2026-04-12 14-25-40

May 25, 2026 13:42 · 9:29 · English · Whisper Turbo · 2 スピーカー
この成績は今日で有効期限が切れる。 永久ストレージのアップグレード →
講義索引
表示のみ
0:07
S… Speaker 1 (2026-04-12 14-25-40)
Once network data is captured,
0:10
S… Speaker 1 (2026-04-12 14-25-40)
that is where the analysis portion of the threat
0:14
S… Speaker 1 (2026-04-12 14-25-40)
hunting comes in.
0:15
S… Speaker 1 (2026-04-12 14-25-40)
And we're going to take a look in this video at a couple of different tools that
0:20
S… Speaker 1 (2026-04-12 14-25-40)
are used for network analysis.
0:22
S… Speaker 1 (2026-04-12 14-25-40)
Now,
0:23
S… Speaker 1 (2026-04-12 14-25-40)
before we get into specific tools,
0:25
S… Speaker 1 (2026-04-12 14-25-40)
I want to talk about a library known as libpcap.
0:29
S… Speaker 1 (2026-04-12 14-25-40)
This is a Unix -based library that was originally written and
0:33
S… Speaker 1 (2026-04-12 14-25-40)
provides a lot of the capabilities that we see
0:36
S… Speaker 1 (2026-04-12 14-25-40)
in some of the more popular packet sniffing applications,
0:39
S… Speaker 1 (2026-04-12 14-25-40)
packet capture,
0:41
S… Speaker 1 (2026-04-12 14-25-40)
and analysis applications as well.
0:43
S… Speaker 1 (2026-04-12 14-25-40)
Both Wireshark and TCP dump,
0:47
S… Speaker 1 (2026-04-12 14-25-40)
two applications we'll take a look at in this course,
0:50
S… Speaker 1 (2026-04-12 14-25-40)
are based off of libpcap.
0:53
S… Speaker 1 (2026-04-12 14-25-40)
Now, Wireshark,
0:54
S… Speaker 1 (2026-04-12 14-25-40)
when I talk about Wireshark being based on libpcap,
0:56
S… Speaker 1 (2026-04-12 14-25-40)
that is technically going to be the Linux version of it.
0:59
S… Speaker 1 (2026-04-12 14-25-40)
The Windows version was originally based on a library known
1:03
S… Speaker 1 (2026-04-12 14-25-40)
as winpcap.
1:06
S… Speaker 1 (2026-04-12 14-25-40)
This is basically the libpcap library,
1:08
S… Speaker 1 (2026-04-12 14-25-40)
but for Windows instead.
1:10
S… Speaker 1 (2026-04-12 14-25-40)
However, it is no longer developed or maintained or supported
1:14
S… Speaker 1 (2026-04-12 14-25-40)
and has been replaced by a library known as npcap.
1:19
S… Speaker 1 (2026-04-12 14-25-40)
The n there standing,
1:21
S… Speaker 1 (2026-04-12 14-25-40)
meaning nmap,
1:23
S… Speaker 1 (2026-04-12 14-25-40)
because it was created by the nmap project.
1:27
S… Speaker 1 (2026-04-12 14-25-40)
So LibPCAP is going to be the basis on a lot of the applications
1:32
S… Speaker 1 (2026-04-12 14-25-40)
we're going to look at for packet analysis and also packet capture
1:36
S… Speaker 1 (2026-04-12 14-25-40)
as well.
1:37
S… Speaker 1 (2026-04-12 14-25-40)
One of the kind of main features that it's important
1:42
S… Speaker 1 (2026-04-12 14-25-40)
to be aware of with libpcap is what's known as the Berkeley
1:46
S… Speaker 1 (2026-04-12 14-25-40)
Packet Filter or BPF.
1:50
S… Speaker 1 (2026-04-12 14-25-40)
This is basically a way to filter
1:54
S… Speaker 1 (2026-04-12 14-25-40)
down the packets that are captured by any
1:58
S… Speaker 1 (2026-04-12 14-25-40)
specific application.
1:59
S… Speaker 1 (2026-04-12 14-25-40)
It is a specific syntax used for
2:04
S… Speaker 1 (2026-04-12 14-25-40)
these capture filters.
2:06
S… Speaker 1 (2026-04-12 14-25-40)
that's used in many different applications.
2:09
S… Speaker 1 (2026-04-12 14-25-40)
So it's important to be familiar with that syntax.
2:13
S… Speaker 1 (2026-04-12 14-25-40)
And we'll take a look at this syntax as we get into things
2:17
S… Speaker 1 (2026-04-12 14-25-40)
like Wireshark and setting up capture filters in Wireshark
2:21
S… Speaker 1 (2026-04-12 14-25-40)
as well.
2:22
S… Speaker 1 (2026-04-12 14-25-40)
So speaking of Wireshark,
2:24
S… Speaker 1 (2026-04-12 14-25-40)
let's take a brief look at that.
2:27
S… Speaker 1 (2026-04-12 14-25-40)
Quick screenshot here of what Wireshark looks like if you are not familiar
2:32
S… Speaker 1 (2026-04-12 14-25-40)
with it, but it basically is a network sniffing application,
2:36
S… Speaker 1 (2026-04-12 14-25-40)
network packet capture,
2:37
S… Speaker 1 (2026-04-12 14-25-40)
and protocol analyzer application with a lot of
2:42
S… Speaker 2 (2026-04-12 14-25-40)
various capabilities.
2:43
S… Speaker 1 (2026-04-12 14-25-40)
It is used by many different specializations in
2:47
S… Speaker 1 (2026-04-12 14-25-40)
IT.
2:49
S… Speaker 1 (2026-04-12 14-25-40)
And it allows for the analysis of any
2:53
S… Speaker 1 (2026-04-12 14-25-40)
network traffic on a specific computer,
2:56
S… Speaker 1 (2026-04-12 14-25-40)
whatever that computer,
2:57
S… Speaker 1 (2026-04-12 14-25-40)
whatever computer Wireshark is installed on,
3:00
S… Speaker 1 (2026-04-12 14-25-40)
it can analyze and capture all the network traffic on
3:04
S… Speaker 1 (2026-04-12 14-25-40)
that interface.
3:05
S… Speaker 1 (2026-04-12 14-25-40)
It is cross -platform,
3:07
S… Speaker 1 (2026-04-12 14-25-40)
so it is available for Windows,
3:09
S… Speaker 2 (2026-04-12 14-25-40)
Linux,
3:10
S… Speaker 1 (2026-04-12 14-25-40)
and as you can see in that screenshot there,
3:12
S… Speaker 1 (2026-04-12 14-25-40)
that is the Mac OS flavor of.
3:15
S… Speaker 1 (2026-04-12 14-25-40)
Wireshark.
3:16
S… Speaker 1 (2026-04-12 14-25-40)
So it is cross -platform,
3:17
S… Speaker 1 (2026-04-12 14-25-40)
so it can be used regardless of which operating system you're
3:21
S… Speaker 1 (2026-04-12 14-25-40)
using at the moment.
3:23
S… Speaker 1 (2026-04-12 14-25-40)
And it has a lot of different capabilities.
3:26
S… Speaker 1 (2026-04-12 14-25-40)
First of all,
3:27
S… Speaker 1 (2026-04-12 14-25-40)
it can perform the live packet captures and the live
3:31
S… Speaker 1 (2026-04-12 14-25-40)
analysis of those packets as they come in.
3:35
S… Speaker 1 (2026-04-12 14-25-40)
And it also has the ability to save that captured data in
3:39
S… Speaker 1 (2026-04-12 14-25-40)
a PCAP file,
3:40
S… Speaker 1 (2026-04-12 14-25-40)
a packet capture file.
3:43
S… Speaker 1 (2026-04-12 14-25-40)
PCAP being one of the wider used standards
3:48
S… Speaker 1 (2026-04-12 14-25-40)
for packet capture files.
3:50
S… Speaker 1 (2026-04-12 14-25-40)
And as it has the ability to save these files,
3:53
S… Speaker 1 (2026-04-12 14-25-40)
it also has the ability to analyze the previous
3:57
S… Speaker 1 (2026-04-12 14-25-40)
captures regardless of what application they were captured in.
4:01
S… Speaker 1 (2026-04-12 14-25-40)
It does have the ability to analyze the previous captures as long as
4:05
S… Speaker 1 (2026-04-12 14-25-40)
they were saved in a compatible format of which there are a number
4:09
S… Speaker 1 (2026-04-12 14-25-40)
of them.
4:11
S… Speaker 1 (2026-04-12 14-25-40)
It does have the capability to implement both capture
4:15
S… Speaker 1 (2026-04-12 14-25-40)
and display filters.
4:17
S… Speaker 1 (2026-04-12 14-25-40)
And you can see in this screenshot here,
4:19
S… Speaker 1 (2026-04-12 14-25-40)
you've got a section to enter capture filters right there
4:23
S… Speaker 1 (2026-04-12 14-25-40)
and a section where you can enter in display filters as
4:27
S… Speaker 1 (2026-04-12 14-25-40)
well. Again,
4:28
S… Speaker 1 (2026-04-12 14-25-40)
these do use different syntaxes with the capture
4:32
S… Speaker 1 (2026-04-12 14-25-40)
filter using the Berkeley packet filter syntax.
4:36
S… Speaker 1 (2026-04-12 14-25-40)
and the display filters in Wireshark using their own
4:40
S… Speaker 1 (2026-04-12 14-25-40)
syntax there.
4:42
S… Speaker 2 (2026-04-12 14-25-40)
In addition,
4:43
S… Speaker 1 (2026-04-12 14-25-40)
you have the ability to do what they call following the stream
4:47
S… Speaker 1 (2026-04-12 14-25-40)
in which you can select a specific packet
4:51
S… Speaker 1 (2026-04-12 14-25-40)
in the interface and be able to kind of just essentially
4:55
S… Speaker 1 (2026-04-12 14-25-40)
right click and follow the stream depending on what type of packet it is
4:59
S… Speaker 1 (2026-04-12 14-25-40)
to be able to see all of the information kind of in one view
5:03
S… Speaker 1 (2026-04-12 14-25-40)
instead of seeing all of the packets for all of
5:07
S… Speaker 1 (2026-04-12 14-25-40)
the streams all at once in the display.
5:10
S… Speaker 1 (2026-04-12 14-25-40)
It's just showing the relevant packets for that one stream.
5:14
S… Speaker 1 (2026-04-12 14-25-40)
And we will take a look at all of these features
5:18
S… Speaker 1 (2026-04-12 14-25-40)
throughout this course as we start using Wireshark more in depth.
5:23
S… Speaker 1 (2026-04-12 14-25-40)
Now, if you're not using a graphical interface,
5:26
S… Speaker 1 (2026-04-12 14-25-40)
you can still use Wireshark.
5:27
S… Speaker 1 (2026-04-12 14-25-40)
Technically, you can use the T -Shark component of Wireshark,
5:31
S… Speaker 1 (2026-04-12 14-25-40)
which is essentially just Wireshark for a terminal -based interface.
5:35
S… Speaker 1 (2026-04-12 14-25-40)
It is a command line version of Wireshark,
5:39
S… Speaker 1 (2026-04-12 14-25-40)
but it is included with the Wireshark installation.
5:42
S… Speaker 1 (2026-04-12 14-25-40)
In addition to Wireshark,
5:45
S… Speaker 1 (2026-04-12 14-25-40)
there's another application that is used for capturing filters known as TCP dump.
5:49
S… Speaker 1 (2026-04-12 14-25-40)
This is a Unix -based packet sniffer,
5:53
S… Speaker 1 (2026-04-12 14-25-40)
so it is available on Linux,
5:55
S… Speaker 1 (2026-04-12 14-25-40)
FreeBSD,
5:56
S… Speaker 1 (2026-04-12 14-25-40)
and with macOS being Unix -based,
5:58
S… Speaker 1 (2026-04-12 14-25-40)
it's available for macOS as well.
6:01
S… Speaker 1 (2026-04-12 14-25-40)
As very similar to Wireshark,
6:05
S… Speaker 1 (2026-04-12 14-25-40)
it does have the capability
6:07
S… Speaker 1 (2026-04-12 14-25-40)
to intercept,
6:08
S… Speaker 1 (2026-04-12 14-25-40)
to display,
6:09
S… Speaker 1 (2026-04-12 14-25-40)
capture all the packets transmitted or received on the computer.
6:13
S… Speaker 1 (2026-04-12 14-25-40)
Again,
6:14
S… Speaker 1 (2026-04-12 14-25-40)
very similar capabilities to Wireshark and T -Shark.
6:17
S… Speaker 1 (2026-04-12 14-25-40)
And we will take a look at TCP dump as we go throughout this
6:21
S… Speaker 1 (2026-04-12 14-25-40)
course as well.
6:22
S… Speaker 1 (2026-04-12 14-25-40)
And just a quick screenshot of TCP dump being used.
6:26
S… Speaker 2 (2026-04-12 14-25-40)
Very simple command.
6:28
S… Speaker 2 (2026-04-12 14-25-40)
In this case,
6:28
S… Speaker 1 (2026-04-12 14-25-40)
it is running on the specified interface of
6:32
S… Speaker 1 (2026-04-12 14-25-40)
eth0 and displaying the packets it intercepted there.
6:36
S… Speaker 1 (2026-04-12 14-25-40)
It looks like these are all going to be DNS packets,
6:40
S… Speaker 1 (2026-04-12 14-25-40)
specifically looks like reverse DNS.
6:44
S… Speaker 2 (2026-04-12 14-25-40)
Moving on,
6:45
S… Speaker 1 (2026-04-12 14-25-40)
there are a couple other applications that are useful in threat
6:49
S… Speaker 1 (2026-04-12 14-25-40)
hunting.
6:49
S… Speaker 1 (2026-04-12 14-25-40)
The first one I want to talk about is NetWitness Investigator.
6:53
S… Speaker 1 (2026-04-12 14-25-40)
Now,
6:53
S… Speaker 1 (2026-04-12 14-25-40)
if you're familiar with NetWitness,
6:54
S… Speaker 1 (2026-04-12 14-25-40)
you know that there is another product that is known as the NetWitness SIM.
6:58
S… Speaker 1 (2026-04-12 14-25-40)
This is different than that full platform.
7:02
S… Speaker 1 (2026-04-12 14-25-40)
This is just the NetWitness Investigator that I'm talking about here.
7:07
S… Speaker 1 (2026-04-12 14-25-40)
It has the ability to analyze information from previously
7:11
S… Speaker 1 (2026-04-12 14-25-40)
captured PCAP files.
7:13
S… Speaker 1 (2026-04-12 14-25-40)
and show important information kind of in a different type
7:17
S… Speaker 1 (2026-04-12 14-25-40)
of summary that can be a lot easier to read than Wireshark.
7:22
S… Speaker 1 (2026-04-12 14-25-40)
It can call out specific information like the types
7:26
S… Speaker 1 (2026-04-12 14-25-40)
of services that were discovered in the capture file,
7:29
S… Speaker 1 (2026-04-12 14-25-40)
source and destination IPs and ports,
7:32
S… Speaker 1 (2026-04-12 14-25-40)
email addresses,
7:33
S… Speaker 1 (2026-04-12 14-25-40)
host names that are found in there,
7:35
S… Speaker 1 (2026-04-12 14-25-40)
all kinds of other information.
7:37
S… Speaker 1 (2026-04-12 14-25-40)
Now, we're not going to specifically use NetWitness in
7:42
S… Speaker 1 (2026-04-12 14-25-40)
this course,
7:44
S… Speaker 1 (2026-04-12 14-25-40)
as there's another application we're
7:48
S… Speaker 1 (2026-04-12 14-25-40)
going to use instead,
7:49
S… Speaker 1 (2026-04-12 14-25-40)
and that is known as Network Miner.
7:52
S… Speaker 1 (2026-04-12 14-25-40)
We will take a look at Network Miner in this course.
7:55
S… Speaker 1 (2026-04-12 14-25-40)
Very similar to NetWitness Investigator,
7:58
S… Speaker 1 (2026-04-12 14-25-40)
it has the ability,
7:59
S… Speaker 1 (2026-04-12 14-25-40)
in this case, to capture and analyze packets.
8:02
S… Speaker 1 (2026-04-12 14-25-40)
And it can summarize the information in a very similar
8:07
S… Speaker 1 (2026-04-12 14-25-40)
manner to Net Witness Investigator as well.
8:11
S… Speaker 2 (2026-04-12 14-25-40)
In addition,
8:11
S… Speaker 1 (2026-04-12 14-25-40)
it has the functionality for keyword searching,
8:14
S… Speaker 1 (2026-04-12 14-25-40)
for calling out specific anomalies,
8:16
S… Speaker 1 (2026-04-12 14-25-40)
things like that.
8:17
S… Speaker 1 (2026-04-12 14-25-40)
But it's two additional applications that I wanted to call out.
8:21
S… Speaker 2 (2026-04-12 14-25-40)
In this case,
8:22
S… Speaker 1 (2026-04-12 14-25-40)
NetWitness Investigator is a Windows -only product.
8:25
S… Speaker 1 (2026-04-12 14-25-40)
NetworkMiner is a cross -platform product.
8:28
S… Speaker 1 (2026-04-12 14-25-40)
And both of these are just really different ways of analyzing
8:33
S… Speaker 1 (2026-04-12 14-25-40)
captured network traffic and network information.
8:37
S… Speaker 1 (2026-04-12 14-25-40)
All of the same information is going to be available in a capture file
8:41
S… Speaker 1 (2026-04-12 14-25-40)
regardless of what application you use to
8:45
S… Speaker 1 (2026-04-12 14-25-40)
analyze it.
8:46
S… Speaker 1 (2026-04-12 14-25-40)
All the information will still be in there.
8:48
S… Speaker 1 (2026-04-12 14-25-40)
The only thing that would affect the information that's in the capture file
8:52
S… Speaker 1 (2026-04-12 14-25-40)
is what application that was used to
8:56
S… Speaker 1 (2026-04-12 14-25-40)
capture the information,
8:58
S… Speaker 1 (2026-04-12 14-25-40)
how that traffic was captured,
9:01
S… Speaker 1 (2026-04-12 14-25-40)
what method was used.
9:03
S… Speaker 2 (2026-04-12 14-25-40)
the specific tool was used,
9:04
S… Speaker 1 (2026-04-12 14-25-40)
and any capture filters that may have been used as well.
9:09
S… Speaker 1 (2026-04-12 14-25-40)
So a few different tools that are very useful for capturing network
9:13
S… Speaker 1 (2026-04-12 14-25-40)
data, and a few that we're going to be taking a look at in depth in this
9:17
S… Speaker 1 (2026-04-12 14-25-40)
course as well.
9:18
S… Speaker 1 (2026-04-12 14-25-40)
So
9:25
S… Speaker 1 (2026-04-12 14-25-40)
the filter we're going to enter.

この転写は AI (自動音声認識) で生成されました。エラーが含まれている可能性があります。重要な場合は、オリジナルのオーディオと比較してください。 AI政策

❤️ STT.aiが好きですか? 友達に教えてあげましょう!
要約
この転写の AI 要約を生成するには 要約をクリックしてください。
要約中...
この転写についてAIに尋ねる
これらの記録に関して何か質問があれば、AIは関連する部分を見つけて答えます。
別のものを転写