1 00:00:00,120 --> 00:00:01,710 In this walkthrough, we're going to go over a few 2 00:00:01,710 --> 00:00:05,040 of the network services utilities that Linux provides 3 00:00:05,040 --> 00:00:07,230 in order to troubleshoot the network. 4 00:00:07,230 --> 00:00:09,330 So in particular, we're going to go over the ss, 5 00:00:09,330 --> 00:00:12,480 or the socket state command, the netcat command, 6 00:00:12,480 --> 00:00:14,703 and also one of my favorites, the TCP dump. 7 00:00:15,570 --> 00:00:19,833 So first let's just see what our current address is. 8 00:00:21,420 --> 00:00:23,880 Now we look at enp0s8. 9 00:00:23,880 --> 00:00:27,450 That's my second ethernet NIC I'm currently using. 10 00:00:27,450 --> 00:00:30,723 And we'll see the IP address for that's 10.0.3.15. 11 00:00:31,740 --> 00:00:32,970 Now, just to note 12 00:00:32,970 --> 00:00:36,450 if you were ever to see something like 169.254, 13 00:00:36,450 --> 00:00:39,210 that's letting you know that there's an issue 14 00:00:39,210 --> 00:00:41,130 with the DHCP server. 15 00:00:41,130 --> 00:00:43,890 And we're not able to issue any addresses at the time. 16 00:00:43,890 --> 00:00:44,723 All right, let's go ahead 17 00:00:44,723 --> 00:00:46,530 and try this socket state command really quick. 18 00:00:46,530 --> 00:00:47,490 So we're going to do socket state. 19 00:00:47,490 --> 00:00:49,050 We're going to do listen. 20 00:00:49,050 --> 00:00:50,800 That's what that option stands for. 21 00:00:51,930 --> 00:00:53,010 We want to go to the less command 22 00:00:53,010 --> 00:00:54,120 cause it gives out a lot of information. 23 00:00:54,120 --> 00:00:55,870 So we want to condense that for us. 24 00:00:56,850 --> 00:00:57,683 Okay. 25 00:00:57,683 --> 00:00:59,790 So it's going to pull up pretty much a socket. 26 00:00:59,790 --> 00:01:02,100 In a socket it's nothing more than a combination 27 00:01:02,100 --> 00:01:04,680 of an IP address and a port. 28 00:01:04,680 --> 00:01:07,860 So if we see these names, these network names, 29 00:01:07,860 --> 00:01:10,200 with the different ports that's associated with them 30 00:01:10,200 --> 00:01:11,280 that's what a socket is. 31 00:01:11,280 --> 00:01:14,040 An address associated with a port. 32 00:01:14,040 --> 00:01:15,570 So we scroll down, we can see all 33 00:01:15,570 --> 00:01:19,113 of the services that are listening currently on our device. 34 00:01:22,020 --> 00:01:23,580 Okay. 35 00:01:23,580 --> 00:01:25,110 I'm going to quit out of this. 36 00:01:25,110 --> 00:01:26,820 Now next we're going to actually try to connect 37 00:01:26,820 --> 00:01:31,380 to our port 21 on our local host. 38 00:01:31,380 --> 00:01:33,180 This is to test out the network connection. 39 00:01:33,180 --> 00:01:35,220 Now it should give us an error 40 00:01:35,220 --> 00:01:36,970 because we have not opened that up. 41 00:01:38,040 --> 00:01:39,630 Okay. Connection refused. 42 00:01:39,630 --> 00:01:41,640 That's exactly what we should have got. 43 00:01:41,640 --> 00:01:44,850 Remember the nc stands for the netcat command. 44 00:01:44,850 --> 00:01:48,300 Again, this is another network utility tool that we can use 45 00:01:48,300 --> 00:01:49,650 to troubleshoot our system. 46 00:01:51,030 --> 00:01:54,750 All right, next I'm going to check our partner's connection, 47 00:01:54,750 --> 00:01:56,760 and it should be listening on port 22 48 00:01:56,760 --> 00:01:59,370 which is for the SSH connections that we made earlier. 49 00:01:59,370 --> 00:02:02,016 So let's try to connect to our partner's 50 00:02:02,016 --> 00:02:06,003 server02 and do port 22. 51 00:02:07,020 --> 00:02:07,853 Okay. 52 00:02:07,853 --> 00:02:10,350 So what this response has given us 53 00:02:10,350 --> 00:02:14,310 let us know that we've opened an open SSA session 54 00:02:14,310 --> 00:02:16,620 and we have a good connection. 55 00:02:16,620 --> 00:02:18,687 So going control C out of that 56 00:02:18,687 --> 00:02:20,940 and we don't need to do anything further. 57 00:02:20,940 --> 00:02:22,110 Again, that's just the test to make sure 58 00:02:22,110 --> 00:02:23,560 that the connection was open. 59 00:02:25,440 --> 00:02:28,050 Next we're going to test the domain name resolution. 60 00:02:28,050 --> 00:02:29,400 So we can use this host command. 61 00:02:29,400 --> 00:02:33,692 And this is just to resolve addresses for DNS. 62 00:02:33,692 --> 00:02:34,525 Okay, so we're going to do comptia. 63 00:02:37,710 --> 00:02:41,130 Okay, we see it resolved for us comptia has two IP addresses 64 00:02:41,130 --> 00:02:42,750 associated with it as well 65 00:02:42,750 --> 00:02:46,770 as two IPv6 IP addresses as well. 66 00:02:46,770 --> 00:02:50,220 So again it's a quick way to test the DNS servers 67 00:02:50,220 --> 00:02:52,890 and make sure that they're resolving properly. 68 00:02:52,890 --> 00:02:55,350 And last but not at least, one of my favorite commands is 69 00:02:55,350 --> 00:02:57,840 going to be the TCP dump command. 70 00:02:57,840 --> 00:02:59,040 Now we're going to set this to be listening 71 00:02:59,040 --> 00:03:00,483 to one of my ethernet NICs. 72 00:03:06,600 --> 00:03:08,310 Okay, so we have that going. 73 00:03:08,310 --> 00:03:11,430 Now we're going to open up another terminal and ping 74 00:03:11,430 --> 00:03:13,223 and we're going to see what the results are. 75 00:03:26,994 --> 00:03:28,710 Going to set it for four count. 76 00:03:28,710 --> 00:03:29,543 Okay. 77 00:03:31,320 --> 00:03:33,413 All right let's switch back over and see what we got. 78 00:03:34,740 --> 00:03:36,990 Now we see this network utility tool. 79 00:03:36,990 --> 00:03:39,780 It pretty much monitors our network and gives us information 80 00:03:39,780 --> 00:03:40,740 about anything that's going 81 00:03:40,740 --> 00:03:41,890 in and out of that NIC. 82 00:03:43,020 --> 00:03:44,730 And we see we have a series of ARP requests 83 00:03:44,730 --> 00:03:47,130 which stands for Address Resolution Protocol. 84 00:03:47,130 --> 00:03:49,020 And that's to resolve the MAC address 85 00:03:49,020 --> 00:03:51,750 from an IP address because on the local area network 86 00:03:51,750 --> 00:03:54,723 everything is sent via MAC address. 87 00:03:59,790 --> 00:04:03,153 And now if you look down here, we see that ICMP Protocol. 88 00:04:04,020 --> 00:04:06,510 Now again, that's what's going to be the protocol that monitors 89 00:04:06,510 --> 00:04:08,400 or that creates ping. 90 00:04:08,400 --> 00:04:09,720 And we can see that we sent the request. 91 00:04:09,720 --> 00:04:10,990 Got a reply request reply 92 00:04:11,880 --> 00:04:13,230 and a little bit more information. 93 00:04:13,230 --> 00:04:15,510 So everything that's going in and out of that NIC, 94 00:04:15,510 --> 00:04:16,440 it's going to record it for us. 95 00:04:16,440 --> 00:04:20,070 So it gives us more in-depth troubleshooting for things. 96 00:04:20,070 --> 00:04:21,990 Okay, so we just went over a few tools just 97 00:04:21,990 --> 00:04:25,530 to give us a good view of how our network is operating. 98 00:04:25,530 --> 00:04:27,300 One of my favorite ones, TCP dump, 99 00:04:27,300 --> 00:04:29,250 this is a good network capturing tool 100 00:04:29,250 --> 00:04:30,240 to allow us to see what's going 101 00:04:30,240 --> 00:04:31,980 on in and the outside of our NIC. 102 00:04:31,980 --> 00:04:33,417 Let's not forget about the netcap 103 00:04:33,417 --> 00:04:35,430 and the socket state command. 104 00:04:35,430 --> 00:04:37,230 And I'll see you in the next lesson.