Hey, everyone, welcome back to the
course. So in the last video, we
went over Wireshark, so again, we
just captured some more packet's in
this video. We're going to go over
TCBY dump, as well as Wireshark
to work on setting some filters and
built those tools.
So part one is going to be TCAP dump
and then we'll move into Wireshark a
little later on.
So you should already be allowed to
do the cyber environment.
Go ahead and search for applying
filters. So in the search box here,
just type in applying filters
and you'll see it'll pull the lab.
We actually want to use this,
applying filters to TCP Dump
and Wireshark.
So once you find that it's go to
click on that and then select a
launch button again.
All these Step-By-Step guides are in
the supplemental resources section.
So make sure you download that so
you can follow along once you click
that launch button. It's going to
give you this option, a launch item.
So basically it's going to open it
in a separate tab.
So you click on that and you should
open it up for you.
And it shouldn't take too long to
get the lab environment going here.
You'll see it booted right up for
me. Sometimes it takes 10 to 15
seconds or so. So just keep that in
mind. And also you
may see a paper box here.
Just click next to it, OK, to close
a paper box and you should then be
at the screen I'm at right now.
There's some other pop ups here that
you'll notice in the corners, you
can just out of those or you're
welcome to read them as well, but
I'm just going to X out of them for
our purposes.
All right. So let's go back to our
lab guide here.
So if went ahead and logged into
our environment, we're at the Ubuntu
Linux desktop now.
Now we're going to go ahead and
launch a terminal window.
So the way we do that, we just click
on the left side here.
We click on this little black box
that's going to be our terminal
window.
Now, sometimes it's a little finicky
and it doesn't open right away, as
you'll see here.
And you have to click it around a
little bit and eventually it will
open a terminal window for you.
I'm not sure why it is that, but
hopefully they'll get that resolved
quickly.
But in the interim, just kind of
keep clicking on it until it opens a
terminal window for you.
All right. So at the terminal
window, we're going to go ahead and
change the directory that we're
in. We're going to go ahead and
change it to the desktop and then
specifically the captures folder.
And then from there, we'll be able
to run the commands that we want to
use throughout the lab.
So let's go ahead. Do the now we're
going to type in KDDI space
for Egholm, forward slash
student forward slash desktop with
a capital D force
excuse me, forward slash captures.
So let's go ahead and type all that
in now.
So what do we do.
It step by step.
So could all lower case.
We'll put a space, we'll put a
forward lowercase home.
Forward, lower case
student
forward slash desktop with
a capital D, so capital D.
Lowercase E desktop
and then a photographer captures and
then we're just going to press enter
on our keyboard once we've done
that.
All right. So now we're redirected
into this directory here.
So now we're going to go ahead and
run our command. So TCP
dump is going to be our command if
we go back to our lab document here.
TCB dump.
Space Deshler, case in space,
Deshler case X, X,
space telescope space,
Dasch, outer space,
and then in quotation marks because
we don't want to read
this as end of strings.
This white space is here.
So we put it in quotation marks or
just reads this as a actual file
and then from there we're going to
pipe it to less.
So let's go ahead and do that now.
Now, I'm not going to actually
explain what these
different flags mean
because of the of resources.
We have a document that does all
that for you. So go ahead and
download that, make sure it's about
40 or 40 or so pages
worth of stuff. So just take a look
at that and then I'll walk you
through exactly exactly what
we're doing in this particular lab.
So let's go and type all that in so
we've got TCBY done.
We'll put a space,
we'll put a dash lowercase nd
we'll put a space, a dash lowercase
X X, we'll
put a space than tcp our
we'll put another space Deshler case
are we'll put a space in
now. No again we need to put in our
file name there. So quotation mark
lab space
two point two point three
dash. Three dot
popcap.
So Labbe two point two
point three Dash three PopCap
We'll end it with a quotation mark
for the space We're going to pipe
it. If you're not familiar with a
pipe command in most keyboards
it's usually right above the enter
key. So this whole downshift shift
in procedure key
looks like just a big stick.
All right, so we're in a pipe it to
space, then less
and then want to go ahead and run
that command. They're just pressing
enter there. You'll see it's going
to show us some different
IP address and packet information.
So just taking a quick glance at it
at the output there.
Question number one here, what port
numbers do you see in the output?
And then also what IP addresses do
you have listed there?
So you can go ahead and list?
Those are if you want to.
We see here that we've got this IP
address, 192 DOT one six
eight zero two.
And then we see it's running on Port
21.
We also see we've got one of 192
down one six eight eight zero twenty
five. And it's running on port one
thousand one hundred and ten.
So we see if we look around
there, we've got similar results for
most of these.
We also see that we have 25
and then we are 21, just basically
swapped around here.
Let's go back to a lab document.
So now what we're doing, we're just
going to basically back out of this.
So we're just going to use a letter
Q on our keyboard here that's going
to back us out of this particular
area here and take us back to the
command prompt.
So let's do that now.
So just click back over there
with the Cuban and you'll see it
takes us back to our prompt.
Let's go back to our lab, we know
now we're going to go ahead and type
in this command here, now,
the main change here is what is
going to be basically be sorting by.
And so we can only or filtering
excuse me, by just the HDP
or the or Port 80, as it's more
commonly known
as those. Go ahead. Do announce
we're going to type in this long
command here.
The other option we can just do is
press up on her keyboard here.
You notice that gives us everything
from the previous command.
And so if we just use our left arrow
on our keyboard, we can come all the
way over here.
And right in front of this dash
are so just right here in the space
between TCP space dash are
we're just going to put another
space and the actually going to type
in port space A-T.
So you'll notice that we're running
the basically the exact same command
here. We're just adding in port and
now you can go through and you could
type out, you know, Tsipi
Space Station or case in
space, dash, you know, lowercase, X,
X, et cetera, et cetera, all the way
through. But to save time, just
pressing up and your keyboard
pressie left arrow key
to get all the way back over between
the TCP and the dash lowercase
R and then just put a space
in there and then put port a esport
space A-T.
You're good to go.
Now, all we have to do is go ahead
and hit enter a keyboard to run that
command.
So let's take a look at our lab
document because we have a couple of
questions now. So questions
three or four, what
port numbers do you see in the upper
now and then? Also, what Web server
IP address do you see?
So what port numbers do we see now?
Well, we of course, at least on my
end, I see Port 80 now
is in there. So that's to be
expected if we're looking for
before for searching for traffic
with Port 80 in it.
All right, so what's the server IP
address in this situation?
So we've actually I've kind of give
it away on the screen here.
Ah, so you guessed right here we
were where we've got Port 80
highlighted, you are correct.
So it's going to be a 172 one six,
not 20, not 24 now
jotted down someplace or, you know,
thrown in the document.
It's definitely something you want
to know in just a moment.
Ah, so the next thing we're do,
we're going to quit again on this
here, by the way, you should never
quit in life itself, but just quit
on this thing here and there.
We're just going to run one last
command.
I should just come back to your
terminal window there, click the
button there to cancel that out, and
then we're just going to run this
long command right here.
So we're basically just going to be
looking for this specific
Web server IP address.
We're just looking at the packet
capture file for this particular
Web server IP address.
So a couple of ways we could do
this, we can hit the up arrow again
and then just add in the differences
here, I'm going to be ambitious
here and we're just going to type
everything in on this particular one
step by step.
So we're going to type in TCP dump,
and again, you could hit the up
arrow if you want to just add in the
different differentiating things,
the TCP dump space
that's lowercase M space
dash lowercase X X
space host.
Then we want to specify our IP
address. So again, space 172
that one six twenty to twenty
four, we're going to put a space,
we're going to say and this
is the end
space TCP
Spaceport 80
space.
And then dash lowercase R
will put another space and there
were a half our file into quotation
marks, Labbe
two point two point three
Dash three PopCap.
Quotation mark, we end up with
space, we're going to pipe it again,
that's right above the knee and your
keyboard, and then we'll type in
less and we'll press enter into a
keyboard and let that run.
All right, so a question here is, do
you only see inbound traffic,
you only see inbound traffic?
So question number five here.
Do we see only inbound traffic in
our results?
All right, so the answer, at least
on my end here and here should be
the same is a no right.
It's one we see in
internal and external traffic.
So we see inbound and egress
traffic are so
in this lab. We went ahead and just
went through TCP dump.
In the next video, we're going to
jump into Wireshark.