‫What's going on, guys?
‫My name is Hussein, and welcome to another episode of Wireshark of them all when we wireshark every
‫single particle and existing back in engineering.
‫So how about we jump into it today?
‫Today we are wired shanking or shanking wire sharking.
‫Mongo DB is going to be extreme fun.
‫So among the TV guys is a known sequel database.
‫That's a key value store and I already spent up Mangel Atlas database with the user and and all that
‫stuff.
‫They they give me a free assistance with three, three shards, three clusters, one cluster, three
‫shards.
‫And we're going to just basically run this code which connects to the database, does a little bit of
‫sleep just because I want to see what's going on there and then connect to the database called Thunderbolt,
‫which I created there, gets the employee and literally find the employee that's name Hussein and then
‫execute a search cursor.
‫And then once we get the search console we printed and then after that we close the connection.
‫So I'm going to show you that.
‫And then slowly, I'm going to start breaking up the connections one by one after each operation.
‫So how about we do that?
‫So here's a Wireshark I filtered based on Amazon's public IP addresses, which is there, which is the
‫provider I'm using for Mongul atleast for Monga to be Atlas, least that's the IP address.
‫So now anything going to that IP address will be logged here.
‫And another thing I did, I use SSL key log NPM package for NOGs to split up that session to Lasky's
‫because Mongo DB is always encrypted by default.
‫Golf upload for Mongo DB team.
‫That's awesome.
‫Right.
‫So because it's encrypted, I won't be won't be able to see it in Warshak unless I decrypted.
‫And in order to do that I spit up the key logs.
‫Right, the key log which I showed how to do that and stood to you when we wireshark to.
‫And once we do that I said that that key to.
‫Ta ta ta wireshark in the TLS option here, where the.
‫Right here, and that basically will allow Wireshark to decrypt the keys because no one in the middle
‫can actually decrypt anything, right, until unless they have the final exchange keys.
‫And this works on any cipher, whether defacement, elliptic, cooperative element, anything, because
‫you're at the end of the line.
‫So you do have the keys.
‫This is just an option for for a four month form, no gas to spit of those keys so we can use them for
‫debugging purposes.
‫All right.
‫How about we jump into it?
‫So I'm going to go ahead and run out there.
‫All right.
‫I'm going to go ahead and run node tester, Jess.
‫And what this will do, it will literally connect.
‫Spends.
‫Brent and then close.
‫That's it.
‫So Prince Hussein, which is the employee we found and then closed the connection.
‫Let's go to beautiful, beautiful Wireshark.
‫Look at all this stuff, so that's what I love about Warshak, it actually knew that we're dealing with
‫Mongo DB.
‫Look at that.
‫It actually knows the protocol.
‫It does all that stuff.
‫So how about we go through that stuff and then slowly after we go through all the operations until we
‫close the connection, where's the fun?
‫Right here.
‫I don't see often where the fanfan there is often, yeah, until we close the connection, let's go
‫through that.
‫So Mungiu just disappear.
‫So obviously since inexactly.
‫So that's the three way handshake which we talked about right here.
‫Go check it out.
‫So every TCP connection has to be first agreed on the sequence number that we will be used to basically
‫a number and you have to to agree for client sequence number and a server sequence number that will
‫be used to label those packets that you send across the wire so they can be reordered, so they can
‫be retransmitted if they are lost and things like that.
‫Lionello to eleven point three, go beautiful one.
‫Go look at this.
‫There's one of the three and this is my Mongul client, Norges.
‫Right.
‫And said, look at all this beautiful sciver so powerful suites, powerful suites.
‫Look at that stuff.
‫At Elliptic of the Fidelman there is a diffie helmond one.
‫Right.
‫It's like, all right, all right.
‫That's good stuff.
‫Good stuff.
‫Right.
‫That's not very secure if you ask me.
‫I it depends on how how is the bit size for this.
‫But look at this.
‫You can use any of these encryption methods first.
‫Which methods.
‫Right.
‫And then since we're using TLC one point three, sort of her name is and I will go into this charade.
‫So Shahd zero zero zero one, that's the primary charge that we're hitting and doing all that stuff.
‫Supporters support secession because that's part of the tools or is it a part of Kerberos?
‫I'm not sure about that.
‫I don't think you can do a comparison deal as Labora version.
‫This is the most important thing.
‫We support one point two and one point three, and we send that stuff right.
‫I'm not going to go through all this.
‫And we went through the details, the services.
‫Yo, I love you a lot.
‫Let's use tearless one point three to communicate, but we have to say one point two, unfortunately,
‫because there are dumb routers on the Web that unfortunately blocks the one point three on the version.
‫So this is fake.
‫This is not reality as one point to write the real version somewhere right here where we actually say,
‫hey, what is this one point three supported version?
‫There you go.
‫It's under supported version that we had to add and you just didn't do that stuff.
‫All right.
‫So we exchange the key and then acknowledge and send the certificate, the server sends the certificates
‫and all that stuff.
‫We talked about that many, many times in this general.
‫Verify the certificate that's the server and acknowledge acknowledge some Tsipi loss.
‫And there is the first thing we send a query.
‫What is this query?
‫All right, Mongo wire protocol.
‫We're using the wire Mongul.
‫So it's a specific protocol for Mongo.
‫It's around three hundred byte, not that big as good.
‫And look at this, where querying a database called Edman.
‫Technically, I didn't say any of that stuff.
‫The admin database is not created by me.
‫I didn't create it and do not anything.
‫And there's no collection called Dorson cmd.
‫That's probably some some built in collection.
‫And that if we just apparently use.
‫All right.
‫And then we query and this is the thing we ask for.
‫We asked for so many other information.
‫We as for the compression type we ask for, that's the SS itself record stands for.
‫This is the the URL LDAP alternative I forgot was stands for the master is the one I'm connected to
‫is the mass that I want to connect to the master clients.
‫Can I say the driver I'm connecting through from Norges and this is the version of the Mongo DB client
‫and all that stuff to look at.
‫That's compression, what kind of compression I'm using.
‫And I said and the server obviously acknowledges that I received your query and then sends back the
‫reply and the reply in the reply says, Hey, here's the list of horse that you can connect to.
‫This is awesome, by the way, guys.
‫So this is the three shots that we talked about.
‫So I connected, I believe, to this one.
‫This is the master.
‫We're going to find out.
‫And they gave us, like, by the way, this is this is another two shots that you can connect it.
‫So it's almost like a client side sharding.
‫Right.
‫And that's how long TV works.
‫The client side is aware of the shot.
‫All right.
‫And Satnam, the atlas we're using Atlas is master.
‫Yes.
‫You're connected to the master, are you?
‫Connect to the secondary.
‫Nope.
‫Ah, you connect to the primary.
‫This is the primary one as the primary.
‫Right.
‫And that's all that other stuff.
‫Look, and that electable.
‫Whether this is electable or not.
‫A.W. is a region where where is it.
‫It's in the east.
‫All the information is that by the way, this is encrypted guys.
‫But I have managed to decrypt it because I'm using that we talked about.
‫Right.
‫Well, yeah.
‫What other stuff?
‫Election.
‫I don't care about that.
‫Really late last.
‫Right at Max and the binary JSON that is I don't I think I'm not an expert in Monga, so I don't know
‫what what all this stuff is.
‫Most of the stuff I know basic stuff.
‫The, the versions manoir version maximizer.
‫This is the response that's a little bit lengthy response time and that's it.
‫So query.
‫And here's the thing guys.
‫You'll notice that.
‫After that.
‫That client also sends another query, and that's left me a little bit baffled.
‫So we're sending another query around one 24.
‫And what we're asking here, we're doing the Sarcelles start think.
‫Right.
‫So let's let's Google this.
‫All right.
‫So it's simple authentication and security layer protocol.
‫So simple authentication, security protocol.
‫So that's the protocol that they're using.
‫Scram.
‫That's another hashing algorithm that Mongo uses.
‫And apparently this is they they are agreeing on this stuff.
‫I don't know, scram, as I had to look at this, scram, so stands for salted challenge response authentication
‫mechanisms cramb.
‫So this is apparently an authentication mechanism and there are two there are many times there shall
‫one.
‫Why are we still using one guy's cha cha?
‫One is dead.
‫It's been proven to be weak.
‫So and apparently what am I missing here?
‫I'm using sha one.
‫I probably is not a bad idea.
‫No big deal because this person have to also decrypts in order to get into the show on to, to, to
‫break it.
‫So I don't see, I don't see it as a big deal unless you guys disagree.
‫What do you think.
‫So yeah.
‫So this is the first Sarcelles query and then the replies back and it says.
‫We having a conversation, so this is like a conversation, so there's a lot of chattiness just to establish
‫the Mongo DB connection.
‫All right.
‫So we have done are we done false?
‫We're not done.
‫So it's almost like a conversation.
‫I don't know the size of the protocol and how it works, but this is extremely chatty.
‫Look at this.
‫We're going to see that this is the first query reply, the second query and reply.
‫The third query, almost the same thing.
‫We're going to the admin CMD collection.
‫We're just having the conversation again.
‫There's some negotiation that is going on and then we get a reply back and it's not done yet.
‫And then until the fourth query, the fourth round trip, we say, yo, let's continue sampling.
‫And then we say done and then we're done the connection.
‫So this I believe this is just the connection part.
‫So we're and we're going to see that later.
‫When I continue that, I think we're just here.
‫That was just here, so little bit slow, if you ask me, I am.
‫And this is the first request, request, extensible message format, is this the Ximo is that way extensible
‫message format that just ximo that's what the XML stands for.
‫Extensible message, markup language.
‫Maybe it's different.
‫I think it's a different thing.
‫All right, so what are we're sending the where the user's sending the query to find.
‫Right.
‫We're sending a find.
‫That's the find right here.
‫Right.
‫So this we're going to find out that this doesn't do anything.
‫This is all clients ideologic going and getting the database, getting that collection until where you
‫want to do something as the client and Mongo as the lazy is a lazy load approach, right where I found
‫out by actually stopping in each step and there are no network packets sent when you're doing this stuff,
‫only even here you don't send anything.
‫It's only here, actually, we're going to find out that.
‫Right.
‫So find we're going to find and on the employees collection, do we specify the the collection here
‫of the database?
‫I mean, the database that we specify the diaries, we specify the collection, but none of the database.
‫So that's the filter.
‫Hosain, I want to go to who find me Hussein.
‫The name Hussein retain key show and document.
‫Look at all this stuff, man.
‫The time stamp.
‫And there's a DB Thunderbolt.
‫Right.
‫Awesome.
‫And we acknowledge the service.
‫Say, I got your request.
‫And now here's what I think.
‫This is just weird.
‫It's not really a request because it's coming from the server.
‫So it should be a reply or a response.
‫So I think this is a problem in Wireshark Warshak just expanding the messages and treating it as a request
‫where it is actually a response.
‫I think so.
‫So we're going to curser a beautiful cursor.
‫This is a client site courser.
‫We're going to show that because we asked for everything basically.
‫Right?
‫We asked for to array and we get back in an array of every single element, which is one basically.
‫And the ID, the object idea of the element.
‫Right.
‫And the string, which is name same.
‫If you notice here, this is five F to five F two and the name is the same.
‫And then we get the the collection and the idea and all that stuff, OK.
‫The cluster time for some reason we're exchanging the cluster time a lot and I don't know what's the
‫purpose of this.
‫That's very interesting.
‫I think it's just for cinching purposes, that would be interesting to know.
‫All right, some lost packages.
‫No problem.
‫Another request.
‫Hmm.
‫We don't know out the request course.
‫That's weird.
‫So if you look at this request, that request I didn't do that.
‫Cissé intercessions was like almost like it's ending the session.
‫Well, there is a document that says I.D. that gives you a value, a fort, a five était.
‫I didn't do any of that stuff.
‫Only thing I did as printed and just close that connection.
‫So maybe that's part of the closing the connection and that's the client sending it right.
‫And then the time stamp and we're getting all of this adamant, I didn't do that, we're doing something
‫to the admin.
‫The Mongo DB client is sending a request to the admin.
‫Oh, look at that.
‫This is part of a negotiation with the shards.
‫Look at that.
‫Says, Hey, I prefer the primary.
‫Well, we are connected to the primary.
‫All right.
‫What's wrong with you, sir?
‫Also, why no one is good.
‫And then we get a response back from this gentleman saying what server saying, OK, one time don't
‫really care about the cost of time now.
‫And the operation that's nothing is just responding back with a response.
‫So I didn't send that as a client, as a user, as a developer.
‫I didn't write that.
‫It's all Mongo.
‫And then obviously this is the close of the connection and the Fehn or is it Fennec so that the client
‫initiating the closing of the connection, look at all that stuff.
‫All right, guys.
‫So here's what I do now.
‫So we went through all that stuff.
‫This is a very basic Mongo DB request to pull all that stuff.
‫How about we spice things a little bit and I'm going to copy this thing.
‫And do it right here.
‫Right after that connect, I'm going to close the connection.
‫And we're sleeping here just because I noticed that, I think that it's almost like a bug here, when
‫we don't close, we close immediately.
‫We get a reset on the can on the on the on the TCP stack.
‫So I'm just adding milliseconds so we avoid the reset.
‫So let's go ahead and clear, which we shouldn't get to.
‫If you think about we shouldn't get this reset lesson.
‫And one second.
‫And then, Don, let's take a look.
‫All right.
‫Three way handshake deals, handshake all the way, we get a query, reply, a query, reply, I query,
‫reply, a query, reply, that's what we show, right.
‫And then Ifan So for round trips, that is, man, if you the next time you establish a DCB connection,
‫a Mongo DB client connection.
‫Think about this as a back, an engineer.
‫Think about what you're doing.
‫Right.
‫So pull this connection as much as possible if you can and and eagerly load them because lazy load this
‫thing, the user will feel it because it is extremely slow, especially if you're fear mongering is
‫all over there.
‫And this is another thing.
‫Guys like your TV client should be very close to the to the to the Mongo DB database.
‫Mine is mine is in the West, a client of the West and the database is somewhere in the east.
‫Right.
‫So that's bad anyway.
‫But that is just negotiation and authentication.
‫I still don't understand why do we need Sasol?
‫To be honest, there's a part of Kerberos authentication.
‫I don't need to do any of that stuff.
‫Right.
‫I mean, mutual TLC can solve this problem to authenticate me as a client if that's what it's doing.
‫But I might be wrong.
‫I might be missing something here.
‫All right.
‫So let's move this a little bit.
‫Just this sense for four packets yike.
‫See, what the hell are you doing?
‫And now I'm going to.
‫Do it all the way here, right?
‫So this, this and this, and you've got a guy who's going to notice that nothing I'm saying nothing
‫will be sent to the to the server after that.
‫It's the exact same thing.
‫Exact same thing.
‫Right.
‫So.
‫Let's go home again.
‫Query, reply, query, reply, query, reply, query, reply.
‫That said, and Fent.
‫So that whatever we did hear all this work, it's all lazy, loaded, all of this is a lazy loading
‫client side, which is a good thing, right.
‫So this is to avoid round traps.
‫Right.
‫And DBI, Thunderball, this is.
‫Yeah.
‫Give me the Thunderbolt database.
‫But why do you if we're not going to use it immediately, I'm not going to send a request to give you
‫a thunderbolt.
‫Right.
‫So let's let's pull this connections that of course as much as possible.
‫So, OK, you want the Thunderbolt derivates, OK, you want the collection employees.
‫OK, I'm not going to send a request yet.
‫You want to find that the employees that name Hosain.
‫OK, I'm not going to send it yet.
‫Why?
‫Because technically you didn't consume the search courser yet.
‫Because what other methods do you have guys.
‫It engineers.
‫Let me know.
‫Mongul experts.
‫What's there is there is a next.
‫Is it next.
‫Yeah, I think it's called next.
‫So this is next.
‫We'll do something else then to Arae, for example.
‫Right once I do next or to Arae that will do all of this in one trip.
‫So they're kind of optimizing things, which I'm going to give them.
‫I'm going to give them the props for that.
‫That's good.
‫But look at this.
‫Look at this stuff.
‫And here's my message, request, message, request to hear their request, extensible message format,
‫so that's the message extensible message format that we sent, right?
‫That's our query.
‫And the second one is basically the response for this, right?
‫Well, that's that's the first one.
‫Sorry.
‫That's the second request that that client just does send word that we don't know what's going on there.
‫It's sending it to the admin database.
‫So it's some sort of a messaging.
‫Right.
‫Just like we saw on WebSocket there is that was it a websocket, the heart, the heart beat thing,
‫the ping pong or something else?
‫It was it was a stab to the messaging, the solar system stream or the magic stream where they are not
‫on the magic stream.
‫It's basically a specific stream just for exchanging messages.
‫That's what that's what was it.
‫So this is like, I think the exchanging of information about the cluster, about other stuff like that.
‫But yeah, that's the idea of this stuff.
‫And then finally, we close the connection.
‫All right.
‫The last thing I want to do, something I didn't do offline, but I'm going to do it with you because
‫I'm I'm very courageous.
‫Not really is I'm going to try this.
‫I got to see what happen when I do this cursor dot next.
‫So this will give me the next result, we'll see what will happen when I do this, the result they call
‫this, let's just do this and see what will happen.
‫And there's just sure, let's just printed that Eau Claire clear.
‫Clear.
‫And then boom.
‫So the normal queries, no more queries, no more queries, extensible message, format, the same thing,
‫it's the same thing, guys, it's the same thing.
‫Maybe it's not really an array.
‫So this is a request, OK?
‫This is the response I like.
‫That's a little bit different.
‫The cursor, its first batch.
‫It is an all right.
‫Huh.
‫I guess the same thing.
‫All right, never mind.
‫Just giving you the same results, right, but just one at a time.
‫So this is this is whenever you want something, you just ask for it and you get the second one in second
‫once.
‫I like that.
‫So there will be a round trip for each one of them versus if you do to array, they will all be brought
‫locally.
‫So.
‫Kind of a server side versus client side cursor.
‫All right, guys, that's it for me today.
‫That was Mongul Wireshark Mongo DB.
‫What should I WARSHAK Next, let me know in the comments section below.
‫I'm going to see you in the next one.
‫You guys, they all go by.