44 Scanning and Enumeration – Sniffing Basics
Dante Rocca
Sniffing is an important task for any hacker or network administrator. It allows one to see the traffic going across the network and pick out important details such as active machines, IP and MAC addresses, and sometimes even passwords if unencrypted traffic is being sent.
Learning Objectives
- Learn the basics of Wireshark filtering
Prerequisites
Deliverables
- Screenshot of Wireshark filtered to only TCP and FTP
- Screenshot of tcpdump capture on the command line
Resources
- “Lab 51 – Packet Capture with tcpdump” – https://www.101labs.net/comptia-security/lab-51-packet-capture-with-tcpdump/
- comparitech – tcpdump Cheat Sheet – https://cdn.comparitech.com/wp-content/uploads/2019/06/tcpdump-cheat-sheet-1.jpg.webp
Contributors and Testers
- Mathew J. Heath Van Horn, PhD
- Jacob M. Christensen, Cybersecurity Student, ERAU-Prescott
Phase I – Generating Traffic to be seen on WireShark
To begin the lab we’ll use Wireshark, which learners should already be familiar with. After generating some traffic, we’ll show how to use some basic filters.
- Open a Wireshark capture between the router and the switch on the network containing the Metasploitable VM
NOTE: Keep Wireshark running in the background. This section is all about generating interesting network traffic to examine later.
- Navigate to the Kali Linux VM
- Open the terminal and check its IP address
NOTE: In this example, our Kali IP address is <IP_ADDRESS>.
> ip address show
- Perform an Nmap scan on the <IP_ADDRESS>/24 network
> nmap <IP_ADDRESS>/24
- In our example, we can see that our Metasploitable3-linux machine has an IP address of <IP_ADDRESS> and has FTP running on port 21
- Connect to the FTP service running on the Metasploitable VM
> telnet <IP_ADDRESS> 21
- In the telnet terminal, log into the FTP server
user vagrant
pass vagrant
- Exit the FTP session
quit
- Open Firefox and go to the following URL:
http://<IP_ADDRESS>/
- You can see that there are four web pages you can click on: Three folders and a Hypertext Pre-processor (PHP) file
- Click around on some of the various tabs on the webpage to generate traffic, then close the browser
- Open the terminal and check its IP address
Phase II – View traffic on wireshark and practice using filters
If you have ever observed Wireshark packet capture on a live connection you can be easily overwhelmed by the thousands of data packets. In this book, we generally use a ‘closed’ system so you may have only seen the packets of the tools we are using at the time. To separate the weeds from the wheat in a live environment, we need to learn to use filters. The most common filter on Wireshark is the display filter. We can use a combination of expressions and logical operators to filter which packets appear to us. The following are just some examples so you can gain practice using various display filters.
| Command | Meaning |
| != | Not equal |
| == | Equal |
| || | OR |
| && | AND |
Don’t worry