5a

tcpdump

- a non-GUI and strictly CLI based packet capture program - widely available on Linux OS distributions but can also be run on Windows OS machines

WireShark

- de facto standard for network protocol analyzers - GUI-based packet capture program - provides a functionality to examine entire frames in addition to the packets encapsulated inside of them

tshark

- non-GUI and strictly CLI based packet capture program - widely distributed alongside a GUI based program known as WireShark

Software that falls under the umbrella of being a packet capture is

- specifically designed to capture data between a packet header and packet footer known as the payload - designed to do this for traffic that is addressed to nodes on a computer network other than itself

The starting relative sequence number and acknowledge numbers are both ___ by default and increment in progression as you would expect

1

By default, there are ____ separate coloring rules for a display filter

20

When tcpdump is used as a packet capture, most of the output for the program will contain information that is related to primarily layer ___ and a little bit of layer ___

3; 4

when conversations between nodes using TCP initiate, they generate a random __-_____ initial sequence number to track it

4-byte

By default, most of the information from a tcpdump is presented in a non-human friendly manner and extremely technical in nature as either __________ or ___________ code values

ASCII; HEX

When utilizing the above programs, ___ _______ can be applied to the commands executed on the packet capture CLI to further specify results.

BPF syntax

By default, NICs on nodes for a computer network are programmed to only receive and forward frames up to the _________ __________ when the destination MAC address of the received frame matches either the...

Operating System (OS); MAC address of the receiving NIC or is a broadcast frame (FF:FF:FF:FF.FF:FF)

Often, network protocol analyzers are also referred to as __________ __________ programs

Packet Capture

By default, NICs on nodes for a computer network are programmed to only receive and forward frames up to the Operating System (OS) when the destination MAC address of the received frame matches either the MAC address of the receiving NIC or is a broadcast frame (FF:FF:FF:FF.FF:FF). However, this can be circumvented via enabling what is known as _________ ________ for an NIC

Promiscuous Mode

Primitives in BPF syntax are then followed by what are known as

Qualifiers

The random sequence numbers used in the TCP conversation are also assigned what is known as a ___________ ___________ ____________ and acknowledges a __________ _____________ ____________ to further assist in identifying the starting point of a conversation and how it progresses.

Relative Sequence Number; Relative Acknowledgment Number

There are additional levels of detail which can be increased beyond the default referred to as ___________ levels within the program

Verbose

A BPF syntax contains what is known as a Primitive which is a reference to

a field in a layer 3 PDU header to help with filtering

conversations view

a view option that allows viewing every conversation between a source and destination node that has been identified during a packet capture

protocol hierarchy view

a view option that allows viewing every protocol that has been identified during a packet capture and percentages related to their use

Berkley Packet Filter (BPF) Syntax

accomplishes packet capturing and presentation of the information to a human user

Stream

created when WireShark captures an individual conversation, organizes it, and assigns it (to a stream)

BPFs are meant to interface directly with the ______ ______ ______ of the OSI reference model to _________ frames and act as a filter to break up...

data link layer; capture; larger packet captures of traffic on a computer network into smaller more narrower results by filtering based on a specific type of traffic

in promiscuous mode, Once the node of an OS has been forwarded the frame, packet capture software can...

decapsulate the frame and analyze and extract information from the PDU headers and payload contained within.

When performing a packet capture, packets belonging to a specific individual conversation will naturally be __________ and ___________ due to the amount of traffic that is being captured.

dispersed; disorganized

WireShark introduces what is known as a ________ ________ in addition to the BPF that is built into the GUI program and referred to as the ______ _______

display filter; capture filter

Qualifiers help further

filter packet captures based on criteria such as protocols (for example: IPv4 or IPv6).

WireShark provides a functionality to examine entire frames in addition to the packets encapsulated inside of them. Because of this, this type of traffic analysis is sometimes referred to as a

frame capture

It is important to note that before a packet capture occurs and simply because a NIC has been configured in promiscuous mode

frames will not be automatically sent to the machine that is performing a packet capture

WireShark will not just simply provide details regarding packet traffic but will also provide what and why?

full protocol decodes that are being used in said traffic because WireShark is programmed to have a thorough understanding of most network related protocols that can be observed on a computer network

__________ ___________ __________ may be used when performing more thorough and in-depth analysis of a computer network's traffic

network protocol analyzer

It is important to note that before a packet capture occurs and simply because a NIC has been configured in promiscuous mode, frames will not be automatically sent to the machine that is performing a packet capture. An additional step that must be performed is known as _________ ____________ which will...

port mirroring; replicate traffic across a specific link to the Mirrored Port

When tcpdump is used as a packet capture, most of the output for the program will contain information that is related to

primarily layer 3 and a little bit of layer 4

packet sniffing/packet capturing

process of capturing data destined to another node on a computer network

display filter is purely for

separating and categorizing data that is presented to the user during a packet capture session (in WireShark)

You can specify either a ________ primitive or have ___________ primitives when creating a filter with BPF.

single, multiple

A primitive in the context of BPF syntax can be a ________ or ________ IP address for example

source; destination

WireShark will automatically perform the calculations necessary to determine the _______ and ________ of said conversation and assign it to a __________ that can be followed within the program.

start; finish; stream

The conversations view includes but is not limited to relevant information such as

total number of packets transmitted in the conversation, duration of the conversation, and total amount of bytes transmitted in the conversation

The protocol hierarchy view includes but is not limited to relevant information such as

total number of packets which utilized a specific protocol and total number of bytes transmitted in relation to said protocol

In contrast to tcpdump, tshark is much more granular in the level of detail which can be viewed because

tshark can be forced to print specific fields from captured packets versus an entire captured packet as observed in tcpdump.

Promiscuous Mode

will force a NIC on a node to forward all received frames regardless of the destination MAC address specified in the header of the frame up to the receiving node's OS.