-: Telnet, tcpdump and nmap. 2 2
In this video, we're going to cover the telnet, 3 3
tcpdump and nmap tools and how we use them in maintaining 4 4
and troubleshooting our networks. 5 5
First, we have the telnet command. 6 6
Telnet is both a command and a network protocol. 7 7
The telnet command is going to be used to communicate 8 8
using an application protocol over the internet 9 9
or a local area network 10 10
to provide a bidirectional interactive text 11 11
oriented communication facility 12 12
using virtual terminal connections. 13 13
Now, telnet is used to be built into windows, 14 14
Linux, Unix and OSX systems by default. 15 15
Telnet is capable of allowing a user 16 16
to test the network connectivity 17 17
between a client and a server, 18 18
as well as issue commands using text-based interfaces. 19 19
Normally, you're not going to want to use telnet 20 20
because it's an older and insecure protocol. 21 21
Instead, you should be using SSH. 22 22
But as a network technician, there's still one use case 23 23
where relying on telnet could be considered acceptable. 24 24
And that's when you're connected directly to a router 25 25
or switch over a console cable connection 26 26
because you're then have a trusted and direct connection 27 27
to that device. 28 28
Because of the insecure nature of telnet in general, 29 29
it's actually been disabled by default in Windows 10. 30 30
If you want to re-enable it, 31 31
you can enter the command 32 32
Deism/Online/Enable-feature/FeatureName:TelnetClient 33 33
and then it's going to re-install this feature. 34 34
OSX has also removed telnet in recent versions too, 35 35
but most Linux and Unix systems 36 36
still have telnet installed by default. 37 37
If you want to quickly test a network connection using telnet, 38 38
you can enter Telnet, domain name and port and hit enter 39 39
to connect to that device. 40 40
For example, I might enter telnetdeontraining.com80 41 41
and hit enter. 42 42
Then, you're going to see the word connecting 43 43
flash across your screen 44 44
and then you'll be receiving a black terminal window 45 45
with a blinking cursor. 46 46
At this terminal, you can hit enter a few times 47 47
or conduct a banner grab technique, 48 48
which is using cybersecurity to get information directly 49 49
to that web server and get it to responses back 50 50
and then you can identify 51 51
what type of software they're using. 52 52
In this case, you can see that my web server 53 53
is running open rusty, 54 54
and it's a web server software here. 55 55
And then the connection was terminated by my web server, 56 56
because it didn't get the commands it was expecting. 57 57
If I was using telnet to connect to a router, 58 58
I can assign network ports, set up LAN IP addresses, 59 59
reset the web graphical user interface password, 60 60
reset the system to its factory defaults, reboot the system, 61 61
or ping a host, 62 62
all from within a text-based interactive telnet session. 63 63
Next, we have tcpdump, tcpdump is a command line tool 64 64
that allows a network technician to display TCP/IP 65 65
and other packets that are being transmitted 66 66
or received over a network to the client screen. 67 67
Now, tcpdump is not included on windows clients by default, 68 68
but it is installed by default on Linux, 69 69
Unix and OSX systems. 70 70
If you want to use it on windows, 71 71
you'll have to actually download and install it. 72 72
Now, tcpdump is used to simply dump the traffic 73 73
from a network onto the screen, 74 74
but this can also be redirected to a file, 75 75
so you can store it and analyze it later on 76 76
using the tcpdump-w option. 77 77
This will create a file known as a PCAP file 78 78
or Packet Capture file. 79 79
When you use tcpdump, you can see the same standard format 80 80
used for every single packet, this includes a timestamp, 81 81
whether the packet is IPV4 notated by IP in the tcpdump, 82 82
or IPV6 notated by IP6 in the tcpdump, 83 83
the source IP import, the destination IP import, 84 84
what flags were used in that TCP packet, 85 85
the sequence number, the acknowledgement number, 86 86
the windowing number and the length of the packet. 87 87
If any of these options are set in the packet, 88 88
it's going to be shown between the windowing number 89 89
and the packet length. 90 90
If you create a PCAP file using tcpdump, 91 91
it can later be loaded into a more graphical tool 92 92
like Wireshark, where you can do more analysis on it. 93 93
Or you can reload it back into tcpdump 94 94
and analyze it in this text-based tool. 95 95
Finally, we have nmap then Network Mapper. 96 96
Nmap is used to discover hosts and services 97 97
on a computer network by sending packets 98 98
and analyzing the responses it receives. 99 99
Now, nmap provides a number of features 100 100
for probing computer networks, including host discovery 101 101
and service and operating system detection. 102 102
Nmap is a great tool to use when you're conducting 103 103
both port scanning or IP scanning. 104 104
Now in addition to this, nmap can be configured to conduct 105 105
fingerprinting of the services running on those ports, 106 106
which allows it to identify the versions 107 107
of the software being used. 108 108
This is really helpful in detecting vulnerabilities 109 109
and specific versions of services 110 110
that are operating on your network. 111 111
Also, nmap is very useful when trying to create 112 112
network maps, documenting your network, 113 113
or identification of road network devices.