2026-04-12 14-25-40

May 25, 2026 13:42 · 9:29 · English · Whisper Turbo · 2 Kõnelejad
See ärakiri aegub täna. Täiendamine alaliseks ladustamiseks →
Loenguindeks
Ainult näitamine
0:07
S… Speaker 1 (2026-04-12 14-25-40)
Once network data is captured,
0:10
S… Speaker 1 (2026-04-12 14-25-40)
that is where the analysis portion of the threat
0:14
S… Speaker 1 (2026-04-12 14-25-40)
hunting comes in.
0:15
S… Speaker 1 (2026-04-12 14-25-40)
And we're going to take a look in this video at a couple of different tools that
0:20
S… Speaker 1 (2026-04-12 14-25-40)
are used for network analysis.
0:22
S… Speaker 1 (2026-04-12 14-25-40)
Now,
0:23
S… Speaker 1 (2026-04-12 14-25-40)
before we get into specific tools,
0:25
S… Speaker 1 (2026-04-12 14-25-40)
I want to talk about a library known as libpcap.
0:29
S… Speaker 1 (2026-04-12 14-25-40)
This is a Unix -based library that was originally written and
0:33
S… Speaker 1 (2026-04-12 14-25-40)
provides a lot of the capabilities that we see
0:36
S… Speaker 1 (2026-04-12 14-25-40)
in some of the more popular packet sniffing applications,
0:39
S… Speaker 1 (2026-04-12 14-25-40)
packet capture,
0:41
S… Speaker 1 (2026-04-12 14-25-40)
and analysis applications as well.
0:43
S… Speaker 1 (2026-04-12 14-25-40)
Both Wireshark and TCP dump,
0:47
S… Speaker 1 (2026-04-12 14-25-40)
two applications we'll take a look at in this course,
0:50
S… Speaker 1 (2026-04-12 14-25-40)
are based off of libpcap.
0:53
S… Speaker 1 (2026-04-12 14-25-40)
Now, Wireshark,
0:54
S… Speaker 1 (2026-04-12 14-25-40)
when I talk about Wireshark being based on libpcap,
0:56
S… Speaker 1 (2026-04-12 14-25-40)
that is technically going to be the Linux version of it.
0:59
S… Speaker 1 (2026-04-12 14-25-40)
The Windows version was originally based on a library known
1:03
S… Speaker 1 (2026-04-12 14-25-40)
as winpcap.
1:06
S… Speaker 1 (2026-04-12 14-25-40)
This is basically the libpcap library,
1:08
S… Speaker 1 (2026-04-12 14-25-40)
but for Windows instead.
1:10
S… Speaker 1 (2026-04-12 14-25-40)
However, it is no longer developed or maintained or supported
1:14
S… Speaker 1 (2026-04-12 14-25-40)
and has been replaced by a library known as npcap.
1:19
S… Speaker 1 (2026-04-12 14-25-40)
The n there standing,
1:21
S… Speaker 1 (2026-04-12 14-25-40)
meaning nmap,
1:23
S… Speaker 1 (2026-04-12 14-25-40)
because it was created by the nmap project.
1:27
S… Speaker 1 (2026-04-12 14-25-40)
So LibPCAP is going to be the basis on a lot of the applications
1:32
S… Speaker 1 (2026-04-12 14-25-40)
we're going to look at for packet analysis and also packet capture
1:36
S… Speaker 1 (2026-04-12 14-25-40)
as well.
1:37
S… Speaker 1 (2026-04-12 14-25-40)
One of the kind of main features that it's important
1:42
S… Speaker 1 (2026-04-12 14-25-40)
to be aware of with libpcap is what's known as the Berkeley
1:46
S… Speaker 1 (2026-04-12 14-25-40)
Packet Filter or BPF.
1:50
S… Speaker 1 (2026-04-12 14-25-40)
This is basically a way to filter
1:54
S… Speaker 1 (2026-04-12 14-25-40)
down the packets that are captured by any
1:58
S… Speaker 1 (2026-04-12 14-25-40)
specific application.
1:59
S… Speaker 1 (2026-04-12 14-25-40)
It is a specific syntax used for
2:04
S… Speaker 1 (2026-04-12 14-25-40)
these capture filters.
2:06
S… Speaker 1 (2026-04-12 14-25-40)
that's used in many different applications.
2:09
S… Speaker 1 (2026-04-12 14-25-40)
So it's important to be familiar with that syntax.
2:13
S… Speaker 1 (2026-04-12 14-25-40)
And we'll take a look at this syntax as we get into things
2:17
S… Speaker 1 (2026-04-12 14-25-40)
like Wireshark and setting up capture filters in Wireshark
2:21
S… Speaker 1 (2026-04-12 14-25-40)
as well.
2:22
S… Speaker 1 (2026-04-12 14-25-40)
So speaking of Wireshark,
2:24
S… Speaker 1 (2026-04-12 14-25-40)
let's take a brief look at that.
2:27
S… Speaker 1 (2026-04-12 14-25-40)
Quick screenshot here of what Wireshark looks like if you are not familiar
2:32
S… Speaker 1 (2026-04-12 14-25-40)
with it, but it basically is a network sniffing application,
2:36
S… Speaker 1 (2026-04-12 14-25-40)
network packet capture,
2:37
S… Speaker 1 (2026-04-12 14-25-40)
and protocol analyzer application with a lot of
2:42
S… Speaker 2 (2026-04-12 14-25-40)
various capabilities.
2:43
S… Speaker 1 (2026-04-12 14-25-40)
It is used by many different specializations in
2:47
S… Speaker 1 (2026-04-12 14-25-40)
IT.
2:49
S… Speaker 1 (2026-04-12 14-25-40)
And it allows for the analysis of any
2:53
S… Speaker 1 (2026-04-12 14-25-40)
network traffic on a specific computer,
2:56
S… Speaker 1 (2026-04-12 14-25-40)
whatever that computer,
2:57
S… Speaker 1 (2026-04-12 14-25-40)
whatever computer Wireshark is installed on,
3:00
S… Speaker 1 (2026-04-12 14-25-40)
it can analyze and capture all the network traffic on
3:04
S… Speaker 1 (2026-04-12 14-25-40)
that interface.
3:05
S… Speaker 1 (2026-04-12 14-25-40)
It is cross -platform,
3:07
S… Speaker 1 (2026-04-12 14-25-40)
so it is available for Windows,
3:09
S… Speaker 2 (2026-04-12 14-25-40)
Linux,
3:10
S… Speaker 1 (2026-04-12 14-25-40)
and as you can see in that screenshot there,
3:12
S… Speaker 1 (2026-04-12 14-25-40)
that is the Mac OS flavor of.
3:15
S… Speaker 1 (2026-04-12 14-25-40)
Wireshark.
3:16
S… Speaker 1 (2026-04-12 14-25-40)
So it is cross -platform,
3:17
S… Speaker 1 (2026-04-12 14-25-40)
so it can be used regardless of which operating system you're
3:21
S… Speaker 1 (2026-04-12 14-25-40)
using at the moment.
3:23
S… Speaker 1 (2026-04-12 14-25-40)
And it has a lot of different capabilities.
3:26
S… Speaker 1 (2026-04-12 14-25-40)
First of all,
3:27
S… Speaker 1 (2026-04-12 14-25-40)
it can perform the live packet captures and the live
3:31
S… Speaker 1 (2026-04-12 14-25-40)
analysis of those packets as they come in.
3:35
S… Speaker 1 (2026-04-12 14-25-40)
And it also has the ability to save that captured data in
3:39
S… Speaker 1 (2026-04-12 14-25-40)
a PCAP file,
3:40
S… Speaker 1 (2026-04-12 14-25-40)
a packet capture file.
3:43
S… Speaker 1 (2026-04-12 14-25-40)
PCAP being one of the wider used standards
3:48
S… Speaker 1 (2026-04-12 14-25-40)
for packet capture files.
3:50
S… Speaker 1 (2026-04-12 14-25-40)
And as it has the ability to save these files,
3:53
S… Speaker 1 (2026-04-12 14-25-40)
it also has the ability to analyze the previous
3:57
S… Speaker 1 (2026-04-12 14-25-40)
captures regardless of what application they were captured in.
4:01
S… Speaker 1 (2026-04-12 14-25-40)
It does have the ability to analyze the previous captures as long as
4:05
S… Speaker 1 (2026-04-12 14-25-40)
they were saved in a compatible format of which there are a number
4:09
S… Speaker 1 (2026-04-12 14-25-40)
of them.
4:11
S… Speaker 1 (2026-04-12 14-25-40)
It does have the capability to implement both capture
4:15
S… Speaker 1 (2026-04-12 14-25-40)
and display filters.
4:17
S… Speaker 1 (2026-04-12 14-25-40)
And you can see in this screenshot here,
4:19
S… Speaker 1 (2026-04-12 14-25-40)
you've got a section to enter capture filters right there
4:23
S… Speaker 1 (2026-04-12 14-25-40)
and a section where you can enter in display filters as
4:27
S… Speaker 1 (2026-04-12 14-25-40)
well. Again,
4:28
S… Speaker 1 (2026-04-12 14-25-40)
these do use different syntaxes with the capture
4:32
S… Speaker 1 (2026-04-12 14-25-40)
filter using the Berkeley packet filter syntax.
4:36
S… Speaker 1 (2026-04-12 14-25-40)
and the display filters in Wireshark using their own
4:40
S… Speaker 1 (2026-04-12 14-25-40)
syntax there.
4:42
S… Speaker 2 (2026-04-12 14-25-40)
In addition,
4:43
S… Speaker 1 (2026-04-12 14-25-40)
you have the ability to do what they call following the stream
4:47
S… Speaker 1 (2026-04-12 14-25-40)
in which you can select a specific packet
4:51
S… Speaker 1 (2026-04-12 14-25-40)
in the interface and be able to kind of just essentially
4:55
S… Speaker 1 (2026-04-12 14-25-40)
right click and follow the stream depending on what type of packet it is
4:59
S… Speaker 1 (2026-04-12 14-25-40)
to be able to see all of the information kind of in one view
5:03
S… Speaker 1 (2026-04-12 14-25-40)
instead of seeing all of the packets for all of
5:07
S… Speaker 1 (2026-04-12 14-25-40)
the streams all at once in the display.
5:10
S… Speaker 1 (2026-04-12 14-25-40)
It's just showing the relevant packets for that one stream.
5:14
S… Speaker 1 (2026-04-12 14-25-40)
And we will take a look at all of these features
5:18
S… Speaker 1 (2026-04-12 14-25-40)
throughout this course as we start using Wireshark more in depth.
5:23
S… Speaker 1 (2026-04-12 14-25-40)
Now, if you're not using a graphical interface,
5:26
S… Speaker 1 (2026-04-12 14-25-40)
you can still use Wireshark.
5:27
S… Speaker 1 (2026-04-12 14-25-40)
Technically, you can use the T -Shark component of Wireshark,
5:31
S… Speaker 1 (2026-04-12 14-25-40)
which is essentially just Wireshark for a terminal -based interface.
5:35
S… Speaker 1 (2026-04-12 14-25-40)
It is a command line version of Wireshark,
5:39
S… Speaker 1 (2026-04-12 14-25-40)
but it is included with the Wireshark installation.
5:42
S… Speaker 1 (2026-04-12 14-25-40)
In addition to Wireshark,
5:45
S… Speaker 1 (2026-04-12 14-25-40)
there's another application that is used for capturing filters known as TCP dump.
5:49
S… Speaker 1 (2026-04-12 14-25-40)
This is a Unix -based packet sniffer,
5:53
S… Speaker 1 (2026-04-12 14-25-40)
so it is available on Linux,
5:55
S… Speaker 1 (2026-04-12 14-25-40)
FreeBSD,
5:56
S… Speaker 1 (2026-04-12 14-25-40)
and with macOS being Unix -based,
5:58
S… Speaker 1 (2026-04-12 14-25-40)
it's available for macOS as well.
6:01
S… Speaker 1 (2026-04-12 14-25-40)
As very similar to Wireshark,
6:05
S… Speaker 1 (2026-04-12 14-25-40)
it does have the capability
6:07
S… Speaker 1 (2026-04-12 14-25-40)
to intercept,
6:08
S… Speaker 1 (2026-04-12 14-25-40)
to display,
6:09
S… Speaker 1 (2026-04-12 14-25-40)
capture all the packets transmitted or received on the computer.
6:13
S… Speaker 1 (2026-04-12 14-25-40)
Again,
6:14
S… Speaker 1 (2026-04-12 14-25-40)
very similar capabilities to Wireshark and T -Shark.
6:17
S… Speaker 1 (2026-04-12 14-25-40)
And we will take a look at TCP dump as we go throughout this
6:21
S… Speaker 1 (2026-04-12 14-25-40)
course as well.
6:22
S… Speaker 1 (2026-04-12 14-25-40)
And just a quick screenshot of TCP dump being used.
6:26
S… Speaker 2 (2026-04-12 14-25-40)
Very simple command.
6:28
S… Speaker 2 (2026-04-12 14-25-40)
In this case,
6:28
S… Speaker 1 (2026-04-12 14-25-40)
it is running on the specified interface of
6:32
S… Speaker 1 (2026-04-12 14-25-40)
eth0 and displaying the packets it intercepted there.
6:36
S… Speaker 1 (2026-04-12 14-25-40)
It looks like these are all going to be DNS packets,
6:40
S… Speaker 1 (2026-04-12 14-25-40)
specifically looks like reverse DNS.
6:44
S… Speaker 2 (2026-04-12 14-25-40)
Moving on,
6:45
S… Speaker 1 (2026-04-12 14-25-40)
there are a couple other applications that are useful in threat
6:49
S… Speaker 1 (2026-04-12 14-25-40)
hunting.
6:49
S… Speaker 1 (2026-04-12 14-25-40)
The first one I want to talk about is NetWitness Investigator.
6:53
S… Speaker 1 (2026-04-12 14-25-40)
Now,
6:53
S… Speaker 1 (2026-04-12 14-25-40)
if you're familiar with NetWitness,
6:54
S… Speaker 1 (2026-04-12 14-25-40)
you know that there is another product that is known as the NetWitness SIM.
6:58
S… Speaker 1 (2026-04-12 14-25-40)
This is different than that full platform.
7:02
S… Speaker 1 (2026-04-12 14-25-40)
This is just the NetWitness Investigator that I'm talking about here.
7:07
S… Speaker 1 (2026-04-12 14-25-40)
It has the ability to analyze information from previously
7:11
S… Speaker 1 (2026-04-12 14-25-40)
captured PCAP files.
7:13
S… Speaker 1 (2026-04-12 14-25-40)
and show important information kind of in a different type
7:17
S… Speaker 1 (2026-04-12 14-25-40)
of summary that can be a lot easier to read than Wireshark.
7:22
S… Speaker 1 (2026-04-12 14-25-40)
It can call out specific information like the types
7:26
S… Speaker 1 (2026-04-12 14-25-40)
of services that were discovered in the capture file,
7:29
S… Speaker 1 (2026-04-12 14-25-40)
source and destination IPs and ports,
7:32
S… Speaker 1 (2026-04-12 14-25-40)
email addresses,
7:33
S… Speaker 1 (2026-04-12 14-25-40)
host names that are found in there,
7:35
S… Speaker 1 (2026-04-12 14-25-40)
all kinds of other information.
7:37
S… Speaker 1 (2026-04-12 14-25-40)
Now, we're not going to specifically use NetWitness in
7:42
S… Speaker 1 (2026-04-12 14-25-40)
this course,
7:44
S… Speaker 1 (2026-04-12 14-25-40)
as there's another application we're
7:48
S… Speaker 1 (2026-04-12 14-25-40)
going to use instead,
7:49
S… Speaker 1 (2026-04-12 14-25-40)
and that is known as Network Miner.
7:52
S… Speaker 1 (2026-04-12 14-25-40)
We will take a look at Network Miner in this course.
7:55
S… Speaker 1 (2026-04-12 14-25-40)
Very similar to NetWitness Investigator,
7:58
S… Speaker 1 (2026-04-12 14-25-40)
it has the ability,
7:59
S… Speaker 1 (2026-04-12 14-25-40)
in this case, to capture and analyze packets.
8:02
S… Speaker 1 (2026-04-12 14-25-40)
And it can summarize the information in a very similar
8:07
S… Speaker 1 (2026-04-12 14-25-40)
manner to Net Witness Investigator as well.
8:11
S… Speaker 2 (2026-04-12 14-25-40)
In addition,
8:11
S… Speaker 1 (2026-04-12 14-25-40)
it has the functionality for keyword searching,
8:14
S… Speaker 1 (2026-04-12 14-25-40)
for calling out specific anomalies,
8:16
S… Speaker 1 (2026-04-12 14-25-40)
things like that.
8:17
S… Speaker 1 (2026-04-12 14-25-40)
But it's two additional applications that I wanted to call out.
8:21
S… Speaker 2 (2026-04-12 14-25-40)
In this case,
8:22
S… Speaker 1 (2026-04-12 14-25-40)
NetWitness Investigator is a Windows -only product.
8:25
S… Speaker 1 (2026-04-12 14-25-40)
NetworkMiner is a cross -platform product.
8:28
S… Speaker 1 (2026-04-12 14-25-40)
And both of these are just really different ways of analyzing
8:33
S… Speaker 1 (2026-04-12 14-25-40)
captured network traffic and network information.
8:37
S… Speaker 1 (2026-04-12 14-25-40)
All of the same information is going to be available in a capture file
8:41
S… Speaker 1 (2026-04-12 14-25-40)
regardless of what application you use to
8:45
S… Speaker 1 (2026-04-12 14-25-40)
analyze it.
8:46
S… Speaker 1 (2026-04-12 14-25-40)
All the information will still be in there.
8:48
S… Speaker 1 (2026-04-12 14-25-40)
The only thing that would affect the information that's in the capture file
8:52
S… Speaker 1 (2026-04-12 14-25-40)
is what application that was used to
8:56
S… Speaker 1 (2026-04-12 14-25-40)
capture the information,
8:58
S… Speaker 1 (2026-04-12 14-25-40)
how that traffic was captured,
9:01
S… Speaker 1 (2026-04-12 14-25-40)
what method was used.
9:03
S… Speaker 2 (2026-04-12 14-25-40)
the specific tool was used,
9:04
S… Speaker 1 (2026-04-12 14-25-40)
and any capture filters that may have been used as well.
9:09
S… Speaker 1 (2026-04-12 14-25-40)
So a few different tools that are very useful for capturing network
9:13
S… Speaker 1 (2026-04-12 14-25-40)
data, and a few that we're going to be taking a look at in depth in this
9:17
S… Speaker 1 (2026-04-12 14-25-40)
course as well.
9:18
S… Speaker 1 (2026-04-12 14-25-40)
So
9:25
S… Speaker 1 (2026-04-12 14-25-40)
the filter we're going to enter.

Selle transkripti tekitas AI (kõne automaatset äratundmist). Võib sisaldada vigu ® kontrollida originaalheli kriitiliseks kasutamiseks. AI poliitika

❤️ Meeldib STT.ai? Räägi sõpradele!
Kokkuvõte
Klõpsa selle ärakirja AI kokkuvõtte genereerimiseks kokkuvõtvalt.
Kokkuvõtvalt...
Küsi AI selle transkripti kohta
Küsige selle ärakirja kohta midagi, AI leiab asjakohased lõigud ja vastab.
Transheeri teine