Finally we'll take a look at a few examples of computer scans in remote operating system detection we'll
start at the lowest layer with the IP scan above you can see a capture file you'd never like to register
in your network.
We see here this same IP protocol packets were sent in any packet of other protocols we're dealing with
scanning in the third layer of the OS model
detector tries to probe the network infrastructure in this way.
They want to see which protocols are supported by which network devices.
This is called the IPs scan only IP packets are sent in the IP header that contain information which
protocol should be above.
Then you wait for a response from a given device.
It will tell you whether the device supports the protocol or not.
The IP scan is used to check out the infrastructure of network devices.
This is how the IPs scan is presented in Wireshark.
Let's see how the port scan looks like we see the TCAP packets sent by the computer identified by the
address 10 1 0 2 to a computer identified by the address 10 out 1 0 1.
This is very chaotic.
If we look at the destination port it appears that each packet is sent to a different port.
Everywhere a connection request is addressed to a different port and each time the destination computer
responds with the reset.
If the port is closed the R T packet is sent.
That's how the TCAP scan works.
If the port is opened it either won't respond or the response will be definite.
However if you receive an R S T response it means that the port was closed the scan failed.
We can see that in our case most of the ports were closed.
However if the port was open the server responded with a send in act packets the port wasn't behind
the firewall.
It tried to establish it TCAP session just as we've discussed it before.
In this case we can analyze successful and failed attempts to establish a session through a standard
scan
let's examine UDP scan because UDP is a stateless protocol.
We do not expect a positive response.
This is a broadcast protocol.
The packets are sent but there's no certainty whether they got through and are received
in accordance with the R-S.C. after receiving a packet at a closed port.
The computer should notify the sender by sending the ICMP packet destination unreachable port unreachable
informing them that the packet was sent to the wrong address.
In the UDP scan no response means that you have come across to an open port at the same time.
We expect the error message if a packet reached a close port.
How such a scan proceeds is shown in the picture below.
Finally let's see how you can identify a remote operating system.
In this case the ICMP protocol was used.
We see the attackers computer with IP 10 does 0 0 0 data 29 and the tests computer with the address
10 that 0 does 0.2.
The process begins with sending an echo packet and waiting for the response.
This is repeated several times because the ping command sends several packets.
In this step we want to identify a computer existing in the network then we formulate different ICMP
requests.
We look at what the requests and how the server will reply.
If someone responds to the time stamp request giving away the time stamp or not depends on a particular
version of the device and the operating system
older Windows systems readily allowed to synchronize their clocks after their request we see the response
someone shared with us his time stamp then we ask about other things.
For example the IP version 4 address mask we can receive the response or not the response may also contain
the default values.
The process which has been previously presented and used quietly in a certain program for example in
and map to identify victims operating system boils down to posing a typical or atypical request and
observing responses individual responses are compared with a list of predefined schemata.
Certain systems respond to one kind of questions.
Other systems to another kind after you've used up all the 60 questions you can quite accurately determine
what system you're dealing with details such as version and service pack included.
Functionalities We've tried out are only a part of the full capabilities of Wireshark.
We had the opportunity to capture some data configure that display filter's in a nutshell.
We went through the features such as visualization statistics packet coloring and creating custom profiles.
The range of possibilities offered by wireshark that we got to know is sufficient to monitor user activity
in the network in real time.
It allows you to detect unusual behavior of hosts and users and react to accordingly.
For example by recording a certain operation if you'd like to analyze save capture files wireshark files
are used by various network services for example programs for tracking Wi-Fi network passwords.
If you have some spare money turn on wireshark for a while and send someone a file to a certain web
page the next day.
You'll get an email with a password for the Wi-Fi network whose packets you captured as you see.
Wireshark has a very broad application before you use the capture files as a proof.
You need to sign them a couple of modules before we mentioned how important data integrity is.
You should sign the file with the shell one or the five key in that way you can make sure that the data
someone extracts from the file will be the data that you have provided to them.
At this point I would like to end the presentation of Wireshark.
Thank you for your attention.