OK, so let's capture some of the protocols, I'm going to start a capture on this link because this
is my server
and I want to capture the traffic going to the server, what I'll do on the router
is
make sure that the router can ping the server, so the IP address is 10.1.1.1.
So on the riouter ping 10.1.1.1,
ping succeeds. So in Wireshark
let's filter for ICMP, ping uses the ICMP protocol, and there you go, you can see we've got a ping
or echo request message and then an echo reply.
So the router IP address 10.1.1.254 is pinging the server and the servers replying back
so we can see that the ping succeeded.
We'll be able to see information about the ping.
Now, I'm not worried too much about that here.
What I want to do is capture traffic from the router to the server and specifically traffic like TFTP.
So what I'm going to do is save the routers configuration and let's say the administrator of this router
wants to back up the configuration.
So copy startup config, so copy the saved configuration to a TFTP server IP address will be
this will set to the destination name as that.
So the destination filename is that configuration has been copied.
So the route administrator's happy his router configuration has been copied to the TFTP server
but the problem is that.
You have captured that whole session, so notice we can see router sending traffic to the server using
TFTP destination filename is this.
We're getting acknowledgments, we're seeing various information.
But what I'm going to do here is follow
the UDP Stream TFTP uses UDP, so notice what I can see.
I can see the full running configuration of the router, including the DHCP pool information, can
see IP addresses, I can see passwords.
So notice there's the telnet password scrolling up user made a big mistake.
The enable password is in clear text, so they used the enabled password rather than the secret password.
Secret is encrypted or hashed.
Whereas the enabled password is in clear text.
So just by capturing traffic on the wire, I was able to grab the passwords of the router and the full
configuration of the router.
Be careful using TFTP in a network.
OK, so what I'll do is stop that.
And save it so that you've got it.
So TFTP