Sometimes sifting through logs is not enough.
And we need to retrieve raw data traversing the network packet captures provide the most detail when
it comes to gathering data on a network.
It is a raw capture of IP traffic with all the information you could ask for when troubleshooting or
investigating a security issue.
These captures can be fetched directly from network devices like firewalls and switches or were they
software tool running on a computer.
The most popular packet capturing softwares are TCAP damp and Wireshark.
TCAP dump is a utility that can be used on Linux and Mac operating systems to show you how to use the
TZP dump utility on a Linux machine.
I'm going to use my Kelly Linux box and start by launching a terminal
from the terminal.
I used the command TCAP dump and then to capture.
I'll use the dash w command than the name of the file.
I'll just call this capture and then you're going to want to make it a copy cat file.
That's a file extension for packet captures and then if I wanted I could actually specify specific TCAP
Porth but I'm just going to hit enter and capture all data traversing my network interface cards.
OK so now that the packet captures running I'm going to generate some traffic by launching a Web browser.
Then I'll just go to a Web site
OK.
So now that I've generated some data others should be some traffic being captured I'll hit Control C
too and the capture
shows that they captured 644 packets to view the TCAP dump.
I'll use the TCAP dump command again then the dash are command in the name of my captured file.
My screen is kind of small here so it's not a very good view but I can easily copy this and put this
in a text file and take a closer look at it.
And as you can see all the raw packets that were being generated from my Linux machine was captured
by the TCAP dump utility.
So I just showed you how to use the TZP dump utility on a Linux machine.
Now let's use wireshark on a Windows computer to obtain a copy of Wireshark.
You can go to the wireshark Web site at wireshark or
and it is a free download so you would simply download your desktop run through the wizard already have
installed so I'm just going to launch it.
The first thing you need to do in Wireshark is pick which network interface card you want to capture
on.
I'm using wireless currently so I'll double off click on my wireless network interface card and now
the wireshark software is capturing data.
That leaves my wireless network interface card
so if I wanted to I could slot to one of these traffic flows and then down below I can expand the eternal
frame or IP packet information to really take a close look at the traffic.
One cool thing about wireshark is you can apply display filters so if I only wanted to see what HTP
traffic my computer was generating I could just type in a TTP which is a predefined filter hit enter
and now it's only showing me HTP traffic that's running on my computer.
So even though pad captures are very helpful for administrators for troubleshooting in for cybersecurity
engineers for investigations it can also be our worst enemy because a hacker could use a packet capturing
tool to capture wireless or wired traffic being sent on the network.
And that's why you want to make sure that you're always using encrypted protocols.
For example when you remotely access network equipment like firewalls routers and switches you can use
S-sh or Telma S-sh of course is encrypted and is the more preferred option.
But if you were to use something like Talma a hacker could actually intercept your username and password
sense tell him that data is sent in clear attacks just to show you I will filter or capture a few Talma
traffic
I'll launch a Telma session to my core switch and I'll put in the username Cisco and password Cisco.
So just now my computer just sent a telnet quest and my username and password and information in plain
text.
So now we go back to our packy capture software here and we look at these packet captures for my telnet
session.
You can actually look through the raw data that was sent in my session.
I can look and I can see the banner that was sent from the switch to my log and prom.
And then you can see the data that was sent when I entered my username I have a c i s c o.
From a user name and then it shows my password as c i s c o.
So using C with this capture if I was a hacker and I was able to somehow capture the data that was being
sent to this telnet session I could easily look at the payload and see what username and password was
sent to log into the switch.