In this video, I'm going to show you how to use tea shock as well as term shock.
Tea shock to capture traffic off the wire and term shock to view.
Wireshark captures through a terminal.
Sometimes you don't have access to a gooey interface.
Sometimes you want to be able to capture packets off the wire using a terminal and tea shock is great
for doing that.
As an example, you may run a capture application on a Linux server or Linux host which doesn't have
a graphical user interface installed.
You could, as an example, run it on a Raspberry Pi, so capture traffic off the wire using a Raspberry
Pi, but do that without a graphical user interface.
So simply using a console, capture the traffic and you may want to be able to view those Wireshark
captures through a console.
So that's what I'm going to demonstrate in this video, in this genius three topology.
I've got an Ubuntu host.
This Ubuntu host does not have a graphical user interface.
So if I type clear, all I get is a console connection.
There is no graphical user interface.
So as an example, if I want to view the interfaces on this device, I'm doing that through a ally.
I'm not doing it through a graphical user interface.
All I have is a console connection.
So as an example, I'll edit this file so that.
The host gets an IP address from a DHCP server.
What I'll do is close that console connection down or terminal down.
Stop the ubuntu client started up again.
Open up a console.
Notice here I now have an IP address that has been allocated to me via DHCP.
The net cloud is allocating IP addresses to the ubuntu client.
This is a bolt in genius.
Three switch.
This is a cisco switch.
This is a Cisco router running within genius three.
So the problem here is I can't run a graphical Wireshark application.
I need to run Wireshark directly through the console.
So the first thing I'm going to do is type apt, get update to update my ubuntu references.
Okay.
Now that my ubuntu references have been updated through apt get update.
What I'm going to do is install t shock.
So to do that, I type apt get install.
Tea shock.
Say yes to install the application.
So what this is doing is connecting to the Ubuntu cloud and essentially downloading and installing te
shock on the ubuntu client.
I'm asked, should non super users be able to capture packets?
I'm going to say yes, but in this example, I'm actually logged in as route, so I'm simply going to
capture using route.
So I've now installed tick tock.
I can start it by simply typing tea shock.
And notice it's capturing packets on Ethernet zero.
It's essentially capturing packets on this interface.
And what we're seeing at the moment are spanning three messages that are sent by the switch.
What I'll do on the router.
Is enable OSPF and we should be able to see OSPF updates.
So we'll get this device to use DHCP and then enable OSPF on all interfaces.
It's now received an IP address through DGP.
Notice we can see information such as spanning tree op messages and so forth.
Now that's not great.
That's just showing me the updates in real time so I can see as an example.
DHCP offer.
DHCP request.
So what you may find more useful is to push that to a file, so write it to a file.
In this case t shock one dot pcap as an example.
So that's capturing the traffic and dumping it into that file.
So as an example, show ip ospf interface brief.
We're running OSPF on this router now if I type clear.
IP ospf process and clear all the OSPF processes.
OSPF messages will be captured.
Let's enable IGP.
So I.
JP And I'll enable that on all interfaces.
Hopefully this tea shock application is now capturing messages including spanning tree, including CDP,
HTTP, IGP, OSPF and so forth.
So I'll stop that by pressing control.
C and notice I now have a t locked up pcap file.
Now I want to be able to view that.
I could copy that to my Windows Computers, an example or my Mac or a Linux computer with a gooey and
then open that up with Wireshark.
But lets view the files directly through this console.