Packet analysis and traffic sniffing are utilized by various network devices, including routers, switches
and firewall appliances.
These devices capture and interpret the raw bits of packets, examining field values to make informed
decisions about the appropriate actions to take.
Here we have three different devices examined for network traffic.
The first is routers.
Ruders capture traffic and analyze the IP header which works on the layer two of internet layer to determine
the appropriate routing path for the packets.
And here in this course you will learn all of this, this PDU and the TCP IP layers here.
And we also have the firewalls, firewalls, monitor all network traffic and enforce access control
lists.
X, so they drop packets that do not comply with the specified rules in the ACLs, ensuring that only
authorized traffic is allowed to pass through.
For instance, when they when data passes through a firewall, the device inspects the traffic and decides
whether to permit or deny the packets based on the ACL rules.
As I said, an ACL means access control list.
And here too, and here, as you can see in this diagram, I draw something that simulated how ACL works.
And here we are.
Communication order starts from bottom to top.
So as you can see, one, two, and here we have two way communication.
And to decide whether to allow or deny a packet, the firewall must check each header as it passes through
the device.
And here we have the feeder IP header, TCP header and Ethernet header.
They both have source source port and destination port.
And here the firewall checks them and it and it will determine variables such as IP addresses, transmission
control protocol, TCP IP flags here, TCP flags and port numbers here.
Destination Port and Source Port Destination Port Source port here.
Destination Address and Source Source address here.
So and port numbers that are in use.
If the packet does not meet the ACL entry, the firewall, as you can see here, will drop the packet
as shown in this diagram.
And inboard syn packet with a destination port of 80 is blocked because it does not match the rules.
And it's so important to note that a packet sniffer while examining traffic, does not modify the contents
of the packets in any way, and its purpose is solely to capture traffic for analysis as it traverses
the network.
And packet sniffing and analysis have played integral roles in network management for many years.
However, the initial step in the analysis process is to capture the network traffic and which we will
explore in the subsequent sections.