On Linux, you will find different useful utilities that allow you to analyze networking, including
tcpdump and nmap, which are amazing to analyze network traffic as well as open ports.
So let's talk about tcpdump.
tcpdump is dumping network traffic.
And here on the slide, you can see a couple of examples.
Let me demonstrate.
So if you just use tcpdump, then it's going to listen on all network interfaces.
And as you can see, it's quite busy.
And it's showing what it's what is coming on and what type of traffic was detected.
Like here, an ARP request, ARP requests are playing a role very fundamentally at tcp IP
communication.
Look at that.
This is a Canon scanner, apparently scanner and printer, we can even see the model name
of it.
Here we can see some DNS traffic.
So it's requesting for a pointer and no such domain.
And that can be quite useful.
Now if you want to do tcpdump efficiently, you might want to add the name of the interface.
So tcpdump minus I ENS 160 is only going to dump what was found on interface ENS 160.
That can be convenient, particularly if you have multiple network interfaces.
Add the option minus A to show packets in ASCII format makes it a little bit more readable.
Well, that is assuming that the packet is in a readable format.
You can also use tcpdump minus W, let's call it dump dot, well, tmpdump dot pcap.
And that is creating a packet capture file.
And this packet capture file is convenient, because it allows you to later analyze what
is going on.
That's probably a little bit nicer if I am going to generate some traffic.
So ping to nu dot nl.
And what else?
Well, that should be enough.
Just a ping request from a network perspective should be interesting.
Now if you are interested in what is going on on a specific port, you can also add more
filtering.
So tcpdump port 22 for SSH traffic only.
So here we go.
I'm opening a new window, and I'm going to use SSH to 192.168.29.142.
And oh, look at that.
SSH traffic is dumped right here.
And if you want to filter a little bit more, you can add a source.
Because in many occasions, the result of utilities like tcpdump tends to be overwhelming.
Okay, I have used tcpdump to dump some packets.
Now I am going to check if we have Wireshark.
So dnf search Wireshark, yeah, we do.
So I'm going to use dnf install on Wireshark.
And that is good enough.
I don't need the CLI.
CLI is command line, and the nice thing about Wireshark is that it is a graphical utility.
It allows you to perfectly visualize what is going on.
Now in order to do this, I need chmod 644 on tmpdumppcap.
That's a packet capture file.
Because these are files that you can analyze in an amazing way using Wireshark.
So here is Wireshark.
And in Wireshark, you can do a live packet capture.
So in the live packet capture, you can filter what exactly you want to do.
And then you start capturing packets.
So you can identify what you want to do.
I don't want to do a Cisco remote packet capture.
I want to show you what is in this file that we created.
So I need to navigate to the tmp directory.
And in the tmp directory, there is the dump.pcap.
pcap is the standard format for a packet capture.
And here you can see what it looks like.
Now this is a little bit boring.
But we have the information about the ping request.
So it starts with the DNS request.
And in the DNS request, open it.
And you can analyze exactly what is going on in your packet information.
And that's a quick introduction to tcpdump as well as Wireshark.
These are really very amazing utilities.
Let's get back to the slides because I want to tell you about something else.
It's called nmap.
So nmap is a very powerful utility.
Some consider it a hacking utility.
And for that reason, you should never ever use nmap without authorization by the target host owner.
If you do, you risk getting blocked from the network where you are using it.
Now the nice thing about nmap is that you can use it for analyzing networks and ports.
It will show you ports that are open on remote hosts.
And it will do that in different ways, allowing you to get beyond the firewall.
Because how are you going to sniff for ports on a host that has a firewall running?
Well, nmap can help you with that.
I'm going to show you a couple of examples about this fantastic utility.
To start with, I need to install it.
So dnfinstall-y nmap.
And then I'm going to use it on, let me use IP addresses.
Be very, very careful using nmap on the internet, or better, don't do it at all.
So I'm going to use it on 192.168.29.142.
I know that that's an IP address that is open on my system.
And now there we can see that this is only using SSH.
You see that port SSH?
It has detected that it's a VMware brand network card.
Now, if I use minus O, minus O is for operating system detection.
And that should tell me which operating system it has found.
And as you can see, it has found Linux kernel 4.x, 5.x.
So this is the kernel range that it has detected.
Based on the specifics in the protocol headers that nmap encounters,
it can tell you pretty precisely what it has found.
What I also like is nmap minus SN.
That's for scan network.
And I'm going to scan it on my local network.
It's an easy way to figure out if there are any IP addresses available that I wasn't aware of.
So as you can see, it all starts with the IP address.
And there we can see some more information.
So we have this 146, for instance, or 124.
I have no idea what 124 is.
So I'm going to use nmap minus SA on 192.168.29.124.
The minus SA is checking if a firewall is available.
Maybe I should do it on 142 because the result is a little bit disappointing.
And we don't see anything cool right here.
Okay, let's do an nmap minus SV.
Because if you have services that are running,
you might be interested in finding the version of the service.
So here we can see the version of the service.
Why is that interesting?
Well, some versions have vulnerabilities.
And this allows you to figure it out.
Now, nmap minus P 80,443,22 on a specific host.
And I'm including 22 because I know for sure that that one is listening.
It's just scanning on these specific ports.
I made a typo, by the way, in port 442.
That doesn't really matter.
What matters is that it allows you to scan on specific ports.
Now, if ever you encounter a machine and you think,
hey, some heavy firewalling is going on, you might be in for a stealth scan.
So the stealth scan is going to listen to your servers
and is trying to detect what exactly is going on.
And oh boy, even with the stealth scan,
it's done pretty fast on this 192.168.29.2,
which is my router,
which apparently has no further ports that are active.
Be prepared for a long wait, in some cases,
where you are using a stealth scan.