Concepts of TCP/IP

0:00[AUDIO LOGO] First officer's log. Star date, something with numbers. I wonder what it is we could actually start getting into here in this next course. It's time for you to get into the packet and see what the user is actually doing. But I don't think that-- Do it. Do it. Well, OK, if you insist. Welcome back as we dive into another course here together. I've missed you.

0:31And in this course, we're actually going to start looking at the actual data in the packets going across the wire between point A and point B. And we're talking about looking at the actual binary, hex, and all that other stuff. But fret ye not, fellow learner. We're actually going to break this down in such a way to where we don't have to really memorize a lot of hex and binary. We just want to get familiar with what's actually going on and so we can actually go in and take a look at the packet as it's broken down in programs like Wireshark, tcpdump, and whatever other programs that we use to be able to go in and analyze this traffic.

1:06Now, there are many different reasons. And we'll be going throughout this entire course, talking about why we'd want to do something like this. Part number one is we want to make sure that whatever it is that we're doing is in line with the security policy of the organization. So let's say we're trying to analyze why a firewall rule was put into place and it wasn't executed correctly. Somebody was able to get past it. Somebody was able to get around whatever the protocols were to block said traffic. Well, that's where network monitoring and going into wire analysis helps us in analyzing that kind of information, because if we're taking a look at the actual packet, we might find something that's inside of it.

1:48Maybe it's data that's wrapped around or wrapped in something else that it's not supposed to be. Let's say we're passing normal traffic to a website, but it's wrapped inside of a DNS packet and made to look like a DNS query. Now, we'll figure out later on how to actually start going in and do some of this. But that's kind of some of the stuff that we are looking forward to in this entire course. And for those playing at home, I actually did fix the lighting. I wanted to start off with the original and let you all know that I am taking key notes of your comments.

2:18And I appreciate that. Keep them coming. Let me know what content you want to see and what we need to cover as far as the cybersecurity and getting into the pen testing realm that we need to get into. I just want you to know that I really appreciate each and every one of you out there, along with the other courses here on CBT Nuggets. Without what we have here across the entire spectrum of CBT Nuggets, courses like this would be kind of not making a lot of sense. And that's why I also want to push out in this one, before we get started with the entire course, that there are many other programs and courses and certification tests here on CBT Nuggets that will help us out throughout the entirety of this course.

2:57So if for a moment, let's say, we need to understand a little bit more of the OSI model, get a little familiar with basic networking and some of the ideas that are going along with security overall, take a pause. Go look at some of the other courses. And meet me back over here because I'm not going anywhere. I'm here waiting for you. And it's completely OK because I too go across all the different courses here on CBT Nuggets to try to better myself. And it's really helped out a lot. So thank you to all the trainers as well and those behind the scenes at CBT Nuggets. [LIPS SMACKING] Now, in the grand scheme of things, this course right here is part 3 of our ongoing cybersecurity and pen testing slash hacking slash staying within the law series that we've been doing here together.

3:38And at first, we learned how to do security practices because we want to make sure everything's secure. The second course we did, which was pen testing and hacking and making sure that we understood the tools, was to test out those security controls. And in this course, we're going to be diving deeper into how we test out those security protocols because remember, we can't really implement security unless we know what it is that breaks that security to better defend against it. Now, throughout this skill right here, we're going to be taking a look at the overall picture of TCP/IP and getting more familiar and more acquainted with it, to make sure that we understand later on, when we start looking at raw packets, how it plays a bigger part in network and cybersecurity.

4:19We're going to be going over the different parts of TCP/IP because it's not just TCP. There's also its lesser known sibling, UDP, because we've moved away from UDP packets. But they still exist in critical environments. Then we're going to start taking a look at where we actually get these packets from and what it is that we're using to analyze them. Now, some of these tools may be familiar from our previous courses. But if you're new here, strap in, fire up those virtual machines, and get ready because this course is primarily going to be on our Kali virtual machine.

4:50I definitely encourage you to go back and take a look at some of the other courses that we've done here covering virtual machine, VirtualBox, and also how to use some of those virtual machines in a very basic setting because throughout this course, we'll definitely be using it, as we don't want to brick this system right here. That's where we do all of our recording at. But then we're going to be wrapping this skill up with binary and hex and actually going through and taking a look at what some of these packets actually look like and understanding that there is a rhyme and a reason to why things go across the wire the way they do.

5:22Now, diving straight into it, after our grand intro that we just did-- and welcome back, everybody-- that we need to understand that packets don't actually go over the wire in ASCII or letters. That's something that we as humans need to identify with because we understand our language as it is in front of us. How data actually transfers from one place to another is ones and zeros. And those ones and zeros in their different forms basically all come together and give us a rhythmic pattern, mathematically, which we won't dive too deep into, to tell us this is what it actually means.

6:00So if you're a fan of Futurama, I highly encourage, definitely go back and check out some of the ones where they make fun of binary, especially when a two pops up out of nowhere, because all those numbers are actually real. And they do equal out to actual words. Now, it may come as a shock to you, as I have here on the screen, a packet. And this is something that was pulled from Wireshark, which we'll be diving into later on in this course. But the first example that I have here on the screen is a packet dump-- one individual packet that was dumped out in hex format by default values inside of Wireshark.

6:33Now, it may surprise you here in this next one that this is the exact same packet in hex, except we lose all the spacing and the line numbers at the beginning of the format. And again, this is the same packet in a different type of hex value. And this right here is the same packet in binary. Now, all this translates to a packet that is understandable by computer systems across the network. We rely on our IDS and IPS, or Intrusion Detection or Intrusion Protection Systems, whether they be host based or network based, to be able to read this kind of traffic right here in a real-time environment, to make sure that we are actively and properly defending or implementing rules based on whatever the policy is for our organization.

7:20Now, I know that's a lot to take in. But don't worry. We're going to be walking through this step by step as we go out through the entirety of this course. And we're going to do it one skill at a time. So join me. Grab your VMs. Make sure they're still fired up, like we mentioned while ago. And let's do it to it.

0:01[AUDIO LOGO] TCP/IP is only one part of the network packet when we take a look at what's actually going on across the wire, and that's because when we put all the pieces of the puzzle together, TCP/IP is the overall storyline, if you will, of what's actually going on inside of a packet that we capture and analyze for whatever reason we need to analyze it for. Think of this like a box within a box. Well, IP packets or actual data packets that go across the wire because they may not be IP as we'll find out later on.

0:37All packets start off in a big, old box, and then inside of that box is another box that has the actual, let's say, the idea of what's actually going on. So the outside box is the overall data itself going from point A to point B, and the second box inside starts to tell us more of what's actually going on. Well, the more boxes we go in-- what are those little Russian dolls that always open up and stuff like that? James would know. Definitely check out some of his Nuggets. But if we start taking a look at some of those inside boxes, the more deeper we go, the more information we get about what's actually inside that payload of the overall box itself because looking at the box on the outside just says, it's a box.

1:20And if we only go one deep, well, it's only one box. Now, it's two, and we don't really know that much. That's why we have to go in as much as possible. Now, before going too far deep into this course overall, you may notice that there is some supplemental material attached to this skill that we'll be using throughout the course, and I will try to remember to attach it to whatever skills in the future where we heavily rely on this documentation. But just in case, here in this skill, there will be a zip file that contains a PDF that I built when I was originally going through this course and learning about it myself.

1:53And you'll notice that there's a lot of different types of packet headers and translation tables going from hex to binary, to decimal, et cetera, et cetera. And we'll be going through those one by one as we go out through this entire course together. So don't be overwhelmed by it. Just know that it's here for you if you need it and want to use it whenever you're studying if there were an exam for this course overall. Now, let's get straight to it. TCP/IP is the Transmission Control Protocol and slash Internet Protocol.

2:26That is what is packaging everything inside of that second or third box that we were taking a look at. We're going to take a look at a demonstration packet here in a second and understand that TCP/IP is not actually the outer box. It's more of like the second or third one. The actual overall box itself is the entire data packet that we've captured for analysis. And then once we start digging in, we'll notice that it's more familiar in that TCP/IP setup. But let's take a look at the models and how they represent to each other from OSI to IPv4 to IPv6.

3:00And the reason we're doing this is, is because as prevalent as IPv6 is starting to get on the internet overall, we need to be familiar with that one as well, too, because that is under that TCP/IP protocol series. Now, looking at our models here, we can see where we go with as far as what's our physical, what's our actual network, transport, and application level because we can see that layers 5, 6, and 7 on the OSI model translate to applications on TCP/IP and what's actually happening on the series.

3:33Now, for TCP/IP, this is for IPv4 and IPv6. Please keep that in mind. Now, transport is the same all the way across, and we're talking about the actual segments. So this would be what we can call the payload of the actual data packet that we're capturing. So think of like the last tail end of what's actually going on here. What we're actually getting is the data that's being sent back and forth and not just to and from addressing. That's actually what we see in layer 3 of what's going on of the OSI model and the internet layer of TCP/IP.

4:10This is where we're going to be getting the to and from, source or destination IP addresses, whether they be IPv4 or IPv6, and also the ports that are being used. So if it's TCP, it'll be TCP port, whatever, on the destination and sourced out of whatever on our end. Same for UDP. And we'll see a little bit of discrepancies but the same idea when we get into stuff like ICMP and whatnot. And then layer 2 is our data link. And you'll notice on here that data link and physical are the same color and because under TCP/IP model, we have network access.

4:45This is our physical how are we hooking up stuff. And looking in the actual packet itself, when we see it here in a second, this is the out-of-the-box of what's actually going on. Now, I know what you're thinking. Where's this example that we're going to have? So here it is on screen. Now, this is a snippet out of Wireshark, and what we're taking a look at is how the Wireshark takes a look at some of these packets. We'll be getting deeper into Wireshark in a little bit. But on the outermost shell of a packet that we get, we have the frame, and this is going to tell us just some of the very basic stuff that's actually going on inside of that packet itself.

5:21So how big is it? What was the actual payload overall? And it'll tell us what interface ID that it came on as far as how it was captured. If we're doing this as a local capture, we're going to see that maybe this was picked up over Ethernet 0 as a default. Let's say, inside of our Kali VM. That's fine. But what we're taking a look for is, what's the overall size of the frame overall? So this could vary in size based on the type of protocol and versioning that's being used for this actual packet.

5:53Now, the next box inside of the frame is Ethernet II. And going back to our OSI reference model previously earlier in this video, you'll see that this kind of lines up with layer 2 of the OSI model and layer 1 of TCP/IP. This is where we're getting our information as far as MAC address, something physical. What's the actual physical address of the device that's sending and receiving this packet? So think of this as to and from addressing on the frame overall itself and maybe a packaging label on the inside box of something that we're sending through the mail.

6:31Now, there's a box inside of that one, too, and that is the IP version. This is where we start getting into layer 3 on the OSI model and internet layer on the actual TCP/IP model. The networking portion of this for IP version tells us what IP addresses we're sending this to and from. So we're past that physical layer of MAC addresses and something on the local network, and we're actually having to go out and reach out and touch somebody that's not on our local network. Think of it like this. If it has to go past your gateway that's local there to be able to go out and reach something else, let's say, like the Google, then it's going to utilize layer 3 of the OSI model to be able to get to where it's going and the internet layer of the TCP/IP model.

7:14Now, if you're playing along at home-- and we'll go back to this in a second. This is byte offset 0, and I'll get to cover this here in just a second. The box inside of that one is our IP protocol, and that is byte offset 9, and this is where we start getting into figuring out whether it's TCP, UDP, ICMP, or et cetera, et cetera. And this is layer 4 on this transport layer for OSI and TCP/IP. This is where we start getting into what it is exactly that we're expecting inside of the box inside of this one because again, this is a box within a box-type stuff here, and each layer that we pull off gives us more information of what's actually inside of the actual payload.

7:57And then we have the actual payload itself, which is byte offset 32. And again, we'll come back in a second. And the payload is where we actually start getting the data. So as an example, let's say that the packet that we're looking at here on the screen, and this was the example in the previous video when we were doing the hex dumps and everything, this is a packet that I just pulled off of Wireshark to run it real quick to get our hex dump, and we have in our frame that the packet is 95 bytes. Our Ethernet II source is the VMware VM MAC address of the actual VM itself.

8:32The IP protocol version that we're having here is version 6. So you can see, we're starting to go up the layers in the OSI model. And then this one was a UDP protocol. And so the payload on this will be the next part, which is the Multicast Domain Name system. And what that means is, is that the UDP protocol is identifying that it's sending out a payload that's aligned to the actual Multicast DNS.

9:03And so it's sensing out on the network what exactly is my name and what are other names on the network. Who else is out there that I can be friends with? Now, if you're looking at the supplemental material that we put up in this skill that we're going to be using throughout the entirety of this course, the first one we're taking a look at here is page 2, and this is the IPv4 header. And this is where I was mentioning a while ago the offset bytes and stuff like that because up until now, it probably didn't make any sense, and that's OK. So when we go and compare this to our OSI model, our TCP/IP model for layers and whatnot, that's where all this starts really coming together when we analyze a packet in this course.

9:44The frame is the overall what you see here on page 2 for the IPv4 header. Now, we're picking on IPv4, and I'll show you IPv6 in a second. It's not too far different. The Ethernet II frame, which is the second box inside, is going to be our version and our first half of byte offset 0. So it's going to tell us really what kind of IP are we expected to get. In the next box is our IP version, which is the second half of byte offset 0, and it tells us, are we using IPv4 or IPv6?

10:19And then we have our IP protocol, which, if you look on the next line in orange byte offset 9, it says protocol 8-bit. And I have on here also key guides to let us know what it is that we're using. And if you're really starting to put the pieces together, the hex is actually answered in the keys that I have below. Then in the packet example that we had previously, we're using UDP. So in this IP protocol byte offset 9 area, you would actually see in hex 0x11, which gives us UDP.

10:53And so in that packet, you would start to see somewhere in there. I'll let you look at home, but you'll start to see where 0x11 translated to actual hex itself. And this is stuff we'll get into in a little bit in the course, but you can break down where it's actually turning into hex. So just to hint hint, it's probably 14 echo 9 if you're looking back at the earlier packet. Now, the actual payload starts at byte offset 32. That is line 5, where it says data variable. And the reason that is, is because data can be whatever size it needs to be.

11:28We're not going to send an entire meg in this one frame. We're going to break it down into chunks. And so because we use TCP/IP, let's say, we're using a TCP packet, we're going to have sequence numbers, acknowledgment numbers. And if it's UDP, it's going to be fixed size packets that go. And if they make it, they make it. If they don't, they don't. But definitely take a look at what's actually going on inside of the supplemental files real quick on the side and start taking a look at how the layers line up between OSI and TCP/IP and what's happening in real time because as we start to put this together throughout the course, we'll see that as we get a packet, more and more of this starts to make sense.

12:09Now, in the next Nugget, we're going to start diving into the different parts of TCP/IP. Now, don't worry. We're not really getting too deep in the weeds just yet. We're doing more of an introduction into the course itself and what is to come and to be expected as we start digging through this. So let's get familiar with some of the terminology. Let's get familiar with some of the supplemental files that we have together because we're going to do this together from beginning to end, and I'll be there with you every step of the way. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] So we have our basic understanding of TCP/IP down. Let's move into different aspects of how it's used inside of the network packet. Now, for that, we're going to be putting the cart ahead of the horse, if you will, just a little bit, and we're going to be going into our VM here momentarily, and looking at how some of these packets are actually broken down and the type of information that we can get from it. We're still going through that familiarization phase of getting everything down as far as where we go, what we do.

0:32And as we move forward through these Nuggets and skills, we'll start getting more in-depth on how to analyze and retrieve everything. Now, as you can see here, we started a packet capture on Wireshark, and we're just doing some basic stuff. I'm going to crank up Firefox here for a second, get a little bit of more traffic going across the wire, so we can get more than just the Multicast DNS going on. And then give me just a second. We'll take a stop real quick, and we'll examine some of the packets that we have and what they actually look like in raw format as well.

1:02And just like that, we actually have some packets on here that are more in the variety of what you would commonly see on a network packet capture. And one we have highlighted right here is a TCP packet. Now, looking at it from start to finish, we're taking a look at the frame overall, which is the packet itself, and going down to Ethernet, seeing that it came from the actual NIC that was on here. So we're talking about the physical layer still. And then as we go into IP protocol version, that's how we were communicating.

1:34Now, this one was done over IPv4. And if we go down even deeper, we can see that this was a TCP protocol. And we can dig deeper into that as well and figure out what exactly it was that we were looking at. Now, I have zoomed in here the actual TCP protocol section of that one individual packet. And as you can see on the bottom-left side, we're looking at the actual destination port. So this was going to an HTTP system. So we're looking at, supposedly, a web server.

2:06And on the right side of it, let me move over a little bit. You can see my OBS also maybe. But you can see that highlighted is 0050, and that's the hex translated over from the actual normalized output. So this is the raw packet itself, and that section highlighted right there in that offset is the actual protocol and port number that's actually being used in this packet. Now, inside of the actual terminal itself, let me zoom in here for us real quick, what we're taking a look at is actual traffic as it's going through tcpdump.

2:41Now, we can export this to a PCAP file or something similar and import it into Wireshark, which we'll do later. But I'm going to do a stop here real quick, so we can actually take a look at some of the headers and get an idea of what's actually going on here. Now, this particular packet that I have highlighted here-- makes sure it's in frame shot-- is the actual headline of what's going on and not the actual packet itself. We can do more specific extracting of data packets using tcpdump later on, but the command that I use for this was simply sudo space tcpdump.

3:14And I'll have that below here so that way, we can keep track of what's going on. But being able to look at this header by itself if we were sending all just this overlay information to a text file, let's say, and we could see that the time, what protocol it was using. In this case, IP. Now, in this case, IP means IPv4 because it's by default. You'll see on the next line that it says IP6, and that's doing the whole IPv6 address. So you get the source, the protocol, and where it's going to, and the protocol as well, and along with some other information that's coming back in the packet itself, and this is where if we do the full-packet extraction, we could get more in-depth information from this.

3:58Now, I'm going to put up on the screen one of those lines here real quick, and we're going to do a play at home and challenge yourself for just a second. If you run this at home and you get this kind of output, what we're looking at on the screen right here is a quick overview of what you'll get in your output. And being able to look at this individually, we can see that, yeah, we have the timestamp and the actual IPv4 or IPv6 method that it was using, but we're also looking at the IP address. And you'll notice that it's followed by a .1.mdns.

4:32And that .1 is the actual port of UDP, in this case, and the .mdns is the actual protocol. So Multicast DNS. And then the Pac-Man sign is letting us know where it's coming from and going to. So the following IP address of 224.0.0.251 is the destination, and you'll notice it's followed by another .mdns, which is Multicast DNS. And for the purposes of this exercise, that's all we're really taking a look at right now, is just getting an idea of how to read this and get an understanding of it.

5:12So that way, when you run your examples at home and do this, you get an idea of-- if something looks different, you know already where things are placed and know how to take a more detailed look at them. So I know we scratched the surface on where we get some of this information from, but in the next Nugget, we're actually going to start digging a little bit deeper into how to get better packets and better dumps from our command-line or terminal and also our Wireshark. Now, we're going to have a skill dedicated to Wireshark and going way more in detail.

5:43But since we've already touched on it and there are plenty of skills here on Wireshark in CBT Nuggets, we're jumping past the introductory level of installation and going straight to using its basic functions in that next Nugget. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] Now, we've seen some examples of breaking a packet down and looking into it a bit. But as we hinted in the last Nugget, these have to come from somewhere, right? And in this Nugget, that's what we're doing here, is we're going to start diving into where we get this information from and, more specifically, what it is that we're kind of looking at, without going too far deep into the packet itself because we do have skills coming up later that will focus on those individual aspects of the packet overall.

0:32So we can start diving into whether it's TCP, UDP, IPv4, IPv6, what the payload is, and all this other great stuff. But for now, we just need to get a handle on how we extract the data itself. And primarily, inside of a network or system, there's two different methods that we use. And the first one that we're going to take a look at is tcpdump because that's one of the commands that we rely on heavily, not just in this course but if there were a certification for this course. Now, we're in our Kali VM. And we're taking a look at the terminal here.

1:03And I will put this command below. And we'll kind of walk through what's actually going on here. So sudo first and foremost-- so that way, we run it as an administrator-- and tcpdump. Now, there is an option to put a -i in here. And that's identifying the interface. So if we have a system with more than one interface, we would follow it up with, which interface is it? Now, those interface names come from your ifconfig. So if you're running, let's say, a VM or a physical box with multiple interfaces, you would use eth0, eth1.

1:35But the default, in this case, is eth0 on this system inside of tcpdump. So we're skipping the -i because we kind of know where all the traffic is coming from already. But our next command is -s lowercase with a zero on it. And what that does is it tells us kind of the size limitation. And the zero is identifying that this is an unlimited data size. Now, when we say data size, we're talking about, what's the data cap-- what's the size cap on that actual packet that we're going to be capturing? So when we do our packet capture, if we have any packets that are, let's say, above 1,500, if we've identified that as our cap, anything 1,501 bytes and higher would not be captured.

2:17Now, this could be done for a variety of reasons. Let's say we have limited storage space. We have a need for only low-level, low-data rate stuff like broadcast packets, ICMP, et cetera, et cetera, stuff that normally doesn't have that big of a payload on it. But since we're doing just a short demonstration, we're going to leave this unlimited with -s0, lowercase s, because we want to pick up every packet that goes across. Now, the -w here is what we're going to be using to identify where this actually goes to for storage.

2:51And as you can see, we're putting it on our Desktop and calling it dumptest.pcap. Now, why pcap format? Well, there's a couple of different ways to skin the pcap cat. And we're going to show one for sure. And later on in this skill, we'll show another. First, we're going to use Wireshark to kind of go into it because pcap is a native thing inside of Wireshark. We'll also see here in a minute that we can kind of export our captures in pcap format from Wireshark itself. Now I'm going to go ahead and run this.

3:22And while it is running, after we type in our sudo password, I want to give a couple of tidbits to listen to as we open up our web browser and go to a random website to generate some traffic. One thing that we have to remember is that when we run things in GUI or terminal, we have to consider what the processing power is on that individual system. Now, this is a VM with limited resources. We're running 2 gigs of RAM. And we're also doing some other nefarious things on here through the different skills and courses that we've had together.

3:55So when we do a packet capture, it might be wise to run an actual command-line interface form of packet capture. If we go back over to it real quick, we'll see that it is capturing with a length of 262,144. And we can also see that it is listening on eth0 by default, like we stated. Now, we're not seeing anything in here, because it's all going to an actual file on the desktop, which I can find right here. And as we stop that, we can right-click on it and go into Properties and see that the file size is already 1.5 megs.

4:34Now, if we're using a GUI system or software to do this, like Wireshark, we have to keep in mind-- and I'm going to pop out and see if I can zoom in here real quick. Right there, next to the icon for the network, is kind of where the processing for VMware shows-- or for Kali shows inside the OS. And based on the limited resources, the more stuff you put in there running off a GUI, the more processing it adds to it because it has to render it in graphical form.

5:05So that's where the pros and cons are coming in at. If you're looking for something specific in a very short period, Wireshark might be the best way to go. If you're looking to do a capture of a broad scale and it's going to be capturing a lot, tcpdump or something else preferred by the user in CLI might be the better option. But overall, we can bring them into Wireshark. And that's what we're going to do here because now with that file on our desktop, we can open it up. And that's it right there in gedit.

5:36And I don't know why it went into gedit. That's OK. We're going to right-click and say, open up with Wireshark. It happens sometimes. And as we open it up in Wireshark, we can see that a lot of data has already been captured. And this is everything that we would normally get inside of Wireshark, especially in promiscuous mode. It just happened quicker for us inside of the tcpdump in our CLI. And we can see up at the top that our peaks are starting to come up for processing because we opened up a large file. And we are doing it with GUI.

6:08So if we take a look at it-- I left this open for a reason. If we take a look at this, that's a lot of unintelligible text. Well, that's because it's doing it in hex. And if you wanted to be able to read it-- let me open one up for you right here and move it over for you-- this is what it would actually look like, which we have the option to view this inside of our Wireshark down on the bottom right-hand side when we look at the data extraction. There we go.

6:39And right here, this is the actual packet itself. Now, you'll notice that there's a lot highlighted there. And that's the actual payload of what's going on. And again, this is all OK because we're going to take a step back and look at this from a bird's-eye view and start going back into our box examples again. Addendum-- I wanted to do something real quick and show you before we start getting into the weeds on this that we can actually go down to our bottom right on the actual Wireshark. Right-click. Sorry, my camera glitched there for a second. And we can actually show it as bits.

7:11And this gives us everything in the actual binary format of what's actually going on in that packet in the binary form. So we can actually see how it's broken down. And this lines up better. If you notice the zero, the eight-- let me zoom in for you there right quick-- 0, 8, 10, 18, 20. And those are our line numbers. Now, why does this matter? Well, as a sneak peek into something that we're going to do later in this course, we come back over here to our page two in our supplemental files. And we can see at the very beginning-- now, this is the IPv4 header and not the overall packet itself-- that we have a 0000.

7:51We have 0008 and 0010. Those are the actual line numbers and help us line up with what's going on here. So if we're taking a look at it for funsies of what's going on here, this one right here-- again, let me zoom in. Oh, wrong one. 0000 lines up with line zero in the actual PDF that we have. 8, 10, and then so on, so on, so on. So if we're looking at it from the packet overall and we want to compare it to what's actually going on inside of our supplemental files, we can start piecing together how this works together.

8:28Now, as an actual bonus to this-- I know bonuses all day, right-- that's a lot of information. And we know that the first byte right here, the first eight bits that we see right here, line up with zero through seven. And yep, I can highlight them right there-- zero through seven. So that would be byte offset zero. And we can look. What's the IP header length? Well, if we were on the right one and this was an actual IPv4 header packet, then that would tell us that it's on the actual length of zero.

9:00But this allows us to be able to take information that we see in binary form and bring it over to something that's more intelligible to us. The reason that we do the stuff like this-- and we'll see all throughout this course-- is that we could use programs like Scapy-- and it's coming-- that we can modify and create crafted packets to kind of look like they're supposed to be real but put stuff in there that doesn't make sense. So we would expect an IP header in the byte offset of our form or packet diagram right here to be either a four or a six, right?

9:32Well, what if we had IP version 7 coming across? Well, there's no RFC, or Request For Comment, that's come out for it. So we need to keep an eye out for stuff like this. And that's why we're diving into it throughout this course, to get an understanding of how these packets are put together. And if you're lost in the sauce, like I am, when it comes to binary and hex and all this other stuff, the last page of our supplemental files-- let's see if-- yeah, I got it. Right here, this is an actual conversion chart, where it goes from decimal, binary, hexadecimal.

10:04And we can go in here and see that, for example, on the top left, all eight zeros equal a hex of zero. Well, you can go through here and do this conversion. And it would make sense to you if you had to convert some of these, let's say, for an exam or something like that. Who knows? OK, so we went through and figured out how to copy traffic as far as in a live environment through the CLI and the GUI. We're talking like tcpdump and Wireshark. But what if we wanted to replay that traffic?

10:35I'm a step ahead of you. And that's what's coming up in the next Nugget. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] What happens if we've recorded the traffic but need to replay it? So we got our pcap right here. And we've already copied everything into that pcap by recording the traffic and whatnot. But what if we wanted to replay it? Now, I know what you're thinking. What? Why replay it? Well, let's say we copy the pcap from our regular live network and go to a honey net or a honey pot and we want to replay it to see what exactly happened?

0:31We could be trying to test out if somebody was doing an IPS or IDS evasion tactic or if there was some nefarious traffic that we missed. Well, that's where we use tcpreplay. And I'm going to fire up the Wireshark here. I'm going to close out this one. And we're going to open up a fresh copy of Wireshark. Now, we're going to use this on our loopback. And the reason we're doing that is because everything on our eth0, if we do it in promiscuous mode on Wireshark, it's going to come back and record everything, let's say, like if we were go to the web or something like that.

1:06So we can use a command called tcpreplay in our command line. And we'll type in sudo tcpreplay. And then the I is the interface that we're going to put it on. Now, again, I'm going to do a real quick ifconfig to make sure that we have our local loopback. And that is right there-- the lo. So we're going to go sudo tcpreplay -i lo. And then we're going to say-- just type in the actual location of the pcap file, which is /home/kali-- make sure we recognize our lower and uppercase here because it is case sensitive inside of Unix-based systems-- on our Desktop and dumptest.pcap.

1:58Now, I'm going to go ahead and go into our Wireshark here. Make sure that we have local loopback selected. And start our capture on there. And then go ahead and do this right here. Complete the command and start our replay. Now, if we open up our Wireshark, we can see that we're replaying all that traffic from the PCAP in our local loopback. This allows us a method to be able to capture traffic and replay it for analysis later on in a more detailed method. And you can also see that it's doing it in the same time frame that it captured it in to begin with.

2:30It didn't just do a sporadic dump and show everything all at once. It's doing it in a timed fashion that it caught it in. Now, I'm going to go ahead and do a stop because I don't need that entire thing. This just gives us a tool to where we can understand that we do a capture either through tcpdump or Wireshark. And we can use the CLI and tcpreplay to play it back to a specified interface and bring it back into something else for collection to make sure that, let's say, the original capture matched what the replay was giving us, in case there was something that slipped in that we didn't know about.

3:06Or what if something's missing and we need more info on it? Now, we're not going full on into it in this skill. That's what we have plenty of other skills throughout this course for. But this is, again, more of an introductory skill to the entire course overall in the basic concepts of this and TCP/IP. But in the next Nugget, we're going to go a little bit deeper into that hex and binary that we were talking about while ago and cover some methods that make it a little bit easier for us to be able to understand what's going on without having to dig too deep into it. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] Now, don't worry because this isn't something we have to memorize, but we do need to get familiar with it and learn the basics. And of course, I'm talking about hex binary decimal and all that great stuff. And in this Nugget, we're actually just going to do a quick review over how to-- basic identification and the simple math that actually goes behind it. So I'm going to make this as painless as possible because this is not something that we have to memorize. We just have to be aware of what this is, how it's done, and if we need to use it later on, let's say, spur of the moment, and we have just an idea of what it is that we need to do and how we do it.

0:42Now, of course, I do want to point out again, the last page has a master conversion chart in our supplemental files of almost every possibility that we will run into when we do network analysis or network monitoring. So let's say, just a weird one, we have a decimal of 255, and the binary for it is all 1's, and the hexadecimal for it is ff. So don't be afraid to use this chart and any other source out there to be able to do this because it's not like the real world is going to be a testing environment.

1:19You can have stuff like this on you if you need it. Now, that being said, what we're taking a look at here is a graph that's going to fill in as we go through the different portions of it, and on the first line is how we actually count binary. So we see that we start from the left and work our way all the way over to the right, starting at 128 and going back down to 1. Now, for those that were in the networking before this, this may look a little bit familiar because this is actually how we do subnetting to a certain degree. So let's go ahead and reveal our next line, which is 00001001.

1:53Now, that's our traditional binary-type format, where we have nothing but 0's and 1's. And revealing it to the side, we have that this is a decimal equaling 9. Now, where do we get that from? Well, if we notice that the first one that we run across going from left to right is under the eight column and the next one is under the one column, we're simply just going to add those two together and get 9, and that gives us our decimal formatting. Well, on the next line, let's go ahead and reveal it. We have 00000111.

2:27Now, I'll give you just a second to figure out what this equals up because again, we're just adding the 4, the 2, and the 1 column. And if you guessed 7 or got 7, you are correct. This is a decimal value of 7, so we have converted from binary to decimal. And behind door number 3 is our last one, where we're going to go 00010011. And by their powers combined, it is equal to 19 because we're adding 16, 2, and 1. For an added little bonus to this, I'm going to add another column in here, and you'll notice on the top-right, I just revealed.

3:02It it's hex, short for hexadecimal. Now, this is going to get a little wonky really quick because in our first column, we said that we had a decimal value of 9. Well, that equals 9. You may be thinking, that's not too bad. And in the next column or the one right below it, we have a decimal of 7, and that equals 7. Well, in our third example, and I'm using this one because it's pretty easy to figure out, we have a decimal value of 19, but our hex value is-- I'll give you 1 second-- 13.

3:34Now, you may be thinking, what in the world is going on here? And that's what I first thought when I ran across this too. But now, I'm revealing right below it, and you can see that 19 divided by 16 equals 1 with a remainder of 3. And if you can see, that does calculate in there. Now, for those playing at home, if you did a decimal value of 18, which would be binary 00010010, your decimal value would be 18, and your hexadecimal for that would be 12, not just because it's one lower 19.

4:07I get it. But it's because 18 divided by 16 equals 1 with a remainder of 2. Now, there are many different calculations that we could do with this because of the fact that we have to divide by 16, and that's hexadecimal. But we're making this easier on ourselves and just referring to the chart that we have to be able to do our conversions. Now, if you're like me and some of this overwhelms you sometimes, that's OK, too, because what we're doing now is going to take a look at an actual website that we could use to help us.

4:41And I go to this site all the time to be able to do bigger conversions on if-- basically, if it's outside of what I can do in my own head, I go here because I don't want to strain too hard over it, and I just go do a quick decimal to hexadecimal conversion, and this also does binary. And if you scroll down after we do one, it'll actually show you the steps of how the math actually got involved in it. I will put this link below. So what we're doing now is we're going to do a simple decimal, which would be, let's say, 126, and we're going to make sure it's set to hexadecimal and do a convert, and we see it converted to 7 echo, which is 007 echo.

5:23The binary for that is 11111107. Seven digits. And if we scroll down, we can see right here, this is where the math is actually done to give us where we got 7 echo and how it lined up and everything like that. So I know that there's a lot of math that goes into the actual hexadecimal conversion of this, but thankfully, for the purposes of this course and if there was an exam associated with this, we don't have to do the math in our heads while we're on the test. What this is, is just giving us familiarity and figuring out what's actually going on behind the scenes because when we break those packets down, like we've seen before, there is hexadecimal, and we may need to convert it for whatever reason, from hex to decimal and/or binary.

6:06Now, like I said, that was just a quick familiarization because we didn't want to go too deep into the math. It's not like we're trying to do calculus here or anything like that. But in the next skill, we're going to be diving more deeply into Wireshark. So that one, we will get way all the way up to the waist in the swamp on that one. But that's OK because the more we know about Wireshark, the more we're able to analyze the traffic that's coming across the wire and can make a better determination of that traffic for those folks up in the C-suite with the security policy and whatnot.

6:36So I hope this has been informative for you, and I'd like to thank you for viewing.