background preloader

A tcpdump Primer

A tcpdump Primer
Image from securitywizardry.com tcpdump is the premier network analysis tool for information security professionals. Having a solid grasp of this über-powerful application is mandatory for anyone desiring a thorough understanding of TCP/IP. In a discipline so dependent on a true understanding of concepts vs. rote learning, it's important to stay fluent in the underlying mechanics of the TCP/IP suite. When using a tool that displays network traffic a more natural (raw) way the burden of analysis is placed directly on the human rather than the application. 15:31:34.079416 IP (tos 0x0, ttl 64, id 20244, offset 0, flags [DF], proto: TCP (6), length: 60) source.35970 > dest.80: S, cksum 0x0ac1 (correct), 2647022145:2647022145(0) win 5840 0x0000: 4500 003c 4f14 4000 4006 7417 0afb 0257 E.. 0x0010: 4815 222a 8c82 0050 9dc6 5a41 0000 0000 H Options Below are a few options (with examples) that will help you greatly when working with the tool. Basic Usage Common Syntax Writing to a File More Examples

FrameIP, A site for IP specialists - TcpIp - Voip - Vpn - IPv4 - IPv6 InetDaemon.Com 50+ Open Source Performance Testing Tools | Words From a Purple Mind Performance testing is a general term used to describe testing activities where a simulated user load is directed at a system and measurements are gathered. It is designed to meet or exceed a set of system performance goals while maintaining a particular user load profile. It places variable load – from a minimum to a maximum – on the system. The variable load demonstrates what the system can sustain without running out of resource or having transactions perform in a less-than-optimal fashion. Performance testing is a suite of testing that can consists of, but is not limited to, Benchmark Testing, Load Testing, Durability Testing, Volume Testing, Stress Testing, and Scalability Testing. In some cases a separate Performance Test Plan will be created to explain the details of the Performance Testing effort. NOTE: Transactions above refer to “logical business transactions.” Below are some open source/free tools that can help you with performance testing the application under test (AUT).

TCP Tune System Specific Notes for System Administrators (and Privileged Users) These notes are intended to help users and system administrators maximize TCP/IP performance on their computer systems. They summarize all of the end-system (computer system) network tuning issues including a tutorial on TCP tuning, easy configuration checks for non-experts, and a repository of operating system specific instructions for getting the best possible network performance on these platforms This material is currently under active revision. Introduction Today, the majority of university users have physical network connections that are at least 100 megabits per second all the way through the Internet to every important data center in the world (as well as to every other university user). To put these data rates into perspective, consider this: 100 Mb/s is more than 10 megabytes in one second, or 600 megabytes (an entire CD-R image) in one minute. Note that today most TCP implementations are pretty good. Buffers

DNS for Rocket Scientists - Contents This Open Source Guide is about DNS and (mostly) BIND 9.x on Linux (Fedora Core), BSD's (FreeBSD, OpenBSD and NetBSD) and Windows (Windows 7 and 10). It is meant for newbies, Rocket Scientist wannabees and anyone in between. This Guide was born out of our first attempts a number of years ago at trying to install a much needed DNS service on an early Redhat Linux system. We completed the DNS 'rite of passage' and found it a pretty unedifying and pointless experience. Health Warning: This is still a work-in-progress. <gratuitous publicity> The newly published book Pro DNS and BIND was largely based on this material but significantly extends it - including DNS security (including DNSSEC.bis), IPv6, DNS APIs and complete reference sections on named.conf and RR types. What's new in Guide version 0.1.46 1. 2. 3. 4. 5. 6. 7. 8. Chapter 9 DNS HowTos Chapter 10 Diagnostics and Tools Chapter 11 Trouble and Error Messages Work in progress Chapter 12 BIND APIs Chapter 13 DNS Security

Top 10 Wireshark Filters (by Chris Greer) Author Profile - Chris Greer is a Network Analyst for Packet Pioneer. Chris has many years of experience in analyzing and troubleshooting networks. He regularly assists companies in tracking down the source of network and application performance problems using a variety of protocol analysis and monitoring tools including Wireshark. When he isn’t hunting down problems at the packet level, he can be found teaching various analysis workshops at Interop and other industry trade shows. The filtering capabilities of Wireshark are very comprehensive. 1. ip.addr == 10.0.0.1 [Sets a filter for any packet with 10.0.0.1, as either the source or dest] 2. ip.addr==10.0.0.1 && ip.addr==10.0.0.2 [sets a conversation filter between the two defined IP addresses] 3. http or dns [sets a filter to display all http and dns] 4. tcp.port==4000 [sets a filter for any TCP packet with 4000 as a source or dest port] 5. tcp.flags.reset==1 [displays all TCP resets] 6. http.request [displays all HTTP GET requests] 8. !

3 way handshake, TCP Three-way handshake, TCP Synchronization In this lesson, you will learn how two TCP devices synchronize using three way handshake (3 way handshake) and what are the three steps of a TCP three way handshake and how two TCP devices synchronize. Before the sending device and the receiving device start the exchange of data, both devices need to be synchronized. During the TCP initialization process, the sending device and the receiving device exchange a few control packets for synchronization purposes. The three-way handshake begins with the initiator sending a TCP segment with the SYN control bit flag set. TCP allows one side to establish a connection. TCP identifies two types of OPEN calls: Active Open. Passive Open A passive OPEN can specify that the device (server process) is waiting for an active OPEN from a specific client. TCP Three-way Handshake Step 1. Step 2. Step 3. This handshaking technique is referred to as the Three-way handshake or SYN, SYN-ACK, ACK.

markofu/pcaps PCAP files from the US National CyberWatch Mid-Atlantic Collegiate Cyber Defense Competition (MACCDC) The U.S. National CyberWatch Mid-Atlantic Collegiate Cyber Defense Competition (MACCDC) is a unique experience for college and university students to test their cybersecurity knowledge and skills in a competitive environment. The MACCDC takes great pride in being one of the premier events of this type in the United States. While similar to other cyber defense competitions in many aspects, the MA CCDC, as part of the National CCDC, is unique in that it focuses on the operational aspects of managing and protecting an existing network infrastructure. MACCDC official website:

SampleCaptures Sample Captures So you're at home tonight, having just installed Wireshark. You want to take the program for a test drive. But your home LAN doesn't have any interesting or exotic packets on it? Here's some goodies to try. If you don't see what you want here, that doesn't mean you're out of luck; look at some of the other sources listed below, such as How to add a new Capture File If you want to include a new example capture file, you should attach it to this page (click 'attachments' in header above). Please don't just attach your capture file to the page without putting an attachment link in the page, in the format attachment:filename.ext; if you don't put an attachment link in the page, it's not obvious that the capture file is available. It's also a very good idea to put links on the related protocol pages pointing to your file. Other Sources of Capture Files If you don't find what you're looking for, you may also try: General / Unsorted

Packet Captures Showing 1 - 25 of 166 nf9-juniper-vmx.pcapng.cap 912 bytes Submitted Dec 10, 2016 by Jb93 Juniper vMX NetFlow. arp_pcap.pcapng.cap 2.2 KB Submitted Mar 11, 2016 by Ashay ARP Request reply packet captures STP-TCN-TCAck.pcapng.cap 692 bytes Submitted Mar 11, 2016 by sahil_pujani Spanning Tree 8021.D Topology Change Notification and Topology Change Ack. Packet 4: aa:bb:cc:00:02:00 generates TCN because of Link failure Packet 5: aa:bb:cc:00:01:00 is the Root Bridge and it generates TCAck. bgplu.cap 2.1 KB Submitted Jan 24, 2016 by mxiao BGP Labeled Unicast SNMPv3.cap 1.3 KB Submitted Oct 7, 2015 by nra This is a SNMPv3 (IPv4) Captures.Where SNMP manager is requesting to SNMP agent using SNMPv3. SNMP Manager: 192.168.29.58 SNMP agent: 192.168.29.160 SNMP ver: 3 Level: AuthPriv Authentication: MD5 Encryption: AES 128 Regards Suman S lispmn_IPv6-RLOC.pcapng.cap 5.9 KB Submitted Sep 18, 2015 by krunal_shah LISP control (map register,request and reply )and Data packets with IPv6 as RLOC and IPv4 as EID. ESP IPv6

WLAN Book

Related: