Welcome to experience Tech.

I'm beneath and in today's video will understand a very powerful command line Network analyzer tool are technically a packet sniffer tool going disappeared.

Um, it is a linen stool, but there is a version off TCP Adam for windows that is called Wyndham.

But today, in this video, I'm gonna use calorie knocks, which have TCP dump installed by default.

Now, for those of you who are using a different version off Lennox other than cholera in nooks and you do not have TCP dump installed on your computer, you can type in this command that pseudo act get installed DCP dump type in this commanding your bash, prompt and pressed into, and that will install it TCP dump on your computer.

All right, so that said, let's begin.

Today's video DCP dump, as I said, is the packets.

Nothingto.

This is mostly used by the penetration tester to wash the traffic going through or moving through the network and analyze the data is also used by security administrator to look if there's any unwanted or suspicious activity that is going on in the network.

It's a very powerful tool.

Using this tool, you can check each and every packet that is going to and from a computer to another computer.

Let's go ahead and understand how to use this tool.

No lists in tanks is you type in D.

C P D dump and then you given these options.

These are options, even if you do not give any option.

Just typing.

In TCP dumb pressing enter will start the sniffles, but this requires administrative privileges.

So if you are not administrator or if you are not logged another mystery community typing Sodo and then give us peace and then dive in DC freedom, you could ask you for your administrative password on.

Then don't start sniffing.

Now we look into the option options that are available.

The first option is dash and option.

It will display only numbers and not names off machines.

Think most of the times you do not require, uh, the name of the computer Toby displayed.

Just the I P address will suffice the purpose, so that is where you used ash and knobs.

Dash double End is also used for display number for not only machines but also ports.

So the port number and the I P address off the machine will be displayed in strange off dear orginally.

Dash I option is used for giving a particular interface to sniff phone.

For example, if you're having eaten that you're connected by eternity, then you type in your Internet interface.

That's usually you.

Th zero.

If you're on wireless, let love than you, you can give the Blue Land Jiro.

That's really explain.

More details about this particle backer liked the deal i b a.

D doctor Lend off backward and accept, and you can also incriminate Develop velocity by giving dash reveal double B will increase the verbal verbosity Triple B with further increasing verbosity off.

Um, packet sniffing Dash W is used for dumping the password toe a particular file dash the blue and followed by a final name.

We dump all the password all the package that you're sniffing toe a particle finally and dash R will read the packet strong file.

So after you dump a backer to a file, you can dream this filed by using dash out option Dash Small X will bring the Data Packard or the entire Packard in exile.

Decima Dash Capital X will print in Exodus.

Symbol as well isn't asking.

All right, Dash is will bring distant, nasty characters.

Now, lastly, Dash s small s option is for snapping the Packard the deforested 60 year bite.

If the packet is larger than 60 goodbye, you can.

You can specify the amount of bite that people snap to Dash s and 1000 will snap back into coming by.

Very important, if you typing Dash on, give us peace and then type zero it'll granting that packet.

All right, so that is the options that we have.

Now let's look into the protocol.

There are several protocols that you can also use for eternity.

You can type of eater poor trouble.

I p i p v for i b before just typing i p Then I'd be v six are the deformed protocol is TCP.

Next up is dick type.

Now, this is a type of scanning that you are gonna perform, So the type you can specify host and then give the idea eaters Now that will run the sniffer on and sniff package to and from that particular host.

If you type in neck and give the i P address, it'll sniff Packards 21 from that particular next look.

You can also specify a particular port from which you wantto sniffed the backers for 80 sniff package the one from that board owning You can also specify a port range so poor, strange and then giving, like going to you to 30 or 2020 favours left Packard's from that.

You can also type in as our see that it's for source and then given i p address.

So in that case, it will only sniff package doctors or ejected from this source and similarly for destination.

You guessed it Dr will sniff backwards that is going through this particular destination.

All right, that is very, very important.

And also, you can create an expressions you can use logical expression like end or or to combine certain functionality.

This is the first example typing DCP dump dash and and for no names for ports and machines dash access for printing asking as a live techs dash s equals s speed Zero is for grabbing the entire packer.

DCP is deeper recalled that we're gonna use you're using the logical oppression and and then destination is when 9 to 160.0.

This means grab only TCB bankers that is going to the destination.

19216 All right, so enough of theory.

I know it's kind off a little difficult to understand, erred by the string text until or unless we do a live demonstration.

So that does jump right in and start the demonstration so that it will be absolutely clear to you how we can use disobedient.

So let me open up the bash bomb here before I begin this demonstration.

A quick overview off the center.

This is my career in next box.

This is my Windows seven box.

But I'm gonna do is I'm gonna start the neck and listener on Windows box, and I'm gonna send packet from my colleagues.

The next machine do this and violet disappeared.

Dump is running so that we can analyzed water the package that sending and how DCP dumb is able to sniff that particular package and display it for us.

All right.

So let me quickly start the next can't listener on this computer.

So let me go toe the twins directory in my computer will have done it and the i p address off this machine is 19 to 160.10 All right, so let me start dinner.

Catalyst man On and on board.

4444 So this lawyer has started.

I'm back on my golly.

Next machine on dhe.

I'm gonna establish a connection.

Do not get bash.

And on DDE, the host will give is winning 16 door to door 10 one borders 4444 I'm sorry.

Well, my connection is established to double check it in.

A pressed into, as you can see, has received the package.

The listener has received the package.

Now let me open a pawn in the terminal and start to see Pierre dump.

So type into super dumb Dash X for printing boat asking as Willis next exit isn't corrected, Dash.

And for known names only I beer just only numbers.

Um, Dash s zero for grabbing the entire back it instead off just a deformed six to your bite, and then they're going to give the destination.

So this nation is our windows machine.

19216 years.

Don't.

$0.01 This will grab only the package that are going to this particular machine that is a Windows machine.

And the work that I've given its 4444 my present.

So the now DCP dump ass started listening.

No.

Let me again send a Packard a Britain and press enter.

As you can see, it has grabbed a part of this particular Packard.

And here also we have four.

Is that we have sent from a colleague machine.

No, a quick analysts is that you can see is here the time stamp.

I'm So here's this time stamp that it was transcend the eye people took on.

This is the I.

P.

Address off the source.

And this is the idea just off the destination port as well.

So, as you can see, a lot off information is available here.

This is the entire package in Exodus already.

Um, this particular vine digit here represent four big off packet land.

Okay, so this entire four digit represent total off 16 big No, this is a DCP package.

Arti c p i p packet.

So initially we have this particular we start with the I'd be hurt if he goto d Internet.

Andy, I'd be before heading for Mac you'll see.

This is the I P.

Before her deformity.

The first up is diversion.

So here it says, if you can read this I p v for if it has a version of four, that means that I be before Packard.

So, as you can see, we have the first digit is for the first, um four Big is magnets for, then the next is D Internet.

I don't lend which is off again off four bits.

So as you can see this lot off information you can you can go through this particular information off Wikipedia about the i p Hurdle for murder.

And I'd be a in time Packard former and also you can after I pee harder, I'd be heard there is off 1 60 big after that is deep.

DCP Packard billing Die backwardness.

TCP Majesty, this one All right, DCP Packard So as you can if you I'll just show one more thing to you.

As you can see, the source I p address is act.

This is the entire start, YouTube it and then against addictive.

It is 64 back and then 32.

One more to you.

So 64 then again convicted away.

So let us go to a backward.

So this is your Gilbert?

No, this four juncture.

64 bit plus 32 bit.

So here, you can see sees, you know, eat.

If you see here after, ah, 64 Antonio break.

We have this whole site theaters it says sees it'll eat.

Let me start a pool.

Calculate Don't go to the camp for good and typing.

C, it is C zero C zero in extra decimal is a commando.

192 Destiny, it's 19 So if you can remember is starting off for I'd be addressed 192 on e t Should be 1 16 Right?

The seat need It's 1 60 without disorder.

I'd be addressed right here.

D source A P address and this must be the destination I p address.

I'm sorry.

This must be the destination.

I p address.

Here is our data that we have 414141 that is four is another.

So you need to learn and go through this particular packet.

Former i b v Harder for murdering TCP packet to completely understand the entire package already that is it for today.

I hope this video was useful to you.

You know this This isn't a superior.

You can also sniffed museum and password that are on port Beauty that you support 80 the adult the SSL security.

That is without s to t p s.

If you have any other website that does not use a stew TPS And if you type in your Neiman password And if sniffer is running, it will grab the user name and password.

In fact, let me just quickly demo that out.

Okay, So that to me Let me just your type Mississippi them the entire land.

Uh, six one and work looking special Report 80.

It is for us to tp traffic starting to sniffle sniffle a starter.

Let me quickly go too deep into an explorer.

So, as you can see, this is a strict DP website.

North issued GPS.