would need a program
like wire shark for instance to be able to read it. In order to stop our test.
PCAP from collecting
inside of the terminal for TCP dump I would just hit ctrl C and now I would
double click on test.PCAP
and see here that I have a lot of packets mostly ICMP because I'm running that
ping command
inside of Ubuntu and you could see where the source and destination is let me
pop out and zoom in
for us real quick. The source is 0.52 and the destination is one of many Google
IP addresses
and this is really good information to know not only in terms of being able to
capture this traffic
but to also be able to analyze it. Now this is a lot to go through so instead
of doing it manually
we have ways of being able to analyze this through programs like surakata and
in the next portion of
the skill we're going to dive into surakata ever so slightly to be able to get
a hands-on feel for
it and understand how it works but I wanted to cover the basis of being able to
capture using
network monitoring and also the hyper-v capabilities itself too because this is
passively scanning
and being able to pick up as much data as possible and therefore we aren't
touching the system and
are as quiet as possible. This is that glass on the door to listen to what's
going on inside of
the room itself. Now I have the commands for this below as far as the TCP dump
is concerned
But in the next portion of the skill, I may have a PCAP for you ready to go.