- Lab
- A Cloud Guru
Packet Capture and Analysis
It's crucial for any security or systems administrator to be able to capture and analyze network traffic. This allows for advanced troubleshooting as well as security review. Furthermore, having a working knowledge of the traditional capture filters, like those used in the `tcpdump` and `wireshark` utilities, is a requirement of some certification exams, such as the LPIC-3 303-200.
Path Info
Table of Contents
-
Challenge
Use a `tshark` capture filter to collect TCP traffic on port 80.
-
Use a
tsharkcapture filter to collect TCP traffic on port 80. Store the capture command output in/root/http_out.tshark -f "tcp port 80" -V -R http > http_out -
In another SSH session, run
curl www.example.com/index.htmlduring the capture.curl www.example.com/index.htmlNote:
curlmay produce output but it does not need to be recorded.
-
-
Challenge
Use a `tshark` display filter to collect HTTP traffic and print only HTTP response codes.
-
Use a
tsharkdisplay filter to collect HTTP traffic and print only HTTP response codes. Store the capture command output in/root/http_response.tshark -Y http -Tfields -e http.response.code > http_response -
In a separate SSH session, run
curl www.example.com/index.htmland thencurl www.example.com/error.htmlduring the capture:curl www.example.com/index.htmlcurl www.example.com/error.htmlNote:
curlmay produce output but it does not need to be recorded.
-
-
Challenge
Use a `tshark` capture filter that prints the IP address of hosts sending traffic to the test workstation on TCP port 22.
-
Use a
tsharkcapture filter that prints the IP address of hosts sending traffic to the test workstation on TCP port 22. Observe any IP addresses printed after several seconds.tshark -f "tcp src port 22" -Tfields -e ip.dstAdd the IP address(es) to
/root/ssh_ipin a newline-delimited format.
-
What's a lab?
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Provided environment for hands-on practice
We will provide the credentials and environment necessary for you to practice right within your browser.
Guided walkthrough
Follow along with the author’s guided walkthrough and build something new in your provided environment!
Did you know?
On average, you retain 75% more of your learning if you get time for practice.
