1 1 00:00:00,600 --> 00:00:03,560 Telnet, tcpdump and nmap. 2 2 00:00:03,560 --> 00:00:05,890 In this video, we're going to cover the telnet, 3 3 00:00:05,890 --> 00:00:09,280 tcpdump and nmap tools and how we use them in maintaining 4 4 00:00:09,280 --> 00:00:10,930 and troubleshooting our networks. 5 5 00:00:10,930 --> 00:00:12,920 First, we have the telnet command. 6 6 00:00:12,920 --> 00:00:15,770 Telnet is both a command and a network protocol. 7 7 00:00:15,770 --> 00:00:17,960 The telnet command is going to be used to communicate 8 8 00:00:17,960 --> 00:00:20,660 using an application protocol over the internet 9 9 00:00:20,660 --> 00:00:21,970 or a local area network 10 10 00:00:21,970 --> 00:00:24,350 to provide a bidirectional interactive text 11 11 00:00:24,350 --> 00:00:26,010 oriented communication facility 12 12 00:00:26,010 --> 00:00:28,140 using virtual terminal connections. 13 13 00:00:28,140 --> 00:00:30,360 Now, telnet is used to be built into windows, 14 14 00:00:30,360 --> 00:00:33,460 Linux, Unix and OSX systems by default. 15 15 00:00:33,460 --> 00:00:35,380 Telnet is capable of allowing a user 16 16 00:00:35,380 --> 00:00:36,600 to test the network connectivity 17 17 00:00:36,600 --> 00:00:38,020 between a client and a server, 18 18 00:00:38,020 --> 00:00:40,820 as well as issue commands using text-based interfaces. 19 19 00:00:40,820 --> 00:00:42,760 Normally, you're not going to want to use telnet 20 20 00:00:42,760 --> 00:00:45,210 because it's an older and insecure protocol. 21 21 00:00:45,210 --> 00:00:47,710 Instead, you should be using SSH. 22 22 00:00:47,710 --> 00:00:50,830 But as a network technician, there's still one use case 23 23 00:00:50,830 --> 00:00:53,570 where relying on telnet could be considered acceptable. 24 24 00:00:53,570 --> 00:00:55,470 And that's when you're connected directly to a router 25 25 00:00:55,470 --> 00:00:57,950 or switch over a console cable connection 26 26 00:00:57,950 --> 00:01:00,120 because you're then have a trusted and direct connection 27 27 00:01:00,120 --> 00:01:01,540 to that device. 28 28 00:01:01,540 --> 00:01:03,990 Because of the insecure nature of telnet in general, 29 29 00:01:03,990 --> 00:01:07,020 it's actually been disabled by default in Windows 10. 30 30 00:01:07,020 --> 00:01:08,290 If you want to re-enable it, 31 31 00:01:08,290 --> 00:01:09,420 you can enter the command 32 32 00:01:09,420 --> 00:01:14,420 Deism/Online/Enable-feature/FeatureName:TelnetClient 33 33 00:01:15,370 --> 00:01:17,790 and then it's going to re-install this feature. 34 34 00:01:17,790 --> 00:01:20,770 OSX has also removed telnet in recent versions too, 35 35 00:01:20,770 --> 00:01:22,440 but most Linux and Unix systems 36 36 00:01:22,440 --> 00:01:24,810 still have telnet installed by default. 37 37 00:01:24,810 --> 00:01:27,660 If you want to quickly test a network connection using telnet, 38 38 00:01:27,660 --> 00:01:30,860 you can enter Telnet, domain name and port and hit enter 39 39 00:01:30,860 --> 00:01:32,380 to connect to that device. 40 40 00:01:32,380 --> 00:01:35,810 For example, I might enter telnetdeontraining.com80 41 41 00:01:35,810 --> 00:01:36,820 and hit enter. 42 42 00:01:36,820 --> 00:01:38,890 Then, you're going to see the word connecting 43 43 00:01:38,890 --> 00:01:40,200 flash across your screen 44 44 00:01:40,200 --> 00:01:42,280 and then you'll be receiving a black terminal window 45 45 00:01:42,280 --> 00:01:43,800 with a blinking cursor. 46 46 00:01:43,800 --> 00:01:46,100 At this terminal, you can hit enter a few times 47 47 00:01:46,100 --> 00:01:48,160 or conduct a banner grab technique, 48 48 00:01:48,160 --> 00:01:50,830 which is using cybersecurity to get information directly 49 49 00:01:50,830 --> 00:01:53,120 to that web server and get it to responses back 50 50 00:01:53,120 --> 00:01:53,953 and then you can identify 51 51 00:01:53,953 --> 00:01:55,680 what type of software they're using. 52 52 00:01:55,680 --> 00:01:57,690 In this case, you can see that my web server 53 53 00:01:57,690 --> 00:01:59,090 is running open rusty, 54 54 00:01:59,090 --> 00:02:00,830 and it's a web server software here. 55 55 00:02:00,830 --> 00:02:03,650 And then the connection was terminated by my web server, 56 56 00:02:03,650 --> 00:02:05,880 because it didn't get the commands it was expecting. 57 57 00:02:05,880 --> 00:02:07,990 If I was using telnet to connect to a router, 58 58 00:02:07,990 --> 00:02:11,040 I can assign network ports, set up LAN IP addresses, 59 59 00:02:11,040 --> 00:02:13,740 reset the web graphical user interface password, 60 60 00:02:13,740 --> 00:02:16,820 reset the system to its factory defaults, reboot the system, 61 61 00:02:16,820 --> 00:02:17,900 or ping a host, 62 62 00:02:17,900 --> 00:02:21,200 all from within a text-based interactive telnet session. 63 63 00:02:21,200 --> 00:02:25,550 Next, we have tcpdump, tcpdump is a command line tool 64 64 00:02:25,550 --> 00:02:28,550 that allows a network technician to display TCP/IP 65 65 00:02:28,550 --> 00:02:30,540 and other packets that are being transmitted 66 66 00:02:30,540 --> 00:02:33,450 or received over a network to the client screen. 67 67 00:02:33,450 --> 00:02:37,280 Now, tcpdump is not included on windows clients by default, 68 68 00:02:37,280 --> 00:02:39,840 but it is installed by default on Linux, 69 69 00:02:39,840 --> 00:02:41,690 Unix and OSX systems. 70 70 00:02:41,690 --> 00:02:42,960 If you want to use it on windows, 71 71 00:02:42,960 --> 00:02:45,080 you'll have to actually download and install it. 72 72 00:02:45,080 --> 00:02:47,750 Now, tcpdump is used to simply dump the traffic 73 73 00:02:47,750 --> 00:02:49,410 from a network onto the screen, 74 74 00:02:49,410 --> 00:02:51,460 but this can also be redirected to a file, 75 75 00:02:51,460 --> 00:02:53,680 so you can store it and analyze it later on 76 76 00:02:53,680 --> 00:02:56,600 using the tcpdump-w option. 77 77 00:02:56,600 --> 00:02:58,750 This will create a file known as a PCAP file 78 78 00:02:58,750 --> 00:03:00,530 or Packet Capture file. 79 79 00:03:00,530 --> 00:03:03,510 When you use tcpdump, you can see the same standard format 80 80 00:03:03,510 --> 00:03:06,690 used for every single packet, this includes a timestamp, 81 81 00:03:06,690 --> 00:03:10,900 whether the packet is IPV4 notated by IP in the tcpdump, 82 82 00:03:10,900 --> 00:03:14,940 or IPV6 notated by IP6 in the tcpdump, 83 83 00:03:14,940 --> 00:03:18,080 the source IP import, the destination IP import, 84 84 00:03:18,080 --> 00:03:20,430 what flags were used in that TCP packet, 85 85 00:03:20,430 --> 00:03:22,750 the sequence number, the acknowledgement number, 86 86 00:03:22,750 --> 00:03:25,260 the windowing number and the length of the packet. 87 87 00:03:25,260 --> 00:03:27,430 If any of these options are set in the packet, 88 88 00:03:27,430 --> 00:03:29,270 it's going to be shown between the windowing number 89 89 00:03:29,270 --> 00:03:30,660 and the packet length. 90 90 00:03:30,660 --> 00:03:33,100 If you create a PCAP file using tcpdump, 91 91 00:03:33,100 --> 00:03:35,480 it can later be loaded into a more graphical tool 92 92 00:03:35,480 --> 00:03:38,170 like Wireshark, where you can do more analysis on it. 93 93 00:03:38,170 --> 00:03:40,860 Or you can reload it back into tcpdump 94 94 00:03:40,860 --> 00:03:43,340 and analyze it in this text-based tool. 95 95 00:03:43,340 --> 00:03:46,280 Finally, we have nmap then Network Mapper. 96 96 00:03:46,280 --> 00:03:48,310 Nmap is used to discover hosts and services 97 97 00:03:48,310 --> 00:03:50,320 on a computer network by sending packets 98 98 00:03:50,320 --> 00:03:52,590 and analyzing the responses it receives. 99 99 00:03:52,590 --> 00:03:54,360 Now, nmap provides a number of features 100 100 00:03:54,360 --> 00:03:56,930 for probing computer networks, including host discovery 101 101 00:03:56,930 --> 00:03:58,830 and service and operating system detection. 102 102 00:03:58,830 --> 00:04:01,780 Nmap is a great tool to use when you're conducting 103 103 00:04:01,780 --> 00:04:04,190 both port scanning or IP scanning. 104 104 00:04:04,190 --> 00:04:06,970 Now in addition to this, nmap can be configured to conduct 105 105 00:04:06,970 --> 00:04:09,570 fingerprinting of the services running on those ports, 106 106 00:04:09,570 --> 00:04:11,240 which allows it to identify the versions 107 107 00:04:11,240 --> 00:04:13,000 of the software being used. 108 108 00:04:13,000 --> 00:04:15,310 This is really helpful in detecting vulnerabilities 109 109 00:04:15,310 --> 00:04:17,010 and specific versions of services 110 110 00:04:17,010 --> 00:04:18,780 that are operating on your network. 111 111 00:04:18,780 --> 00:04:21,270 Also, nmap is very useful when trying to create 112 112 00:04:21,270 --> 00:04:23,240 network maps, documenting your network, 113 113 00:04:23,240 --> 00:04:25,833 or identification of road network devices.