Okay.
So let's install tomb shock.
The first thing I'm going to do is install wget.
This is going to allow me to download an application from github.
I could use it, but I'm simply going to use wget.
What I'm going to do now is use wget and connect to GitHub and download term shock.
I'll put the links below this video.
This is essentially a GitHub page and I'm downloading term shock from GitHub.
So here's the GitHub page for term shock or terminal UI for shock.
And we can see a little bit of information about the application.
You can also do a clone or download.
So I'm simply downloading this file from GitHub.
So Liz shows me that I've got the file downloaded.
The next thing I'm going to do is under zip or on top of that file.
So until the file.
There it is.
I'm going to move to that directory.
And I see the term shock.
So what I'm going to do is install term shock to user local ban, and then I'm going to go back to my
home directory.
So back in my home directory of Root, I'll clear the screen.
Notice I've got this file which I previously created by capturing traffic off the network.
So what I can do now is type two shock read t shock pcap file.
So I'm going to read my pcap file.
And what you can see through a terminal window now is the traffic that's being captured.
So as an example, I could filter for OSPF and apply my filter.
Notice I see my OSPF messages.
So as an example, this is the source mac address of the router.
Show interface gigabit.
Zero zero Notice.
Mac Address of router.
IP Address of router.
That's what we see over here.
Destination is 224005, which is the multicast address for OSPF.
There's the layer two mac address.
Open up the IP header.
Can use my up and down arrow keys.
Use enter to open this up.
Notice dhcp is set to see a six very important traffic.
Scrolling down I can see that the protocol is 89 which is OSPF.
So at layer four notice we have ospf press enter there.
Press enter here.
A version of OSPF has version two.
This is a hollow packet source IP address is this as we saw over here, IP address of router.
Area is the backbone area.
So I can see all the traffic that I would normally see through a graphical user interface directly through
a terminal.
Notice once again, if I quit out of here, I am in a terminal.
There's no graphical user interface here.
It's a simple terminal.
But Tom Chalk allows me to read Wireshark captures through a terminal window.
I'll filter for EGP.
Notice there's IGP messages.
I can go up and down through my messages.
Use the up and down arrows if I like.
I can press tab to jump from one window to another.
So Tab takes me down here.
Tab to the first window.
Second window.
Press enter to collapse.
That enter to open it up.
I can press forward slash and that will allow me to change the protocol.
So to keep as an example.
Now I can see spanning tree messages.
Once again click and you have our like your copy.
Click apply.
There's my IGP messages once again.
Source IP address destination 2 to 4 zero zero ten.
Well known multicast address for EGP.
So I'm using my mouse, but I could use a keyboard.
So up and down keys.
And to key.
And to key again.
And to key here to see parameters.
Notice their my k values and to key to see software version information enter up key enter press tab.
And now I can go up and down through the protocols forward slash.
I could specify, let's say STP again and click apply.
Here's my spending tree protocol.
So.
I can see the root identifier, etc., etc. So I'm not going to bore you through all the options in
this application.
Have a look on GitHub.
A lot of good examples and documentation on GitHub, but I'm hoping this has shown you a really nice
application.
You can run term shock through a console and read t shock messages.
TikTok is great because I could put sniffers in different parts of my network and not have to use a
application with a graphical user interface.
I can also schedule it so I could use cron just to schedule T shock to capture traffic if I wanted to.
There are a lot of options with tea shock and term shock is great because it allows you to view the
tea shock captures directly through a console.
Okay, so I hope you've learned something.
I hope you've enjoyed this video.