So a couple of great questions came up
on looking deeper into things and
I mentioned this earlier in the course that
Wireshark is extremely helpful, extremely powerful but
there are enterprise tool sets out there that will allow you
to do more with network and protocol and traffic analysis and some of them
as mentioned again earlier in the, in the foundations course was
Riverbed who owns a huge take in Wireshark.
They have tools such as Cascade, ARX.
There's agents that run directly on the systems themselves all the way through the network.
And it'll all give you an entire picture of application response
all the way down to the database layer of an application.
So, there are many tool sets that you can use
however, for the folks of this course, is on Wireshark.
And what you can do directly with it.
If you can get the foundations down, move in to more advanced functionality,
and then into those enterprise tool sets,
you will be able to quickly and very easily tell what's going on on your network at all times.
And the systems that live and operate them.
Ok, in this module, we will be talking about command-line tools.
So interestingly with Wireshark,
and with Cisco, and with Unix, and with Windows,
a lot of people like operating at the command-line.
Some of us, for geeky reasons, we prefer to type specifically what we want.
We don't necessarily need to point and click, and go through an entire subset of menus.
Some of us are able to operate very quickly while using the command-line.
And by doing so, you can understand things and move very quickly through them
but you have to know the command-line.
What else is it beneficial for? Scripting.
So, you can automate pretty much anything that you want
on a, on just about any system
because if you have the ability to do things at the command-line,
and then you can write file, scripts, bad files, script, scripts into the shell.
There's a lot of things that you can create to automate functionality.
So, that's another reason why a lot of people work with and enjoy the command-line.
So for purposes of this course,
and what we're going to be doing, I've fired up a VM with Linux on it
which we will go through and we will use tshark
and some of the other tools, just so you can be aware of them.
So the command-line tools that you will see,
the ones that are available with Wireshark,
is first and foremost, tshark.
So, you're operating at a terminal. You want to use Wireshark functionality.
Very, very similar to tcpdump which is next on the list.
Both of these are packet capture tools.
Tcpdump has been around for ages,
standard with most Unix and Linux operating systems.
It is also found on a great many firewalls.
If any of you ever used some other firewalls
other than basically, Cisco proprietary firewalls,
McAfee sidewinders as an example. You can run tcpdump right on the console.
So there's a lot of, there's a lot of tcpdump, tshark-ish
command-line packet capture tools available
very freely, on most, if not all systems.
Other command-line tools that you may encounter - dumpcap,
rawshark, editcap, mergecap.
Some of them are very, very self-explanatory.
So, as an example, if you wanted to run a packet capture,
on the command-line and we can do that, right from here.
In this VM, I have tshark running.
And it is simply just capturing all the data in the background while we're talking.
We can, in fact, capture data. We can stop it and then we can move to
to editing it or merging it with another capture file.
So, each one of these utilities is used to get into the capture and work with it.
So, you can do pretty much the same things
that you can do with Wireshark with the command-line tools.
But obviously, not everything. Some of the tools that we went through in earlier modules,
such as the flow graph and this, this plotting statistical tools.
They are in the GUI only. But I will say this, that if you're running Wireshark
let's say on Linux, yes you can use tshark but
it's also, the GUI version is available, so you can just run it right from there.
So we'll let that run in the background.
So as we just mentioned, a little bigger there for you,
the command-line tools are right now,
we're running a packet capture on Linux using tshark,
very much again, like tcpdump. We'll also look at tcpdump but
specifically, it's just capturing the packets, packets list pane data.
Right there for you to see, scrolling. You could see specific information scrolling by.
I see a lot of name querying, so just as an example.
And then other tools, such as tcpdump, very similar.
So what I wanted to do while we are running this,
is I also wanted to run a tcpdump.
It'll run that awhile. And then to stimulate some traffic,
I'll just do a dig and do some basic querying.
So just generate a whole bunch of traffic on the network and there we go.
Alright so, as we mentioned before, there's a lot of things that we can use
to capture data but if we're going to do it at the command-line,
we're going to be using primarily tcpdump or tshark.
Tcpdump is generally found on most Linux and Unix distributions.
Again as mentioned before, on a bunch of firewall distributions,
there's variations of these.
I recommend playing around with this. It will show you very quickly
and easily what may be going on on your network
at the command-line.
So for example, you're troubleshooting a Linux host,
you do a quick ifconfig. You see what IP address you have.
Ok, that's my source, what am I going to, maybe do a quick dig
and you try to resolve a website, ok there's my destination.
Run a tcpdump or tshark.
And just start capturing data and have an idea of where, what my source and destination is.
And once I am done with that capture, I can close it, I can save it
and then I can parse it further.
I can edit it. I can merge it with other capture files and so on.
And here's just a little bit of a closer look at a tcpdump.
And some more questions based on this, and examples -
Again here, everything off the command-line can be run pretty quickly.
You stop the tshark process. You can stop the tcpdump process.
And you can run it directly from the command-line here.
If you're following the syllabus,
the next module I'm going into is based on tsharks.
So these questions are perfectly aligned with what we will be talking about.
However, prior to getting to them, I will answer some of these questions now.
So one of the questions that was asked was 'can you do more than just run a capture?'
Can you do other things with tshark? And the answer is yes.
So, obviously if you're familiar with Unix, the demand pages,
there's information here that I can pull.
I type man space tshark. And it basically gives me the syntax
that I need to be able to pull
pretty much what it is that I would do from a GUI.
Now, it won't do as I said,
everything the GUI will do, but it will do quite a bit.
And this is the missing link here, it's the actual syntax that you will apply.
So as an example, and remember that with Unix and Linux,
everything is case sensitive.
If you wanted to specifically apply settings, you could look through here and say that,
"ok, I want to do a display filter, which would be minus upper case Y,
capture would be minus lower case s."
So the more you play around with it, the more that you can get some data out of it.
But yes, running tshark with these options is going to help you get more granulized data.
And yes, you can run filters and yes, you can specify different things
when you're running tshark.
So let me, actually supersize this so you can see it.
And I apologize, it's a little small but
if you type in man space tshark, you will get a entire listing of options that you can use.
Ok that was one question, and in the chat, if I'm not,
if I don't answer your question completely,
feel free to repost the question with more clear instructions
on what it is that you would like me to answer.
In which cases would you use the command-line versus the GUI?
As we mentioned before,
it's just quicker and easier if that's what you're used to.
It's a lot less overhead on the system.
You don't have to load up the Wireshark tool.
Although it doesn't take up a tremendous amount of memory, the capture will.
It's still low overhead. It's helpful in that way.
It's also helpful in the sense, as I mentioned before if you're running scripts
and you want to script some of this out and automate it.
You can do so with these types of commands.
Essentially, that's one, one of the major reasons people like to use the command-line
is that they can script out what it is that they want to do
and then launch it as a shell script.