2026-04-12 14-49-09

May 25, 2026 13:46 · 10:31 · English · Whisper Turbo · 2 المتكلمون
تنتهي صلاحية هذا النص اليوم. تحسين التخزين الدائم →
فهرس المحاضرات
العرض فقط
0:08
S… Speaker 1 (2026-04-12 14-49-09)
In this video,
0:09
S… Speaker 2 (2026-04-12 14-49-09)
we're going to take a look at how we can capture packets
0:13
S… Speaker 2 (2026-04-12 14-49-09)
within Linux.
0:15
S… Speaker 1 (2026-04-12 14-49-09)
Now,
0:16
S… Speaker 2 (2026-04-12 14-49-09)
Wireshark can be used in Linux,
0:18
S… Speaker 2 (2026-04-12 14-49-09)
but if you only have a terminal
0:22
S… Speaker 2 (2026-04-12 14-49-09)
-based access to Linux,
0:24
S… Speaker 2 (2026-04-12 14-49-09)
well, you can still use a component of Wireshark known as tshark,
0:28
S… Speaker 2 (2026-04-12 14-49-09)
but if you don't have access to Wireshark,
0:31
S… Speaker 2 (2026-04-12 14-49-09)
you can use another utility called tcpdump.
0:35
S… Speaker 2 (2026-04-12 14-49-09)
The syntax for TCP dump is pretty simple.
0:38
S… Speaker 2 (2026-04-12 14-49-09)
You use the command TCP dump,
0:41
S… Speaker 2 (2026-04-12 14-49-09)
a number of options,
0:43
S… Speaker 2 (2026-04-12 14-49-09)
which we'll take a look at a couple of those here in a second.
0:45
S… Speaker 2 (2026-04-12 14-49-09)
followed by any sort of expression that you wish to use to filter
0:50
S… Speaker 2 (2026-04-12 14-49-09)
it. Now, if you remember,
0:52
S… Speaker 2 (2026-04-12 14-49-09)
both Wireshark and TCP dump use
0:56
S… Speaker 2 (2026-04-12 14-49-09)
the Berkeley packet filter syntax for capture
1:01
S… Speaker 2 (2026-04-12 14-49-09)
filters.
1:01
S… Speaker 2 (2026-04-12 14-49-09)
So capture filters that you would use in Wireshark are going to be the same that you would use
1:06
S… Speaker 2 (2026-04-12 14-49-09)
in TCP dump.
1:07
S… Speaker 2 (2026-04-12 14-49-09)
So just keep that in mind when you're looking at these capture filters.
1:12
S… Speaker 2 (2026-04-12 14-49-09)
A couple of useful options.
1:14
S… Speaker 2 (2026-04-12 14-49-09)
We have an example there of what a simple command would look like.
1:18
S… Speaker 1 (2026-04-12 14-49-09)
TCP dump,
1:19
S… Speaker 2 (2026-04-12 14-49-09)
in order to capture packets,
1:20
S… Speaker 2 (2026-04-12 14-49-09)
does require root access.
1:21
S… Speaker 2 (2026-04-12 14-49-09)
So we have our sudo TCP dump.
1:23
S… Speaker 1 (2026-04-12 14-49-09)
And in this instance,
1:25
S… Speaker 2 (2026-04-12 14-49-09)
we are specifying the interface we are going to capture on.
1:29
S… Speaker 2 (2026-04-12 14-49-09)
Some of the more useful options you may use in TCBDump
1:33
S… Speaker 2 (2026-04-12 14-49-09)
is to, one,
1:34
S… Speaker 2 (2026-04-12 14-49-09)
list the interfaces that you have access to or you can capture
1:38
S… Speaker 1 (2026-04-12 14-49-09)
from.
1:39
S… Speaker 2 (2026-04-12 14-49-09)
You have dash C,
1:41
S… Speaker 2 (2026-04-12 14-49-09)
which will capture either a certain number of
1:45
S… Speaker 2 (2026-04-12 14-49-09)
packets and then stop capturing,
1:46
S… Speaker 2 (2026-04-12 14-49-09)
or will allow a certain number of packets to flow
1:52
S… Speaker 2 (2026-04-12 14-49-09)
before the capture actually starts,
1:55
S… Speaker 2 (2026-04-12 14-49-09)
depending on how you use it.
1:57
S… Speaker 2 (2026-04-12 14-49-09)
Another useful one is dash W,
1:59
S… Speaker 2 (2026-04-12 14-49-09)
which will actually save the capture to a file
2:03
S… Speaker 2 (2026-04-12 14-49-09)
that you can later either import into TCP dump or open
2:07
S… Speaker 2 (2026-04-12 14-49-09)
in another application like Wireshark to be able to analyze it.
2:12
S… Speaker 2 (2026-04-12 14-49-09)
There are a lot of different capture filters you can use as well.
2:16
S… Speaker 2 (2026-04-12 14-49-09)
Again, they are using the Berkeley packet filter to
2:20
S… Speaker 2 (2026-04-12 14-49-09)
filter
2:24
S… Speaker 2 (2026-04-12 14-49-09)
those out.
2:25
S… Speaker 2 (2026-04-12 14-49-09)
It is the same syntax as Wireshark.
2:29
S… Speaker 2 (2026-04-12 14-49-09)
For more information on TCP Domp,
2:31
S… Speaker 2 (2026-04-12 14-49-09)
including all of the options you can look at,
2:35
S… Speaker 2 (2026-04-12 14-49-09)
I highly recommend taking a look at the manual they have.
2:38
S… Speaker 2 (2026-04-12 14-49-09)
The link for it there is on the screen at tcpdump .org.
2:43
S… Speaker 2 (2026-04-12 14-49-09)
A lot of useful information in there,
2:46
S… Speaker 2 (2026-04-12 14-49-09)
including all of the possible options and a lot of examples
2:50
S… Speaker 2 (2026-04-12 14-49-09)
of filter expressions you can use as well.
2:53
S… Speaker 1 (2026-04-12 14-49-09)
So with that out of the way,
2:55
S… Speaker 1 (2026-04-12 14-49-09)
let's switch over to our lab environment again,
2:57
S… Speaker 2 (2026-04-12 14-49-09)
and we're going to take a look at how to capture packets using TCP
3:02
S… Speaker 2 (2026-04-12 14-49-09)
dump on a Linux machine.
3:05
S… Speaker 1 (2026-04-12 14-49-09)
Alright,
3:06
S… Speaker 1 (2026-04-12 14-49-09)
so over in our lab environment,
3:08
S… Speaker 2 (2026-04-12 14-49-09)
the very first thing we're going to do is take a look at the interfaces
3:13
S… Speaker 2 (2026-04-12 14-49-09)
we have available.
3:14
S… Speaker 2 (2026-04-12 14-49-09)
So we'll do that with the list interfaces command
3:18
S… Speaker 1 (2026-04-12 14-49-09)
here.
3:19
S… Speaker 2 (2026-04-12 14-49-09)
Very similar list of interfaces that we saw in Wireshark
3:23
S… Speaker 2 (2026-04-12 14-49-09)
if you've already watched that video on capturing packets with Wireshark.
3:28
S… Speaker 2 (2026-04-12 14-49-09)
The one we're going to look at and be concerned about is ETH0,
3:31
S… Speaker 2 (2026-04-12 14-49-09)
so number one there.
3:33
S… Speaker 2 (2026-04-12 14-49-09)
So the very first thing we're going to do is,
3:35
S… Speaker 2 (2026-04-12 14-49-09)
or actually the second thing we're going to do since we've already done the first one,
3:38
S… Speaker 2 (2026-04-12 14-49-09)
is we're going to capture packets just on ETH0.
3:42
S… Speaker 2 (2026-04-12 14-49-09)
We're going to capture all the packets coming through on ETH0.
3:46
S… Speaker 1 (2026-04-12 14-49-09)
And as you can see,
3:47
S… Speaker 2 (2026-04-12 14-49-09)
we have a lot of stuff starting out with a lot of ARP requests and replies.
3:52
S… Speaker 2 (2026-04-12 14-49-09)
Just a lot of general traffic.
3:54
S… Speaker 1 (2026-04-12 14-49-09)
And as you can see,
3:55
S… Speaker 2 (2026-04-12 14-49-09)
it flows through pretty quick.
3:57
S… Speaker 2 (2026-04-12 14-49-09)
We'll get some HTTP traffic in there.
4:00
S… Speaker 2 (2026-04-12 14-49-09)
And again, a little difficult to see in here just
4:04
S… Speaker 2 (2026-04-12 14-49-09)
because of the speed with which it kind of flows through.
4:07
S… Speaker 2 (2026-04-12 14-49-09)
And on a larger network,
4:09
S… Speaker 2 (2026-04-12 14-49-09)
you're going to see a lot more of that as well.
4:12
S… Speaker 1 (2026-04-12 14-49-09)
So we'll stop that.
4:13
S… Speaker 2 (2026-04-12 14-49-09)
And we can see there were 246 packets captured
4:17
S… Speaker 1 (2026-04-12 14-49-09)
right there.
4:18
S… Speaker 2 (2026-04-12 14-49-09)
So we'll clear that out.
4:19
S… Speaker 2 (2026-04-12 14-49-09)
That is how we capture all of the traffic on the
4:23
S… Speaker 1 (2026-04-12 14-49-09)
interface.
4:24
S… Speaker 1 (2026-04-12 14-49-09)
But say,
4:25
S… Speaker 2 (2026-04-12 14-49-09)
like we did in Wireshark,
4:26
S… Speaker 2 (2026-04-12 14-49-09)
we only want to capture HTTP traffic.
4:29
S… Speaker 1 (2026-04-12 14-49-09)
So again,
4:31
S… Speaker 2 (2026-04-12 14-49-09)
we'll do the TCP dump.
4:32
S… Speaker 2 (2026-04-12 14-49-09)
And then we don't need to specify the interface
4:37
S… Speaker 1 (2026-04-12 14-49-09)
here.
4:37
S… Speaker 2 (2026-04-12 14-49-09)
We can leave it out or we can include it.
4:40
S… Speaker 1 (2026-04-12 14-49-09)
We'll go ahead and include it here.
4:41
S… Speaker 2 (2026-04-12 14-49-09)
And then we're going to include a capture filter as
4:46
S… Speaker 1 (2026-04-12 14-49-09)
well.
4:46
S… Speaker 2 (2026-04-12 14-49-09)
Just like we did in...
4:49
S… Speaker 2 (2026-04-12 14-49-09)
Wireshark will do TCP port 80,
4:51
S… Speaker 2 (2026-04-12 14-49-09)
ignore the rest of the command that it's trying to suggest.
4:54
S… Speaker 2 (2026-04-12 14-49-09)
We'll get to that in a second.
4:56
S… Speaker 2 (2026-04-12 14-49-09)
So we're starting a packet capture here.
5:00
S… Speaker 2 (2026-04-12 14-49-09)
just using TCP port 80 as
5:04
S… Speaker 2 (2026-04-12 14-49-09)
we can see there in the capture filter.
5:06
S… Speaker 2 (2026-04-12 14-49-09)
And we have no packets showing yet because,
5:09
S… Speaker 2 (2026-04-12 14-49-09)
well, there's no traffic flowing.
5:10
S… Speaker 1 (2026-04-12 14-49-09)
However,
5:11
S… Speaker 2 (2026-04-12 14-49-09)
if we come over here to the Never SSL site again,
5:14
S… Speaker 1 (2026-04-12 14-49-09)
refresh the page,
5:15
S… Speaker 2 (2026-04-12 14-49-09)
we immediately see traffic on port 80.
5:20
S… Speaker 1 (2026-04-12 14-49-09)
Again,
5:20
S… Speaker 2 (2026-04-12 14-49-09)
a little difficult to see just because there's no good column
5:25
S… Speaker 1 (2026-04-12 14-49-09)
alignment.
5:25
S… Speaker 2 (2026-04-12 14-49-09)
There's no headers that we can look at.
5:29
S… Speaker 2 (2026-04-12 14-49-09)
So it's a little more difficult to...
5:33
S… Speaker 2 (2026-04-12 14-49-09)
parse through the data just raw on the terminal here,
5:36
S… Speaker 2 (2026-04-12 14-49-09)
but we can see it is capturing it nonetheless.
5:39
S… Speaker 2 (2026-04-12 14-49-09)
So we'll clear that.
5:41
S… Speaker 2 (2026-04-12 14-49-09)
We see there were 12 packets captured there.
5:44
S… Speaker 2 (2026-04-12 14-49-09)
We can go a little more in depth with these filters.
5:47
S… Speaker 2 (2026-04-12 14-49-09)
So say we're interested in a
5:51
S… Speaker 2 (2026-04-12 14-49-09)
specific protocol from a specific
5:55
S… Speaker 2 (2026-04-12 14-49-09)
machine.
5:57
S… Speaker 1 (2026-04-12 14-49-09)
So in that case,
5:58
S… Speaker 2 (2026-04-12 14-49-09)
we'll specify eth0 again,
6:00
S… Speaker 2 (2026-04-12 14-49-09)
and we're going to set up a slightly more complex capture filter.
6:04
S… Speaker 2 (2026-04-12 14-49-09)
We're going to be concerned only with ICMP traffic,
6:07
S… Speaker 2 (2026-04-12 14-49-09)
and we are going to only include traffic from
6:11
S… Speaker 2 (2026-04-12 14-49-09)
a specific source of 192 .168 .1
6:15
S… Speaker 2 (2026-04-12 14-49-09)
.98.
6:17
S… Speaker 2 (2026-04-12 14-49-09)
So we are only looking at,
6:19
S… Speaker 2 (2026-04-12 14-49-09)
essentially in this case,
6:21
S… Speaker 2 (2026-04-12 14-49-09)
we're going to be looking at ping requests coming from that machine.
6:25
S… Speaker 2 (2026-04-12 14-49-09)
So I'll switch over to that machine and we will start pinging
6:29
S… Speaker 2 (2026-04-12 14-49-09)
it and we can immediately see the echo requests
6:33
S… Speaker 2 (2026-04-12 14-49-09)
coming in.
6:34
S… Speaker 1 (2026-04-12 14-49-09)
I'll stop that on this machine and we
6:38
S… Speaker 2 (2026-04-12 14-49-09)
can see what we have here.
6:40
S… Speaker 2 (2026-04-12 14-49-09)
So we have specifically coming from the source of 192
6:44
S… Speaker 2 (2026-04-12 14-49-09)
.168.
6:45
S… Speaker 2 (2026-04-12 14-49-09)
1 .98,
6:47
S… Speaker 2 (2026-04-12 14-49-09)
which is what we specified here in our capture filter,
6:51
S… Speaker 2 (2026-04-12 14-49-09)
going to the current machine,
6:53
S… Speaker 2 (2026-04-12 14-49-09)
and it's just ICMP traffic.
6:56
S… Speaker 2 (2026-04-12 14-49-09)
So a little more complex capture filter.
6:59
S… Speaker 2 (2026-04-12 14-49-09)
We'll go ahead and cancel that as well.
7:02
S… Speaker 1 (2026-04-12 14-49-09)
Now,
7:03
S… Speaker 2 (2026-04-12 14-49-09)
say we wanted to save a capture
7:07
S… Speaker 2 (2026-04-12 14-49-09)
because we've got a lot of information flowing through.
7:10
S… Speaker 2 (2026-04-12 14-49-09)
And we want to just save it without necessarily having
7:14
S… Speaker 2 (2026-04-12 14-49-09)
to analyze it on the command line,
7:16
S… Speaker 2 (2026-04-12 14-49-09)
which is useful,
7:17
S… Speaker 2 (2026-04-12 14-49-09)
especially if we are capturing on one machine and performing the analysis
7:21
S… Speaker 2 (2026-04-12 14-49-09)
on another.
7:23
S… Speaker 2 (2026-04-12 14-49-09)
So we're going to do another TCP dump.
7:26
S… Speaker 2 (2026-04-12 14-49-09)
We'll specify the interface of ETH 0.
7:29
S… Speaker 2 (2026-04-12 14-49-09)
And we're going to go back to our TCP port 80,
7:32
S… Speaker 2 (2026-04-12 14-49-09)
except this time we're going to specify to write.
7:36
S… Speaker 2 (2026-04-12 14-49-09)
to a file as the command was suggesting to
7:40
S… Speaker 1 (2026-04-12 14-49-09)
us there.
7:40
S… Speaker 2 (2026-04-12 14-49-09)
Thank you, Linux.
7:41
S… Speaker 2 (2026-04-12 14-49-09)
So we're going to use the dash W and then specify a
7:46
S… Speaker 2 (2026-04-12 14-49-09)
file name.
7:47
S… Speaker 2 (2026-04-12 14-49-09)
So we have our capture running there.
7:49
S… Speaker 2 (2026-04-12 14-49-09)
We'll go back over to our browser.
7:52
S… Speaker 2 (2026-04-12 14-49-09)
We'll refresh this page.
7:54
S… Speaker 2 (2026-04-12 14-49-09)
And we see that there was nothing output to
7:58
S… Speaker 2 (2026-04-12 14-49-09)
the command line because it is being written to this file right now.
8:02
S… Speaker 2 (2026-04-12 14-49-09)
So if we stop our capture,
8:05
S… Speaker 1 (2026-04-12 14-49-09)
And we can look at the files on the desktop,
8:08
S… Speaker 2 (2026-04-12 14-49-09)
and we have a test .pcap.
8:11
S… Speaker 2 (2026-04-12 14-49-09)
Now, there's two things we can do with that here.
8:13
S… Speaker 2 (2026-04-12 14-49-09)
We can either open it up using TCP dump,
8:17
S… Speaker 2 (2026-04-12 14-49-09)
using the dash R option,
8:20
S… Speaker 2 (2026-04-12 14-49-09)
and then specifying the name of the file,
8:23
S… Speaker 2 (2026-04-12 14-49-09)
and we see the information that was captured here.
8:26
S… Speaker 2 (2026-04-12 14-49-09)
Now, because it is a standard format that TCP
8:30
S… Speaker 2 (2026-04-12 14-49-09)
dump writes to,
8:31
S… Speaker 2 (2026-04-12 14-49-09)
we can also come into Wireshark.
8:34
S… Speaker 2 (2026-04-12 14-49-09)
and just open that file as well.
8:36
S… Speaker 2 (2026-04-12 14-49-09)
So we'll come over to Wireshark,
8:37
S… Speaker 2 (2026-04-12 14-49-09)
we'll hit open a capture filter.
8:39
S… Speaker 2 (2026-04-12 14-49-09)
We're already in the right folder,
8:41
S… Speaker 2 (2026-04-12 14-49-09)
so we'll hit our test .pcap here,
8:43
S… Speaker 2 (2026-04-12 14-49-09)
which is the file we just saved.
8:45
S… Speaker 1 (2026-04-12 14-49-09)
And we see the exact same information,
8:48
S… Speaker 2 (2026-04-12 14-49-09)
starting with a request from port 60 ,556
8:53
S… Speaker 2 (2026-04-12 14-49-09)
to port 80.
8:54
S… Speaker 2 (2026-04-12 14-49-09)
It was basically the first part of the TCP three -way handshake,
8:58
S… Speaker 2 (2026-04-12 14-49-09)
the SIN packet.
8:59
S… Speaker 2 (2026-04-12 14-49-09)
If we come back over here,
9:01
S… Speaker 2 (2026-04-12 14-49-09)
we see this is the same thing.
9:04
S… Speaker 2 (2026-04-12 14-49-09)
So we are coming from 60 ,556,
9:09
S… Speaker 1 (2026-04-12 14-49-09)
flag of S,
9:11
S… Speaker 2 (2026-04-12 14-49-09)
which indicates it is a SIN request,
9:14
S… Speaker 2 (2026-04-12 14-49-09)
and it is going to port 80,
9:16
S… Speaker 2 (2026-04-12 14-49-09)
which is indicated here as .http after the domain
9:21
S… Speaker 1 (2026-04-12 14-49-09)
name.
9:21
S… Speaker 2 (2026-04-12 14-49-09)
The same information just displayed in a different way that,
9:25
S… Speaker 1 (2026-04-12 14-49-09)
in my opinion,
9:26
S… Speaker 2 (2026-04-12 14-49-09)
is a lot easier to read.
9:29
S… Speaker 2 (2026-04-12 14-49-09)
So TCP dump is a very useful utility to
9:33
S… Speaker 2 (2026-04-12 14-49-09)
be able to capture traffic on a Linux machine,
9:37
S… Speaker 2 (2026-04-12 14-49-09)
especially if you don't necessarily have access to Wireshark.
9:41
S… Speaker 2 (2026-04-12 14-49-09)
or if you don't have access to a GUI or anything
9:45
S… Speaker 1 (2026-04-12 14-49-09)
like that,
9:46
S… Speaker 2 (2026-04-12 14-49-09)
TCP dump is a lot easier to capture in
9:50
S… Speaker 1 (2026-04-12 14-49-09)
that regard,
9:51
S… Speaker 2 (2026-04-12 14-49-09)
but still being able to use the same type of capture filters
9:55
S… Speaker 2 (2026-04-12 14-49-09)
because it is using the same syntax
9:59
S… Speaker 2 (2026-04-12 14-49-09)
for those captures as Wireshark does.
10:02
S… Speaker 2 (2026-04-12 14-49-09)
You can write the files and you can analyze those PCAP
10:07
S… Speaker 1 (2026-04-12 14-49-09)
files.
10:08
S… Speaker 2 (2026-04-12 14-49-09)
on a different machine at a later date using either TCP
10:12
S… Speaker 2 (2026-04-12 14-49-09)
dump, which can be a little complicated to look at as you can see here,
10:15
S… Speaker 2 (2026-04-12 14-49-09)
or using something like Wireshark,
10:18
S… Speaker 2 (2026-04-12 14-49-09)
which makes it a lot simpler to parse through the information that
10:22
S… Speaker 2 (2026-04-12 14-49-09)
was previously captured.

هذا النص تم إنتاجه بواسطة AI (التعرف الآلي على الكلام). قد يحتوي على أخطاء - التحقق من الصوت الأصلي للاستخدام الحرج. سياسة الذكاء الاصطناعي

❤️ هل تحب STT.ai؟ أخبر أصدقاءك!
موجز تنفيذي
انقر على ملخص لإنشاء ملخص للذكاء الاصطناعي لهذا النص.
وباختصار...
اسأل AI عن هذا النص
وإذا سألت عن أي شيء في هذا النص، سيجد المحقق الخاص الأقسام ذات الصلة ويجيبك.
تفريغ آخر