epbrtcybersecurityportfolio.xyz

Blog

  • Concepts of TCP/IP

    Objective:
    In this lab, I explored various aspects of the TCP/IP protocol by using tcpdump to analyze network traffic. The goal was to familiarize myself with the functionality of tcpdump and practice using its command-line options to read and interpret packet capture files.

    Exercise 1: Reading a PCAP File
    The first exercise involved using tcpdump to read a packet capture file named concepts.pcap. The objective was to analyse the contents and identify the number of recorded packets. I utilized the following command to read the file:

    Six records are displayed:

    Exercise 2: Reading Specific Records from a PCAP File

    Objective:
    In this exercise, I practiced using tcpdump to read a specified number of records from a packet capture file. The goal was to extract and display the first two records from the file concepts.pcap efficiently as well as identify the source IP address of the second record .

    Command Explanation:
    To achieve this, I used the following tcpdump command:

    • The -c 2 option instructs tcpdump to limit the output to the first two records.
    • The -t option suppresses the display of timestamps, making the output more concise.
    • The -n option ensures that IP addresses are displayed as numerical values rather than being resolved to hostnames.
    • The -r option specifies that tcpdump should read from the file rather than capturing live traffic.

    These options can be combined in a single command for efficiency.

    The second source IP address is 192.168.11.13 which is found here:

    Exercise 3: Displaying Network Records in Hexadecimal

    Objective:
    In this exercise, I learned how to use tcpdump to read a single record from a packet capture file and display it in hexadecimal format. This technique is useful when analyzing raw packet data for low-level protocol analysis. I am also asked to identify the first two bytes seen on the hex dump for the first record, the IP protocol field value and the TTL located the IP header.

    Command Explanation:
    To view the first record from the file concepts.pcap in hexadecimal format, I used the following command:

    The -x option displays the packet data in hexadecimal format.

    Regarding the first two bytes question: A hexadecimal character represents 4 bits (or a nibble), so a byte corresponds to 2 hexadecimal characters. The first two bytes are 0x45 and 0x00, respectively.

    The IP protocol field value is 0x01. It is a one-byte field located in the 9th byte offset from the beginning of the IP header. This tells us that the embedded transport protocol is ICMP.

    The TTL is located in the 8th byte offset from the beginning of the IP header and like the IP protocol field is a one-byte field. it is equal to 0x40 or 16*4 + 1*0 = 64 in decimal value.

    Exercise 4: Displaying MAC/Ethernet Addresses from a PCAP File

    Objective:
    In this exercise, I practiced using tcpdump to display the MAC (Media Access Control) addresses from a packet capture file. The goal was to read the first record from the file concepts.pcap and identify both the source and destination MAC addresses.

    Command Explanation:
    To display the MAC addresses from the first record, I used the following command:

    The -e option displays the link-layer (MAC/Ethernet) headers, showing both source (00:04:00:0a:04) and destination (00:0c:29:03:23:19) MAC addresses.

    The -v option increases the verbosity of the output, providing more detailed information about each packet. I can easily identify the ethertype which indicates which protocol follows the ethernet header (in this case it is IPv4). I can also quickly see that the protocol following the IP header is ICMP (It can be seen in the “proto” field).

    Exercise 5: Analyzing DNS Traffic in UDP Packets

    Objective:
    In this exercise, I analyzed DNS traffic captured in a PCAP file using tcpdump. The goal was to identify the type of activity and data within specific UDP packets, focusing on DNS queries and responses.

    Using the same command as in the last exercise, we can see the following two packets:

    The output displayed two consecutive UDP packets related to DNS activity:

    1. Source and Destination:
      • Source IP: 192.168.11.65, Source Port: 52894
      • Destination IP: 192.168.11.53, Destination Port: 53 (DNS port)
    2. Packet Details:
      • The first packet contains a DNS query (A? giac.org.), indicating that the client is requesting the IP address for the domain giac.org.
      • The second packet contains the DNS response, indicating that the server resolved giac.org to the IP address 66.35.45.203.
      • Both packets use the UDP protocol (proto UDP (17)).
      • The length of the first packet is 54 bytes, while the response packet is 70 bytes.

    Analysis:
    The presence of port 53 in the packet indicates DNS traffic. The query type (A?) specifies that the client is requesting an IPv4 address for the domain giac.org. The response from the DNS server includes the resolved IP address, confirming that the communication was successful.