5.3 Given a scenario, use the appropriate network software tools and commands.

Software tools

- WiFi analyzer - Protocol analyzer/packet capture - Bandwidth speed tester - Port scanner - iperf - NetFlow analyzers - Trivial File Transfer Protocol (TFTP) server - Terminal emulator - IP scanner

Command line tool

- ping - ipconfig/ifconfig/ip - nslookup/dig - traceroute/tracert - arp - netstat - hostname - route - telnet - tcpdump - nmap

Basic network platform commands

- show interface - show config - show route

IP scanner

A tool that scans a network for IP addresses, MAC addresses, hostname, manufacturer, operating system, ports, and other information.

port scanner

A tool that sends packets to a destination machine in order to identify the state of that machine's ports. The process of running such scans is called port scanning. From a cybersecurity perspective, port scanning helps you verify the security of systems under your control. From a cybercrime perspective, it allows attackers to find programs or services with vulnerabilities that can be exploited.

WiFi analyzer

Any device that looks for and documents all existing wireless networks in the area.

Sometimes a GUI tool like Wireshark won't work because a server has no GUI installed. In situations like this, tcpdump is the go-to choice.

It not only enables you to monitor and filter packets in the terminal, but can also create files you can open in Wireshark for later analysis.

The ping tool is

a commonly used test to see if you can communicate with another device.

terminal emulator program like PuTTY (https://www.putty.org/)

allows you to send commands through keystrokes from your machine to a remote router or switch and allows the router or switch to send its output to your monitor.

iPerf (the current version is iPerf3)

can actively measure the available and maximum bandwidth on a network.

traceroute/tracert (tracert on Windows, traceroute on everything else) tool

can be even more helpful than the ping tool. If a ping fails, with traceroute/tracert, you can identify where it failed. The traceroute/tracert tool will produce a list of all routers between you and a destination.

show interface command

can provide important configuration information and statistics.

route tool

enables you to display and edit the local system's routing table. To show the routing table, execute route print or netstat -r.

netstat tool

enables you to explore the sessions between communicating systems.

bandwidth speed tester

enables you to measure the data flow in a network.

To see the router's routing table, stored in dynamic RAM,

execute the show ip route command.

To see the running-config file, stored in dynamic RAM,

execute the show running-config command. To see the startup-config file, stored in NVRAM, execute the show startup-config file.

nslookup (name server lookup) is a DNS tool,

found natively in all operating systems, that allows you to query DNS servers for resource records. dig is a more powerful tool, and is also cross-platform, but is not installed by default in Windows OSes.

nmap tool

is the de facto standard tool for port scanning.

protocol analyzer/packet capture program, also known as a packet sniffer,

not only intercepts and logs all the 1s and 0s moving in and out of a NIC but also shows its capture in a human-readable format, in addition to binary and hexadecimal.

hostname tool

prints out the hostname of the current system.

arp tool is used to

see a device's ARP cache, which is populated by ARP requests and ARP replies, allowing hosts to find an unknown MAC address for a known IP address.

telnet tool

should never be used today under any circumstance, as all communication is transmitted in plaintext. Use the ssh tool instead.

Trivial File Transfer Protocol (TFTP) server

uses UDP at Layer 4 and enables you to transfer files from one machine to another.

The ipconfig (Windows), ifconfig (macOS and UNIX), and ip (Linux) tools give

you a lot of information about a computer's IP settings.