1 1 00:00:00,330 --> 00:00:01,680 tcpdump. 2 2 00:00:01,680 --> 00:00:02,610 In this lesson, 3 3 00:00:02,610 --> 00:00:05,730 I'm going to show you a little bit how to use tcpdump. 4 4 00:00:05,730 --> 00:00:06,900 Now, by the end of this lesson, 5 5 00:00:06,900 --> 00:00:09,180 you're not going to be an expert in it but that's okay, 6 6 00:00:09,180 --> 00:00:10,380 because for the exam, 7 7 00:00:10,380 --> 00:00:13,470 you don't need to know how to actually use tcpdump 8 8 00:00:13,470 --> 00:00:14,730 but you should be familiar with the fact 9 9 00:00:14,730 --> 00:00:17,820 that tcpdump and Wireshark are often used together 10 10 00:00:17,820 --> 00:00:20,550 as a way to capture packets and then analyze packets. 11 11 00:00:20,550 --> 00:00:24,180 Unlike Wireshark, tcpdump is a text-based program 12 12 00:00:24,180 --> 00:00:26,490 and you use it inside the command line. 13 13 00:00:26,490 --> 00:00:27,840 Now, what I'm going to do here is 14 14 00:00:27,840 --> 00:00:30,240 first, I'm going to start using tcpdump 15 15 00:00:30,240 --> 00:00:32,490 inside my Mac OSX environment. 16 16 00:00:32,490 --> 00:00:34,020 It comes installed by default 17 17 00:00:34,020 --> 00:00:36,510 inside Mac as well as in Linux. 18 18 00:00:36,510 --> 00:00:38,100 If you're going to use tcpdump, 19 19 00:00:38,100 --> 00:00:40,020 you need to know what interface you're connected 20 20 00:00:40,020 --> 00:00:41,100 to the network on. 21 21 00:00:41,100 --> 00:00:42,873 In my case, it's en0. 22 22 00:00:43,740 --> 00:00:45,780 So to use it, I'm going to do sudo 23 23 00:00:45,780 --> 00:00:47,070 because you must be running this 24 24 00:00:47,070 --> 00:00:48,450 with administrative permissions 25 25 00:00:48,450 --> 00:00:50,910 to be able to turn your card into promiscuous mode, 26 26 00:00:50,910 --> 00:00:54,630 and then tcpdump -i, and then your interface, 27 27 00:00:54,630 --> 00:00:56,310 en0 if you're on a Mac. 28 28 00:00:56,310 --> 00:00:59,400 If you're on a Linux machine, it should be eth0. 29 29 00:00:59,400 --> 00:01:02,610 So I'll go ahead and hit type in en0 and hit Enter. 30 30 00:01:02,610 --> 00:01:04,380 Now, at this point, I'm putting my card 31 31 00:01:04,380 --> 00:01:05,400 into promiscuous mode 32 32 00:01:05,400 --> 00:01:06,630 and I'm starting to look at everything 33 33 00:01:06,630 --> 00:01:08,230 that's going across the network. 34 34 00:01:10,830 --> 00:01:13,500 And here you see information going across the screen, 35 35 00:01:13,500 --> 00:01:14,910 showing me all sorts of different connections 36 36 00:01:14,910 --> 00:01:16,440 that are happening on this network 37 37 00:01:16,440 --> 00:01:19,560 both from my computer and other computers on the network. 38 38 00:01:19,560 --> 00:01:21,180 Now, this isn't nearly as helpful 39 39 00:01:21,180 --> 00:01:22,980 as being able to look at things slowly 40 40 00:01:22,980 --> 00:01:25,260 or by filtering it down, but that's okay, 41 41 00:01:25,260 --> 00:01:28,230 because we can do that using tcpdump as well. 42 42 00:01:28,230 --> 00:01:29,820 Instead of displaying it to the screen, 43 43 00:01:29,820 --> 00:01:31,770 I'm going to go ahead and hit Control + C 44 44 00:01:31,770 --> 00:01:34,440 and that's going to pause that and cancel my collection. 45 45 00:01:34,440 --> 00:01:36,960 And now, I can see a couple of things here. 46 46 00:01:36,960 --> 00:01:38,160 If we start up towards the top, 47 47 00:01:38,160 --> 00:01:43,160 you'll see that my IP address is 10.128.1.130. 48 48 00:01:43,200 --> 00:01:45,780 The first line there is actually going from my computer 49 49 00:01:45,780 --> 00:01:50,780 over port 57963 to that particular website that you see 50 50 00:01:50,850 --> 00:01:53,223 which is 1e100.net. 51 51 00:01:54,210 --> 00:01:57,750 It's doing this over HTTPS, which is port 443. 52 52 00:01:57,750 --> 00:01:59,250 There is no flags in that packet. 53 53 00:01:59,250 --> 00:02:00,990 There was an acknowledgement that was received. 54 54 00:02:00,990 --> 00:02:04,140 You can see the windowing, the options, and the value. 55 55 00:02:04,140 --> 00:02:06,870 That is one packet with one timestamp. 56 56 00:02:06,870 --> 00:02:08,880 Then you go down to the next one, there's another one. 57 57 00:02:08,880 --> 00:02:10,440 And the next one, there's another one. 58 58 00:02:10,440 --> 00:02:12,510 And there's lots of information here. 59 59 00:02:12,510 --> 00:02:14,490 Now, let's say instead of looking at data 60 60 00:02:14,490 --> 00:02:16,230 from all different things on the network, 61 61 00:02:16,230 --> 00:02:18,780 I only wanted to see things that came from my computer. 62 62 00:02:18,780 --> 00:02:20,820 Could I do that? Well, certainly. 63 63 00:02:20,820 --> 00:02:22,680 What I can do is clear my screen 64 64 00:02:22,680 --> 00:02:25,500 and then I will use sudo tcpdump. 65 65 00:02:25,500 --> 00:02:28,650 I will type in source, which is the IP I want to collect from. 66 66 00:02:28,650 --> 00:02:33,360 And in my case, it is going to be 10.128.1.130, 67 67 00:02:33,360 --> 00:02:35,160 and then I will hit Enter. 68 68 00:02:35,160 --> 00:02:36,900 Now, all you're going to see here is traffic 69 69 00:02:36,900 --> 00:02:41,130 going from the .130 my host to somewhere else on the network 70 70 00:02:41,130 --> 00:02:42,840 and right now there's not much going on 71 71 00:02:42,840 --> 00:02:44,490 because I'm sitting here talking to you 72 72 00:02:44,490 --> 00:02:45,990 and not browsing the internet. 73 73 00:02:45,990 --> 00:02:47,250 But if I was browsing the internet 74 74 00:02:47,250 --> 00:02:48,510 and doing other connections, 75 75 00:02:48,510 --> 00:02:50,250 those would all be showing up here. 76 76 00:02:50,250 --> 00:02:52,290 What you're seeing here is a lot of different beaconing 77 77 00:02:52,290 --> 00:02:54,720 and keep alive traffic for different programs I have 78 78 00:02:54,720 --> 00:02:57,600 on my computer, and that's what we're seeing here. 79 79 00:02:57,600 --> 00:02:58,800 Now, the next thing we want to do 80 80 00:02:58,800 --> 00:03:00,570 is go ahead and hit Control + C. 81 81 00:03:00,570 --> 00:03:01,770 And this is also helpful, 82 82 00:03:01,770 --> 00:03:03,780 but again, it's not extremely helpful 83 83 00:03:03,780 --> 00:03:06,540 because if I had this running on a large enterprise network, 84 84 00:03:06,540 --> 00:03:09,030 there'd be so much data whizzing by my screen 85 85 00:03:09,030 --> 00:03:10,560 I wouldn't be able to read it all, 86 86 00:03:10,560 --> 00:03:12,750 so we would want to write that to a file. 87 87 00:03:12,750 --> 00:03:13,890 How do we do that? 88 88 00:03:13,890 --> 00:03:14,940 Well, again, I'm going to clear my screen 89 89 00:03:14,940 --> 00:03:16,170 so I can go to the top 90 90 00:03:16,170 --> 00:03:17,760 and I'll bring up the last command I did. 91 91 00:03:17,760 --> 00:03:19,950 If we want to do this and write it to its file 92 92 00:03:19,950 --> 00:03:22,350 we can just type in -w 93 93 00:03:22,350 --> 00:03:23,760 and then the file name that we want. 94 94 00:03:23,760 --> 00:03:24,593 And so in my case, 95 95 00:03:24,593 --> 00:03:28,440 I'm going to call it host130.pcap, and then hit Enter. 96 96 00:03:28,440 --> 00:03:31,380 Now, that information is going to go into a file 97 97 00:03:31,380 --> 00:03:33,750 that's going to be captured on my hard drive. 98 98 00:03:33,750 --> 00:03:36,330 As it's sitting there listening, it's picking up any traffic 99 99 00:03:36,330 --> 00:03:40,740 that's going from that source, 10.128.1.130 100 100 00:03:40,740 --> 00:03:44,670 and it's writing it to the file host130.pcap. 101 101 00:03:44,670 --> 00:03:47,330 Now, once we have enough of that, we can hit Control + C. 102 102 00:03:47,330 --> 00:03:51,300 In this case, we captured 161 packets of information. 103 103 00:03:51,300 --> 00:03:53,310 Again, it's very little information right now 104 104 00:03:53,310 --> 00:03:56,010 because it's basically background tasks on this computer 105 105 00:03:56,010 --> 00:03:58,320 because I'm not actively running things 106 106 00:03:58,320 --> 00:04:00,810 because I'm not sitting there browsing the internet. 107 107 00:04:00,810 --> 00:04:03,150 Now, if I wanted to be able to see that information 108 108 00:04:03,150 --> 00:04:07,800 I can do that by doing sudo tcpdump and then -r 109 109 00:04:07,800 --> 00:04:11,370 and then the file that I did, host130.pcap. 110 110 00:04:11,370 --> 00:04:14,700 When I hit Enter, I'm going to see all 161 packets 111 111 00:04:14,700 --> 00:04:17,430 from that file and display them to the screen. 112 112 00:04:17,430 --> 00:04:18,510 Here's the first bunch 113 113 00:04:18,510 --> 00:04:19,680 and then it's going to keep reading them 114 114 00:04:19,680 --> 00:04:21,420 and displaying 'em to the screen. 115 115 00:04:21,420 --> 00:04:23,100 Now again, that's a lot of information 116 116 00:04:23,100 --> 00:04:25,470 and I only did that for about 5 or 10 seconds. 117 117 00:04:25,470 --> 00:04:26,910 If I had this running all day, 118 118 00:04:26,910 --> 00:04:29,220 that'd be way too much information to go through. 119 119 00:04:29,220 --> 00:04:32,310 So instead, we would want to start filtering that information 120 120 00:04:32,310 --> 00:04:35,100 and we can do that based on a lot of different things. 121 121 00:04:35,100 --> 00:04:37,590 For instance, if I look at this particular packet 122 122 00:04:37,590 --> 00:04:39,960 right here, you can see 123 123 00:04:39,960 --> 00:04:44,257 that it is going from the host at 130 over port 5475 124 124 00:04:45,420 --> 00:04:47,070 and it's going out to the broadcast 125 125 00:04:47,070 --> 00:04:52,070 of the network at .255.255 over port 5474. 126 126 00:04:52,110 --> 00:04:53,430 If I just wanted to see every time 127 127 00:04:53,430 --> 00:04:55,800 that there was a beaconing that was going out like that, 128 128 00:04:55,800 --> 00:04:56,700 I can do that. 129 129 00:04:56,700 --> 00:04:58,710 And so what I'll do is I'll hit clear. 130 130 00:04:58,710 --> 00:05:03,420 I would type in sudo tcpdump, source, src 131 131 00:05:03,420 --> 00:05:05,700 and then port, the port I want to see, 132 132 00:05:05,700 --> 00:05:08,220 in this case that was 5475. 133 133 00:05:08,220 --> 00:05:10,170 And then again I need to read it from the file, 134 134 00:05:10,170 --> 00:05:11,807 so -r host130.pcap. 135 135 00:05:13,289 --> 00:05:14,122 If I don't put the dash -r host130.pcap, 136 136 00:05:15,780 --> 00:05:18,090 what it's going to do is it's going to look at the live traffic 137 137 00:05:18,090 --> 00:05:20,700 and anytime it sees a source port of 5475, 138 138 00:05:20,700 --> 00:05:22,110 it would display it to the screen. 139 139 00:05:22,110 --> 00:05:23,610 But in this case, I want to go through and analyze 140 140 00:05:23,610 --> 00:05:25,110 what I already captured. 141 141 00:05:25,110 --> 00:05:26,700 So as I did that, you can see here 142 142 00:05:26,700 --> 00:05:28,740 a handful of times that that happened. 143 143 00:05:28,740 --> 00:05:30,870 Now, if this was malware it was beaconing out, 144 144 00:05:30,870 --> 00:05:32,910 I could see exactly when that happened. 145 145 00:05:32,910 --> 00:05:35,490 In this case, this particular packet is being sent out 146 146 00:05:35,490 --> 00:05:40,490 every second, 190651, 190652, 190653. 147 147 00:05:41,820 --> 00:05:43,590 Now, this is just the header we're seeing 148 148 00:05:43,590 --> 00:05:45,810 and we can see this is a UDP packet that's being sent out 149 149 00:05:45,810 --> 00:05:47,190 with a length of five. 150 150 00:05:47,190 --> 00:05:49,140 Well, what if you wanted to look inside this packet 151 151 00:05:49,140 --> 00:05:50,730 and see what was actually sent? 152 152 00:05:50,730 --> 00:05:52,020 Can you do that? 153 153 00:05:52,020 --> 00:05:53,460 Well, sure you can. 154 154 00:05:53,460 --> 00:05:55,560 We can do the exact same thing we just did 155 155 00:05:55,560 --> 00:05:57,840 and then add the command -x 156 156 00:05:57,840 --> 00:05:59,250 which will show the packets contents 157 157 00:05:59,250 --> 00:06:01,050 in both hex and ASCII. 158 158 00:06:01,050 --> 00:06:02,580 So let me go ahead and clear my screen, 159 159 00:06:02,580 --> 00:06:05,160 and then go here and add -x. 160 160 00:06:05,160 --> 00:06:08,760 Now, I see all those packets again done by time 161 161 00:06:08,760 --> 00:06:11,130 and here I see the IP, where it's going from, 162 162 00:06:11,130 --> 00:06:13,920 where it's going to, UDP length five. 163 163 00:06:13,920 --> 00:06:17,130 Then you're seeing that five bites of data. 164 164 00:06:17,130 --> 00:06:19,080 Notice here, we see it in hex first 165 165 00:06:19,080 --> 00:06:21,720 and then we see it in ASCII on the right hand side. 166 166 00:06:21,720 --> 00:06:22,950 This will allow us to go through 167 167 00:06:22,950 --> 00:06:24,480 and see what was being sent. 168 168 00:06:24,480 --> 00:06:25,830 This can be extremely helpful 169 169 00:06:25,830 --> 00:06:29,010 if somebody's using something like FTP or HTTP 170 170 00:06:29,010 --> 00:06:30,990 where things are being sent in the clear. 171 171 00:06:30,990 --> 00:06:32,790 Now, as I said, what I did here 172 172 00:06:32,790 --> 00:06:35,760 was just a very, very quick demonstration to show you 173 173 00:06:35,760 --> 00:06:37,740 some of the capabilities of this tool. 174 174 00:06:37,740 --> 00:06:38,760 If you want to learn more, 175 175 00:06:38,760 --> 00:06:42,150 I recommend you go into the man pages for tcpdump, 176 176 00:06:42,150 --> 00:06:45,480 and just type in man tcpdump and hit Enter. 177 177 00:06:45,480 --> 00:06:46,530 This will bring up the manual 178 178 00:06:46,530 --> 00:06:48,450 and you can see all of the different options 179 179 00:06:48,450 --> 00:06:51,060 and all of the different ways you can filter down content. 180 180 00:06:51,060 --> 00:06:53,280 Remember, you can filter during collection, 181 181 00:06:53,280 --> 00:06:55,320 or you can filter after you've collected 182 182 00:06:55,320 --> 00:06:56,760 when you're reading things. 183 183 00:06:56,760 --> 00:06:59,040 Why would you want to do one versus the other? 184 184 00:06:59,040 --> 00:07:00,360 Well, again, let's say I was running 185 185 00:07:00,360 --> 00:07:02,400 a big large enterprise network. 186 186 00:07:02,400 --> 00:07:04,050 One of the organizations I worked for, 187 187 00:07:04,050 --> 00:07:07,230 we ran a network with tens of thousands of computers, 188 188 00:07:07,230 --> 00:07:08,940 and so if I said show me everything that's coming 189 189 00:07:08,940 --> 00:07:11,700 from this particular IP address or this particular port 190 190 00:07:11,700 --> 00:07:13,650 or is beaconing out to a known bad actors command 191 191 00:07:13,650 --> 00:07:17,130 and control server, that could be a ton of information. 192 192 00:07:17,130 --> 00:07:20,100 So we would want to just filter down on the collection 193 193 00:07:20,100 --> 00:07:22,860 because we're only interested in what we are looking for 194 194 00:07:22,860 --> 00:07:24,630 instead of every single packet sent 195 195 00:07:24,630 --> 00:07:27,840 across the network internally or out to the internet. 196 196 00:07:27,840 --> 00:07:29,220 And so this is why it's important 197 197 00:07:29,220 --> 00:07:31,350 for you to think about what are you trying to collect 198 198 00:07:31,350 --> 00:07:34,770 and filter that down on the collection to reduce the size. 199 199 00:07:34,770 --> 00:07:35,730 On the other hand, 200 200 00:07:35,730 --> 00:07:37,380 if you're not sure what you're trying to collect yet, 201 201 00:07:37,380 --> 00:07:38,340 you're still trying to identify 202 202 00:07:38,340 --> 00:07:39,750 the indicators of compromise, 203 203 00:07:39,750 --> 00:07:41,220 you may collect everything, 204 204 00:07:41,220 --> 00:07:44,610 which can take up tons of space and then filter it down 205 205 00:07:44,610 --> 00:07:47,510 as you start reading through and going through those logs.