Let's take another example.
So what I'm going to do right now I'm going to try to scan another computer.
I know that we didn't talk about scanning yet but this will be explained in depth later on.
So I'm going to a specific comment called and map this is a very powerful Linux tools that allow you
to scan all the computer report and service an operating system and then I'm gonna type and map minor
small kept less which is scanning the services and support and minus kept capital all just scanning
the operating system and I would write an IP inside my network which is 1 9 2 1 6 8 1 6 3 1 3 2.
But before start scanning I would open what shark
and I'm gonna start sniffling.
So choose it 0 and is thought sniffling let me know scan and let's see what would happen.
So as you can see sir scanning was able to scan all the port and get me some results.
And here I'm going to stop the scanning and you're going to see what results we can get.
Now first I want to show you that sometimes you would get a lot of unwanted traffic.
So what you can do you can apply some filter.
This is very useful.
And actually in one shark you'll find the display filter very easy to use.
So if you type here I just need the IP for
the traffic between those two computers so I can type IP address.
I wrote it here before IP address should be written this way let me increase it and you put equal equal
and IP of the sources and the IP of the destination so it may increase.
So here I'm telling him I need only the traffic between those two computers IP address of 1 9 2 1 6
8 1 6 3 138 which is a computer who scan an IP of 1 9 2 1 6 8 1 3 2 1 6 2 1 3 2 which is IP that are
scanned and will click on a..
Okay so it will filter the traffic.
Now let's understand the traffic and compare it to what we received.
So as you can see some traffic here between those two machine he was scanning and some port here are
doing the three way handshake and some ports are sending a reset.
So when he tried to scan the system when he tried to scan a port and support sent the reset packet that's
mean the port is closed.
Well if he completed the three way handshake with the port this means a port is open which is mesh matching
those information.
So any port that didn't show here does mean the system or the clinics try to scan it.
But since support is open it has sent a reset packet now scanning would be explaining depths.
But what I'm saying is if you start getting familiar with Skelly Linux I'm sorry it was wild shark.
You will be able to detect if someone is scanning the system you'll be able to detect what kind of traffic.
So what I suggest that you spend sometimes going through our shark doing different scenario applying
filter try to analyze the traffic.
Definitely this will add to you while you are penetrating a new wired or wireless network.
So spend some times with wild sharks.
Let me know if you need some additional resources and I'll be more than happy to help you that.