Before we move too far into this module,
we need to take a minute to describe a set of conditions
of a potential environment where you, as a student,
can visualize yourself being in. For this course, imagine that you have
been brought into a networking security group within Globomantics to bring
some new ideas and directions to the group.
This includes the ability to bring some tools into the
job that are not already in use today.
These new tools,
Python and Scapy, will help to optimize the way that the team is able
to assess their networking traffic at a layer that is flexible enough
to deal with modern security challenges.
It has the ability to be used at the CLI for quick assessments and
collection, as well as in module form to be utilized within custom
utilities that are at the whim of the imagination of the
networking security professional.
An advantage of using Scapy, instead of the other options like the socket
module that was covered in the previous course, Network Basics with
Python, is that Scapy makes it a bit less complicated to create these
solutions in multiple OS environments, including macOS. Some of this
functionality was possible with the socket module, but specific, focus
code was required for similar outputs. For this course as a whole, we
will be looking at some of the most common use cases for these
technologies,
including multiple demonstrations of how they can be used in a real environment.
This will include this module, as well as several others that
will include coverage of packet manipulation,
port scanning and traceroute, identifying potential brute force attacks,
performing connection hijacking, as well as performing basic
traffic replay. For this module specifically,
we will be looking into how to use these tools to capture the
traffic that is being transmitted over the network.
This action is usually referred to as sniffing.
There are multiple options that exist that provide the
ability to perform this sniffing of traffic, but when using
Python and Scapy specifically,
this can be done at the CLI and with a high amount of control,
both over the specific traffic captured and in the
visualization of the fields inside it.
We will not only look at the basics of sniffing traffic
from a specific network interface,
but also how the information that is collected can be filtered and
parsed to help identify potential attacks on the Globomantics
infrastructure along with their source and destinations.
This collected information can then be used in multiple ways.
It can be used at the CLI to drill down into the specifics
of it and can be used as a module inside a Python program
to perform a specific action.
These actions are only limited to the imagination of the student and engineer,
but before we do that, we need to run through what is required to set
up our environment and the tools in the first place.