HEY EVERYBODY WELCOME TO next video.
We're gonna be talking about network traffic now once you've heard of the machine you're going to want
to know what traffic is going to and from the machine because if you have a web server on the machine
it helps you identify which Web services being hit without having to go through and track all of the
access logs.
However going through the asset access logs would be a much quicker way.
But when it comes to network traffic there might be some other services that you might want to investigate.
And when you're local to the system you can then take a look at a little bit more detailed traffic such
as decrypting SSL traffic.
If you need to if it's been initiated from this machine is all you've seen the original part of the
connection.
So we're going to talk about today is how to grab that traffic and just how to view it.
Now we're not going to be going over traffic analysis per say in this video but you'll at least have
a good understanding of how to grab the traffic that you're looking for and also be able to view it
in a few different ways.
So on most Linux systems there's something called PDA.
Now this can to two things that can save your traffic or you can read the traffic that you are that
you downloaded or that you monitored.
But what it takes is a few parameters dash S zero essentially so a dash s is the size of the file.
You said it's a zero.
It will be at max and it will not roll over.
So if you are running a packet capture with DCP dump and you don't have dash asset it will cap it a
set amount and then it will roll over to you traffic stop gap.
One traffic dot be capped and we'll just keep rolling in different files instead of one to one larger
file for this particular point we're just want the one larger file to work with rather than 30 different
files.
So we put essence zero.
Next we're going to have is the interface which is Dash I in this case the VH 1 because remember this
is a dual home machine and each VH 1 is our arms our 0 is are 1 9 2 1 6 8 address and we can just do
a quick double check on that.
Make sure you're listening on the traffic.
So ETF 0.
And then dash W. is the traffic peak app which is our output file.
So we're gonna want to do is we'll go and run that you see here it says the capsizes that many bytes
and we'll go and create some traffic so will you ping 1 2 1 6 8 1 1 give us a few pings back stop it
and let's do a Let's do a curl to HP let's do it w Google icon.
We got our source page from Google as well.
Got to clear that up and we'll stop traffic so we can see that we've got 36 packets capture zero packets
dropped by the kernel so that's good.
Now there's two ways we can do this.
CPM has its own dump as well and there's also something called TTP view but I'm can see the dump for
now.
So dash ours Fareed and then we passed traffic so you can see here it's just showing us some some base
information so we can see our ICMP echo requests and echo replies in which IP is resolved them and then
there is a request for who has and we've see a DNS request to try to find out what Google's outcomes
IP addresses.
And we keep going down then we start seeing we're making a three way handshake and then we have our
connections back and forth.
So it gives us a generic idea of what's going on.
You see here we have our our get requests and we have our response here.
But there's something that we can use to make this a little bit more intuitive and DCP dump has its
uses such as when you're doing something with your automatically capturing packet traffic from a tool
and you wanna be able to pass out and look for something specific to speed up is a good way to do it
with DCP view or just using CPM in general.
That's a good way to view the traffic from a programmatic standpoint but from a user standpoint the
easiest way might be to just use wire shark.
Now if you can if you have a route on the system chances are you have a way to export trade data through
back to your machine so in this case we have our traffic up he can so if we wire shark traffic that
big cap it's going to load up wire shark which is a much nicer interface.
So this is just because we're running it as super users will ignore that.
But you can see here now we've got a little bit better of an interface to work with and download it
so we can see we have our pings that we sent in before.
Which is exactly what we'd expect.
Then we have our ARP requests and we have our DNS requests to find out where Google is.
And we want to find that out and then we have our get request.
Well we can actually use a wire shark to get a better idea of what's going on so we can see the full
request here.
No user the courtesy user agent we look at our host reissuing the get request.
Let's go ahead and see if we can find the response.
There you go.
So you see here we've got our response we've got our server GSW got our cookies then we've got our actual
response then we've got our line based response which is our actual web page as you see here.
Here we go.
So this is just a quick way for you to monitor traffic and then go ahead and search through it later
to find out what's going on.
So if we saw that this was a web service that was being called out to buy an application we might have
a better idea of what is actually going on here because there might be some scripts that call out to
a specific application and depending on what that application does let's say if it's trying to log into
a user or log into another service we might be able to fake it and have it set up the local DNS on the
machine to redirect to where we want to.
So every time it gets an update from somewhere else and tries to push it to that server it pushes us
instead.
So there's a lot of things we can do with this.
So it's always good just to keep a packet traffic of you know 20 or 30 minutes or so of kind of what's
going on.
Just make sure you don't log up too much space on the disk.
Otherwise it's going to start doing monitoring alerts for other people such as the NOC or maybe Splunk
alerts depending if they have that setup or not goes for disk space usage and last thing you want is
somebody poking around in the box trying to find out why all of a sudden they have 10 percent less or
10 percent left of disk space because you had a 30 minutes peak out sitting there and that's going to
be fairly obvious when they start running commands to find out what the biggest file is.
So just keep that stuff in the back of your mind as long as you can find out how much space they have
left which we can do with DLF so we can see here.
We found out how much we've used.
We've used forty five percent so far.
And if you see this continue to go up or for whatever drive you happen to be on just keep that in the
back of your mind just try not to keep this bumping up too high because some places have alerts for
when things change too dramatically it prevent it is a preventative measure and sends off an alert.
So again just double check network traffic see what's going on and see what you can do from it.