All
right, network troubleshooting utilities, ping.
We've mentioned ping before.
It's used to test whether an IP address or website is accessible by a host.
A reply indicates packets are transferring between the system and a given IP.
Launch a command prompt, ping the dotted decimal notation or ping the FQDN to check
the availability of the host of the computer.
You can also use it to check the DNS resolution.
If you get a host not found, something like that, you might have some DNS issues.
The message request time out indicates there's no connection between the system
and the host and the system is unable to connect to the host.
Trace route. I mentioned this earlier, but again, trace
route sends out a series of ping request with low TTL values.
When you start seeing the asterisks or the drop packets, for example, right here,
that router is either not responding to the ICP traffic or it's a failure.
Now, typically from that point forward, you'll see timeouts on everything because
that's the failure domain or the failure along the route.
If it's just asterisks and then you see
responses, that indicates that system is just not responding.
Our IP config.
Checking your IP configuration is
typically one of the first things I'll check.
Making sure that you have a valid IP address, that it's not a 169.254 address
on a Microsoft box, that it matches the network and your gateway configuration
information and DNA information is correct.
Ip config in Windows, IF config in Linux.
Our NsL ookup.
The NsLookup utility is used to resolve a DNA request.
It can also be used for zone transfers,
look up a specific IP address or multiple addresses associated with domain names,
and let's look up dig hosts and a few others are all DNS resolution utilities.
You can again check the DNS resolution of a given FQDN just by pinging it.
It automatically resolves it, IP address comes back.
But it's used to resolve DNS address resolution issues proper.
It's also used to potentially footprint and perform reconnaissance for an attacker
pulling zone file transfers and other fun types of stuff.
The NNS lookup command is executed in the
command prompt to look up the IP address for the domain name.
Now, again, you're going to be going through a lab on several of these tools.
Nets tat.
The NetS tat utility is used to display both incoming and outgoing TCP IP traffic.
This is your network statistics.
Active connections, listening ports, services that are actually using the port.
So netstat, netstat E.
There's a bunch of different syntax
variations for netstat A and B, shows the binary, everything's listening.
Lots of different command line switches for netstat.
But that will show you your active
connections on local box, whether they're listening or actually fully connected.
All right, Puddy.
Puddy is a SSH client, runs on Windows systems and other types of systems, but
Windows natively doesn't have an SSH client.
Puddy, FTP or SSH FTP client for transferring files, also for remote
administration, opens Terminal Windows, it generates hashes for passwords.
It does a lot more than that.
And you're going to use Puddy to log in to
Linux boxes and perform remote administration.
Again, T elnet was the older protocol, clear text for remotely managing systems.
That's a horrible idea to use from security perspective.
So we use SSH to encrypt remote terminal sessions.
Ip subnet calculators.
Subnet calculators are used when you
actually borrow from your host bits to create more network IDs.
So if you do have a non classful IP
addressing scheme, subnet calculators can help you to divide the network into
multiple subnets with X number of hosts per network.
Network troubleshooting utilities and tools.
Speedtest. N et is used to check your bandwidth,
determine available bandwidth for a host at a point in time.
There's Okla and bandwidth.
N et, so forth.
Lots of different speed testing sites.
This can check for slow connectivity, time taken to upload and download a file.
It can be determined using the website.
All right, Pathping.
Pathping is trace route multiple times.
Imagine you run a trace route and
everything checks out fine, you're still having some packet loss, you may have a
router that's intermediately dropping packets.
Pathping is more likely to pick that up.
So you have a statistical analysis out of X number of trace routes.
This one responded 100 % of the time.
This one responded 90 % of the time.
That actually gives you a number of
responses out of a total number of attempts.
That can help you determine failing
network devices that haven't fully shut down or fully failed on you.
Failing.
Our network troubleshooting tools route.
There's a couple of different ways to show your local routing table.
Get route print netstat r.
Sounds about right.
Get route print shows your local routing table.
This could indicate misconfigurations for your default gateways.
It could also indicate static routes were
added, which could be a poisoning attack, set up a man in the middle attack.
Then Nmap.
Nmap is really useful for network traveling.
It's a scanning utility, it's a network mapper.
It's used primarily for footprintting and
reconnaissance in ethical hacking and other types of network recon.
But host discovery and service discovery,
you can do port scans, you can do host scans.
You're going to be doing a lab on end map.
But the end map utility will check for connectivity by doing ping sweeps.
It actually gives you lots of different flavors of host discovery, lots of
different flavors of service discovery, multiple ways to ping a host, ICMP, TCP,
UDP, raw protocol scanning, multiple flares of ICMP.
So extremely robust on the options.
So again, if your ECHO request, echo reply
is being filtered, and XenMap's got other ways to check it.
So enmap runs from a command line and also from a GUI.
You're going to be running through some
labs on service and version discovery, OS discovery, host discovery.
The OS discovery is especially useful when you're identifying systems to attack.
Getting the OS fingerprint lets you know
what vulnerabilities might be available or present, what exploits might be available.
We use Nmap is probably the most used tool in offensive security.
We use it for all sorts of things in ethical hacking.
We also use it in forensics and a couple
of other disciplines, but definitely can be used for network troubleshooting.
Our troubleshooting utility is Wireshark.
Your Wireshark allows you to capture all
the traffic that is viewable or captureable by a given interface.
Really useful stuff.
You can use it...
You've got a lab where you're going to be
running through different Wireshark filters, but when you capture traffic in
Wireshark, you can filter away the display or filter away the capture.
And again, you're going to be going through an extensive lab on this that
allows you to pinpoint or filter out exactly what you're looking for.
So really useful tool for network troubleshooting.
Hping2, HPing3 is another command line
network scanning and packet crafting tool for TCPIPs.
So it's an alternative to Nmap.
Personally, I prefer Nmap.
This would be the, I guess, Pepsi to Nmap's Coca Cola.
But it's definitely got some cool bells and whistles.
It can do flooding attacks and a bunch of other stuff.
So HPing, really powerful command line packet crafter.
A little bit of command line syntax.
Again, you're going to be doing a lab on
HPing 3.0. I'll let you get your feet wet in the lab.
Netcat.
Generally, you think of Netcat as a hacking tool because it's so useful.
But it's a network utility used for
testing network connections on both Windows and Linux based systems.
Basically, it gives you the ability to
send and receive raw data across a network connection.
It's very similar to Telnet and you will be playing around with Netcat in the lab.
But NetCAT is quite often used for setting
up remote access and Trojans and listeners.
Once the system has been compromised, it's
part of the maintenance of access step of the hacking cycle.
All right, DIG. Dig is an alternative to NNS look up.
It stands for Domain Internet Groper, and
it's used to resolve FQDNs or host names to IP addresses.
You'll be playing with DIG a little bit in the lab.
And then you can also test whether the target DNS allows zone transfers.
Okay, the zone transfer is a request for all of the records in a DNS server zone
file, and that's really useful for footprint and reconnaissance.
So you are almost always shut down when you request a zone transfer.
But every so often you get lucky and that's a good day.
When you pull a zone transfer, that's a
good portion of your network footprint in one basic request.
Arp and TCP DAO.
Arp Cache Poisoning is used to sniff switch networks.
If you use a ARP utility on a local box and you see invalid IP address to MAC
pairings, that can indicate an ARP poisoning attack.
So ARP is used to check your local ARP cash.
The ARP address resolution protocol is used to resolve IPS to MAC addresses.
One of the flaws or features, however, we're going to look at it, with ARP is you
can send unsolicited ARP responses and the system will accept those.
So this will be bold face lies and can be used to intentionally poison ARP caches.
It's meant to proactively update ARP
caches so there's no denial of service or absence of
connectivity, but it could also be misused by an attacker.
That's a pretty common method for sniffing a switch network.
Our TCP dump, really classic command line packet capturing utility.
Tcp dump is a packet logger.
It logs and records in a PCAP format, which is pretty standard.
You can open your TCP dump traces in
Wireshark or any other PCAP compatible viewer, and you'll be playing around a
little bit with TCP dump in the lab as well.
Tcp Replay, haven't actually used that in
quite some time, but it's used to copy and re transmit packets.
Systems for modifying license utility supported by Linux for modifying,
replaying previously sniffed traffic from tools like Wireshark and TCB.
It allows you to capture and transmit traffic.
You actually can manipulate it a little bit.
There was a companion utility for that
called TCB Opera, which allowed you to amplify the traffic.
Definitely has its uses, but it's used to
test systems and how well they process for transmissions and that thing.
Our DNA Enum, a Pro script that enumerates
DNA information of a domain to discover non contiguous blocks.
So DNA Enum or DNA enumeration utilities
will perform DNA name resolutions, host queries, start with authority records, all
that good stuff, and can also be used to footprint its own files.
There's a lot of DNA enumeration tools.
That was an overview of some of the tools
we're going to use for network troubleshooting.
Again, you've got several of those tools you're going to be using in the labs.
That's going to wrap us up for Module 16, network troubleshooting.