1 00:00:00,590 --> 00:00:07,850 Packet analysis and traffic sniffing are utilized by various network devices, including routers, switches 2 00:00:07,850 --> 00:00:10,100 and firewall appliances. 3 00:00:10,130 --> 00:00:17,930 These devices capture and interpret the raw bits of packets, examining field values to make informed 4 00:00:17,930 --> 00:00:21,350 decisions about the appropriate actions to take. 5 00:00:21,890 --> 00:00:27,740 Here we have three different devices examined for network traffic. 6 00:00:27,770 --> 00:00:29,720 The first is routers. 7 00:00:30,620 --> 00:00:39,560 Ruders capture traffic and analyze the IP header which works on the layer two of internet layer to determine 8 00:00:39,590 --> 00:00:42,660 the appropriate routing path for the packets. 9 00:00:42,680 --> 00:00:50,140 And here in this course you will learn all of this, this PDU and the TCP IP layers here. 10 00:00:50,150 --> 00:00:59,060 And we also have the firewalls, firewalls, monitor all network traffic and enforce access control 11 00:00:59,060 --> 00:00:59,840 lists. 12 00:01:00,620 --> 00:01:09,470 X, so they drop packets that do not comply with the specified rules in the ACLs, ensuring that only 13 00:01:09,500 --> 00:01:12,620 authorized traffic is allowed to pass through. 14 00:01:12,680 --> 00:01:19,700 For instance, when they when data passes through a firewall, the device inspects the traffic and decides 15 00:01:19,730 --> 00:01:26,720 whether to permit or deny the packets based on the ACL rules. 16 00:01:26,720 --> 00:01:30,800 As I said, an ACL means access control list. 17 00:01:31,250 --> 00:01:41,630 And here too, and here, as you can see in this diagram, I draw something that simulated how ACL works. 18 00:01:41,990 --> 00:01:43,390 And here we are. 19 00:01:43,400 --> 00:01:46,130 Communication order starts from bottom to top. 20 00:01:46,130 --> 00:01:51,650 So as you can see, one, two, and here we have two way communication. 21 00:01:51,650 --> 00:02:01,260 And to decide whether to allow or deny a packet, the firewall must check each header as it passes through 22 00:02:01,260 --> 00:02:02,190 the device. 23 00:02:02,190 --> 00:02:06,360 And here we have the feeder IP header, TCP header and Ethernet header. 24 00:02:06,390 --> 00:02:10,470 They both have source source port and destination port. 25 00:02:11,200 --> 00:02:19,720 And here the firewall checks them and it and it will determine variables such as IP addresses, transmission 26 00:02:19,720 --> 00:02:27,550 control protocol, TCP IP flags here, TCP flags and port numbers here. 27 00:02:27,550 --> 00:02:30,610 Destination Port and Source Port Destination Port Source port here. 28 00:02:30,610 --> 00:02:33,370 Destination Address and Source Source address here. 29 00:02:33,370 --> 00:02:36,190 So and port numbers that are in use. 30 00:02:36,190 --> 00:02:45,190 If the packet does not meet the ACL entry, the firewall, as you can see here, will drop the packet 31 00:02:45,190 --> 00:02:46,780 as shown in this diagram. 32 00:02:46,780 --> 00:02:58,150 And inboard syn packet with a destination port of 80 is blocked because it does not match the rules. 33 00:02:59,120 --> 00:03:07,670 And it's so important to note that a packet sniffer while examining traffic, does not modify the contents 34 00:03:07,670 --> 00:03:15,140 of the packets in any way, and its purpose is solely to capture traffic for analysis as it traverses 35 00:03:15,140 --> 00:03:15,920 the network. 36 00:03:15,920 --> 00:03:21,680 And packet sniffing and analysis have played integral roles in network management for many years. 37 00:03:21,710 --> 00:03:27,680 However, the initial step in the analysis process is to capture the network traffic and which we will 38 00:03:27,680 --> 00:03:30,140 explore in the subsequent sections.