title: S2E5 - analysing packets |
author: Nicholas Morrison nick@nanocat.net |
draft: false |
tags: [network, workshop] |
categories: [workshop] |
noindex: true |
Connect to the lab server:
Connect to your router:
ip netns list
or
ip netns list | grep pcX
)eth0
interface (because eth0
is connected to the Internet)
ip netns exec NAMESPACE tcpdump -i eth0 -s 1500 -c 5000 -w YOUR_PERSONAL_FILENAME.pcap
In another terminal, while the tcpdump is running, do each of the following:
ping -c 10 www.idsoftware.com
traceroute -w 1 -n nanocat.net
traceroute -w 1 nanocat.net
wget http://insecure.nanocat.net/files/snarf.txt
wget https://nanocat.net/files/snarf.txt
wget ftp://ftp.uni-bayreuth.de/debian/README.CD-manufacture
Back at your tcpdump terminal:
ctrl-c
the tcpdump, if it has not already exited
(remember we set a limit of 5000 packets)ls -l YOUR_PERSONAL_FILENAME.pcap
(or
ls -l *.pcap
if you can’t remember)scp lab@netlab.nanocat.net:YOUR_PERSONAL_FILENAME.pcap .
ip.host == 1.1.1.1
or
ip.dst == 1.1.1.1
or ip.src == 1.1.1.1
tcp.port == 80
for http,
tcp.port == 443
for https,
tcp.port == 21 || tcp.port == 20
for FTP