>> Welcome to a lesson on using
>> Nmap and Wireshark together.
>> Like Nmap, Wireshark is
an amazing free network analysis tool.
It's a full feature protocol analyzer with
capabilities that extend far
beyond the scope of this course.
With that said though,
this lesson is intended to encourage you to install
and/or use Wireshark during your Nmap scanning.
You'll be able to see how Nmap sends out its probes,
manipulates packet headers, and generally
crafts TCP/IP packets. Let's get started.
Here are the learning objectives for this lesson.
First, we'll talk about what Wireshark is
and a little about its history and use.
Next, we'll talk about why
we as IT professionals should use it.
Then we'll discuss why you should consider playing
around with Wireshark alongside Nmap,
and finally, we'll do a lab on just that.
For most of you learning about Nmap,
Wireshark is probably a tool
with which you are very familiar.
In the battle days of network analysis,
packet sniffers were really
expensive and hard to come by.
Wireshark, which was originally
called Ethereal, changed all that.
Officially, Wireshark is
a network protocol analyzer that lets you
capture and interactively browse
traffic running on a computer network.
It's free and open source.
The biggest thing I want to mention here is that
Wireshark is really amazing but
the way that TCP/IP works on
a switch network can limit its effectiveness.
Specifically just because you place
a protocol analyzer like Wireshark on a network
>> and tell it to listen to a network traffic
>> doesn't mean that all traffic will be seen in it.
In order for Wireshark to
capture all traffic on a network,
it must be set to listen promiscuously,
and it must be running on
a hub which repeats all traffic,
or a span or mirrored port on a switch.
If you're a network administrator,
these are definitely things you
can make happen if you choose,
but you probably won't want to on a production network
>> just for the sake of learning Nmap.
>> Just because this limitation exists though,
doesn't mean that Wireshark is useless.
Much to the contrary,
our Wireshark captures in this lesson,
will be set up from the receiving end.
We'll install Wireshark on the target host,
then run some scans,
then filter and evaluate the results.
Why use Wireshark?
While there are million uses for Wireshark,
even on a switched Ethernet network.
This is true for both network administrators
and information security professionals.
In most cases, Wireshark is used for
troubleshooting communication between
a specific sender and recipient.
I've personally used it a lot to troubleshoot
VPN and remote connectivity issues,
voice over IP and SIP issues
and everyday switching and DHCP issues.
For InfoSec professionals,
Wireshark can be an effective tool for investigation.
For example, if you have reason
to believe that a host on your network has
been compromised and want to
gather evidence about the breach,
you might set up a Wireshark capture to
determine the source and nature of that breach.
This can help you figure out how to mitigate
the threat and can provide you
a solid network forensic evidence in case you
need to bring in law enforcement and build a case.
Using Wireshark on the Nmap scanning station
>> or on a target host
>> can be very informative and educational.
>> It gives you the opportunity to see how Nmap
crafts and sentence probes and how they're received.
Since the purpose of this course
is to dig deeper into Nmap,
I think that introducing you to
Wireshark's use with Nmap is very fitting.
We've covered basics about TCP/IP along with some of
the details about TCP and
UDP headers in previous lessons.
Using Wireshark with Nmap will allow you to see
>> what the TCP and UDP packets look like
>> as they're crafted and placed on the wire.
>> Doing this is not only educational,
but it also helps you gain a healthy respect
>> for Nmap's efficiency and speed.
>> In the lab we're going to run through a couple of scans
and look at the raw packets using Wireshark.
We haven't really covered scan techniques though,
so don't get caught up too much in the Nmap commands.
I'll explain them as I run them,
but just know that we'll going into
them in much more detail later.
The main point here is just
to encourage you to consider running
Wireshark on your scanning station or on
selected targets so that you can see
what Nmap is doing when you run scans.
In this lab, we're going to run three Nmap scans.
First, we'll run a default Nmap scan,
which is a TCP SYN scan of a 1000 boards.
Second, we'll run a UDP scan of
a couple of specific boards, and finally,
we'll run an Nmap Xmas scan which sets
the TCP FIN, push and urgent flags.
I'll point out the difference between
capture filters and display filters,
and I'll give you some basic syntax
for filtering in Wireshark.
The last bullet point here is a link to
a really good cheat sheet for
filtering in Wireshark. Let's do it.
Welcome to the lab on
running Wireshark and Nmap together.
Let's just jump right in.
Just to set the stage,
I'm sitting here on Windows 10 Nmap scanning station,
and the machine that I'm running Wireshark on,
which is the target host,
is a Windows 2012 server,
and I am remote desk topped into it.
You can see that here at the bottom,
I'll go ahead and pop that up.
Here's that machine.
The Nmap scanning station's IP address
>> is 192.168.1.167,
>> and the IP address of the target host
is 192.168.1.10.
I'll clear the screen.
I wanted to diagram this out,
but since it's only two machines,
I figure you can follow just fine.
Let's go ahead and open up the Nmap target host,
and I'll fire up Wireshark.
This machine is not extremely powerful,
so it might take a little bit of time to open up.
If you install Wireshark on your machine,
you might see more than just one adapter.
Here I just have one.
It's called physical because this machine
runs some virtual machines also.
The first thing I wanted to point out
was that you see right
here it says capture using this filter.
Well, everything that I show you from now on,
you can type in
your filtering commands here in the capture filter,
or you can type in
commands up here for your display filter.
Anything that you type here once you
run your Wireshark capture,
if you enter it in your capture filter, basically,
Nmap will only listen for those filtered packets.
I'll show you in a second what
the display filters look like.
The display filters, on the other hand,
will capture everything,
but when you type in your display filter,
it will then filter out of that list of everything,
just the stuff that you want to see.
In this lab we're going to focus
on display filters and not
capture filters and that's
the main point that I wanted to make.
The first thing that you want to do
is to select your network adapter,
and you want to go up to capture,
then click on Options.
Then the main thing that you want to make sure it's
checked is this Promiscuous Checkbox.
It's both down here and up here.
In my case, it's already selected,
so I'm just going to leave it as it is.
The next thing you want to do is up here you see
the little shark fin,
and we're going ahead and click on that.
You see that it's already started capturing packets.
I'm going to go back to my scanning station.
All I'm going to do in this first scan is do
a standard default Nmap scan of that target host,
which is at 192.168.1.10 and so we'll run
a Nmap, 192.168.1.10.
Scan is very quick. There we go.
Now open back up
the target host and I'll stop the capture.
If we scroll up on this top window,
you see all the traffic that
has been heard by the target host.
It's all really good information,
but the problem with it is
that it might be receiving some broadcasts,
it might have some other uni-cast traffic
or some multi-cast traffic.
One of the most powerful things
about Wireshark is the ability to
filter the traffic that is displayed here.