Hey, everyone, welcome back to the
course. So in the last lab, we went
ahead and applied some filters and
Wireshark and TCP up
in this video, we're going to go
ahead and cover TCP.
We're going to run a few commands
in. And now this lab is going to be
a little shorter.
We're just going to run a couple of
commands in TCP dump, but just want
to show you how to navigate to the
lab and kind of walk through it step
by step together.
As I mentioned before and many times
throughout this course, be sure to
download the supplemental resources
section that's going to have a lot
of information about Wireshark and
TCP dump, including filters
and commands
are. So for this lab to be using
their cyber lab environment like
I've been doing throughout the
entire course.
Now, again, if you don't have that
particular lab environment or the
access to it, you just want to go
ahead and make sure you're running
TCP dump on your own machine
and go ahead and just test it that
way. You can still follow along the
same commands. You'll just notice
that any IP addresses will more
than likely or at least they should
be different on your particular set.
All right, so let's go ahead and get
started here, you should already be
logged into the Siberry Web
site and we're going to go ahead and
navigate to the lab now.
So we're just going to search in the
search box for TCP dump altogether
there. And you'll see once I do
that, no, no one
does show the lab we were just in a
little bit ago.
And then it's showing us TCAP dump,
which is the one we want.
So we're going to click on this top
one here.
We're going to click on launch that
green launch button there, and
then we're going to click on the screen
launch item button that's going to
actually launch the LaForce.
That takes a moment to pull up some
of the pause video. We'll come back
to it once it's pulled up.
All right, so you'll see that the
lab has environment has pulled up
for us, you'll notice here that we
got our traditional paperbarks that
we've normally seen.
We're just going to say next to that
and then OK, and that'll take us
to our main desktop screen here.
Now, you'll also notice that the
Lubutu
desktop here just logged us right
in. We didn't have to put it in the
username password.
That's perfectly fine since we're in
this particular lab environment.
That's how it's configured.
Ah, so let's go back to our step by
step guide again, you can download
these in the supplemental resources
section if you have not done so
already.
All right, so we want to henckels
our pop up box to the next thing
we're going to do is actually launch
a terminal window, so here in step
five so we can click on it.
I've noticed a few minor issues
in the 2.0 environment.
So a lot of times what I like to do
is just right click and say new
terminal.
Sometimes when you left, click on
it, it doesn't open it right away.
So I like to say time it is
right. Click on say New Terminal and
you'll see it opens the terminal
window for us.
So the first thing we're going to do
at the terminal, we're going to
change directory.
So we're going to do Khedive change
direction and then change into this
directory right here.
So let's go ahead and do that, so
we're on to type in KDDI space
for Egholm, for
student Fortgang
Desktop with a capital V
for slash capturers.
And then just press center on the
keyboard, you'll see it's changed
us into that directory.
All right, so now we're going to
just basically look at the manual
for TCP dump.
So if you're not familiar with Linux
at all, which again, one of the
three risks for the course, you
should understand what the man
command does.
But basically for any type of tool
that you're using in Linux, if
you're not familiar with it, you can
just use man as a command
that will show you the manual for
the tools. What that means is
basically to show you like what kind
of flags and stuff like that to use
what you can actually do with the
tool.
So we're just going to type in man
and then TCP dot
and you'll see here that if we want
to scroll through it, we can see all
sorts of good information about what
is a tool. What does it do?
What are some of the different flags
that we can use?
How can we use them, et cetera, et
cetera? Now, we're not going to go
through like the main page, but
you're welcome to do so on your
site.
We do also, as I mentioned, again,
have information and supplement
resources that's going to help you
out using this tool.
So once you're done looking through
that, just go ahead and hit the
queue button on your keyboard
and that'll just back you out of
there and basically quit and take
you back to that prompt right here.
All right, so the next thing we're
going to do is here in step 11,
we're going to go ahead and
basically restart out all the
interfaces that are available and
we'll use this command here.
Now we're going to do pseudo so we
can do it as root user.
And then once we do that, it's going
to prompt us for a password.
And that's going to be the word
student all lowercase
case.
So let's go and type in that command
will do it step by step here, so
we're going to type in pseudo
space, TCP dump
space, dash capital D,
space dash list,
dash interfaces.
All right. Once you tried that in
press, enter on your keyboard and
then again, it's going to prompt you
for the password. You're just going
to type in student all over case
you'll notice it doesn't actually
show me the text I type.
That's OK. That's to be expected.
And you'll notice that once I type
in that password there, it's going
to show me my interface interfaces.
So you CISO is
zero zero
and I've also got my loop back
interface right there.
All right.
So I actually answer your question
number one for you, at least on my
end, what interfaces are listed?
So I went ahead and mark those down
on your ideas. Go ahead, mark those
in there so you can keep track of
them.
Arseneau words, step number 13 here.
We're just going to type in this
commander right here to go to the
zero interface.
So pseudo tcp dump
dash lowercase I
zero.
And then once we do that, we're
going to come down here instead step
16 and actually just run a ping
command.
So let's go ahead and do that now.
So we're type in pseudo space
TCP dot.
Space dislocates own
space, age 11
and the number zero
interview keyboard.
You'll see here it's going to start
listening for us.
And so I'm going to pause video
briefly, it's going to take just a
moment to run that command.
All right, so once you've got that
command run for, you know, roughly
10 to 15 seconds or so, we want to
just open up a new terminal window
and that's where we're going to run
our ping command.
So the way you do that is just
right. Click on the terminal and
just say new terminal, just like we
did before to launch this one.
So you'll see in the background
there, the command is still running.
And now we're going to do is here to
step 16.
We're just going to run this ping
command right here. So we're going
to do ping and then 10 dot zero,
10, 11.
All right. So what we want to keep
an eye on, once we run that ping
command, we want to look in our
terminal window here.
So this original one here.
And we want to see if we notice that
I.P. address at 10, top zero, 10,
11.
So if you notice has shown up there
that we know we're successful.
So let's go ahead and do that now.
So we're just type in ping
space 10 dot zero,
10, 11, not
just press center and a keyboard.
Again, we want to look at this
background here.
And you'll notice there that I do
see the 10,
11, at least on my
end, and you should see the same
result on your end as well.
All right, so question number two
here, do you see the IP address that
we had just typed in the original
terminal window?
And so the answer to that is, of
course. Yes, I do.
So let's come back to our command
prompt here.
We're just going to do control Seno
in this one.
We just run the ping command to stop
the ping command there.
And if you want, you can type clear
to clear out the screen, make a
little prettier.
You don't have to do that at all.
All right, so coming back to our lab
document here, we're just going to
run our last command here, just
another command as well, what is
going to be pinging against one to
this time?
So same thing here.
We're going to be pinging in this
command prompt window
and assuming this terminal window.
And then we're going to look into
the background here to see if we see
the DOT 12.
So let's do ping space
10, dash zero,
dot 10, 12,
and then just press enter the
keyboard again.
We're going to look there and we do
see in the background that we see
that same IP address going.
All right, so what would I do?
Lastly is we want to see how many
packets were captured in total
in this particular terminal window
here. So let's start our excuse me.
Let's stop our Pinkman here
by control, see?
And our keyboard.
That'll stop that one there.
And we can actually x out of that.
We don't need that window anymore.
And then in this terminal window
here, we just want to do control C
and based on how long you let
this these different commands run
for your packet, maybe different
your packets captured may be
different than mine.
So just keep that in mind
for your answer.
But basically, question number
three, here is how many packets were
captured in total?
And you'll see here that I had one
hundred and seventy four packets
captured total.
Or so this lab, we just ran a couple
of quick commands inside a Tsipi
dump just to give you a little more
hands on experience with it.
And the next video were to jump in
and I'll show you where we go to get
our capstone lab again.
That's going to be for individuals
that are going to have
access to the Siberry lab
environment. If you do not, that
what you'll want to do is just
practice on your own
environment with Wireshark of TCAP
commands, because that's primarily
what everyone else will be doing in
the capstone lab. They'll be focused
on using Wireshark and running
different filters and commands
instead of Wireshark.
So I look forward to seeing you in
the next video.