Hey guys and welcome back. So within this skill we're going to continue down this path
of networking based information and we will be using some tools and exploring some tools
to test for basic connectivity in our network. We will also test how we can do something
called port scanning. We'll get to see what this means and how to do this and we will
also learn how we can track and monitor very particular network information. So we do have
a lot of interesting stuff to get to within this skill. The very first thing which I want
to talk to you about is the concept of testing connectivity. So let's roll up our sleeves
and dig right in then shall we? So what I'll do here is clear my screen and the command
the primary command should I say that I want to describe to you is the PIN command. Now
the PIN command is one of the most well used tools in all of IT at least for systems administrators
and network engineers. This is a tool that we can use to test that devices maybe say
device one here and device two connected via let's say a switch. This tool allows us to
be able to test that device one can talk to device two and vice versa. Now there are some
limitations to the diagnostics that you get from a PIN command. The first one being is
that PIN actually utilizes the protocol called ICMP. This is the Internet control message
protocol. Now as it transpires some devices may just happen to block this particular protocol.
So if you happen to use the PIN command to like I say try to test from device one to
device two maybe device two actually could be reached over something like say HTTP if
it happened to be serving up web requests but maybe for whatever reason on its firewall
it happens to be blocking ICMP. So you may actually get a result that is inaccurate.
IE the result may be that you cannot reach device two via the PIN command and you erroneously
assume that therefore it cannot be reached at all. So really do not look at the PIN command
as an absolute holistic solution that's going to tell you absolutely everything about connectivity.
It's just one of the tools that we have in our tool belt and one of the first tools that we would
use as a go to because it's very simple to use to test out this basic connectivity. Now when I
happen to describe the PIN command there are a few things that I like to talk about first just
because I do believe it's so important to be able to correctly use the tool. We do have to understand
the output that the tool actually gives us. Now one of the things that we want to understand is
the sequence number. So what actually is going to happen is that when we use ICMP we're going to
send what are called echo requests. Now these are just little ICMP packets that we would send to
our target device again so we have device number one here device number two. We could send let's
maybe say five ICMP messages one two three four five. Now the first one we sent would have the
sequence number one the next one would have the sequence number two the next three the next four
the next five incrementing as we send them. So what might happen sometimes if there happens to be
maybe some type of misconfiguration you may actually be able to get a reply from the first
packet but maybe not the second and then you get a reply again from the third packet but not the
fourth. All of these data points provide us information that can ultimately uncover what is
potentially the problem with our network why we're not getting a consistent connection. So like
I say the sequence number very very important to understand and the other concept that is really
really vital to understand how to use the pin command is the TTL value. Now if you do not know
what a TTL value is let me just refresh your memory or explain it from the get go. This is the time
to live value. Now what this means is that a packet has a finite amount of what we would call
hops that it can traverse throughout a network. So let me just describe to you what is going on
here. So let's say we have device one, device two, device three and device four. So let's just
connect these up to one two three four. So let's say device number one has the IP address of one
dot one dot one dot one and device four has the IP address of four dot four dot four dot four. So
device one we go on to its terminal we issue the pin command and we try to ping four dot four
dot four dot four. Now hopefully we would get an echo reply to our echo request indicating to us
that the device is reachable and we are sufficiently connecting to it. Now what if there was a
misconfiguration. So we send this packet to device number two which is on the path towards device
number four. This packet would be likely handled by something called a routing protocol. We don't
actually have to understand the details of such a thing but just as a high level overview that is
how routers can learn how to send what packets what direction. So R1 would send it to R2 and R2
would know to send it out of this interface here if it was correctly configured. But like I say
let's imagine there was a misconfiguration on device R2 and instead R2 sent it the wrong
direction down to R3. Now R3 gets the packet sees its testing for R4 and R3 says hey I know how to
get to R4 I want to go this direction so the packet gets bounced back to R2 but R2 misconfigures
sends it back down and R3 sends it back up and down up and down on and on and on and on. What we
ultimately have here is a routing loop. The packet is just bouncing back and forth and back and forth
and all we're doing is we're not actually going anywhere we're not getting our packet to its target
destination instead we're just bogging down this link with effectively useless traffic. So what would
happen is we would want to have some type of way to terminate this behavior in the event of a loop
IE. We could tolerate this for a little bit of time but we could not tolerate this forever and
ever and ever. In fact we couldn't even tolerate it for a very short space of time we do not want
to have unnecessary congestion on the wire. So think about this what if and I'll simplify this a
little bit we gave it a TTL value of 10. What I'm saying is when I send this message from R1 going to
R4 if we do not reach our destination within 10 stops the packet should just die a death and it
should no longer be transmitted. So let's say we send it to R2, R2 receives it and what R2 will do
it will decrement that number so it'll say okay I'm minus one off it the new TTL is nine but like
I say R2 is misconfigured so R2 sends it the wrong way and it sends it to R3. R3 receives
decrements it by one the value goes to eight that is the new TTL value and R3 tries to send it back
northbound towards R2. R2 receives decrements goes to seven and again like I say this behavior just
keeps going on and on but the difference is is at this time every time this happens every hop
the TTL value is coming down now when that TTL value eventually reaches zero the packet is just
going to die a death so instead of just having this link needlessly congested with this packet
bouncing from wall to wall to wall to wall so to speak instead the network will be cleared up and
we would just see from the output of our ping packets that our destination was unreachable.
Now this is an output that you will see via the ping command if you can't reach your particular
destination so this information here receiving this destination unreachable would communicate to us
some type of networking error so the TTL doesn't actually fix the error for us we still have the
problem of the misconfigured R2 within the network but the problem is is that the TTL is protecting
us from unnecessarily congesting the network while we're trying to figure that problem out.
Now when we happen to get this message of a destination unreachable it can tell us many
different things it can say to us that maybe the local network has no routes to the remote
destination or it can tell us that one of the devices we pass this to has no routes to the
destination so maybe we have our laptop here and we connect to our router which connects to another
router which connects to another router which connects to another router and let's say this is
our destination right here if we happen to send our packets maybe this router is configured okay
however once we get to this device here perhaps this is misconfigured and this no longer has a
route to this destination it's at this point this router would ultimately send back to us this
destination unreachable and we could take further measures trying to break down what exactly has
happened so what I will do here as I will say ip adder and I can actually see my own ip address
right here 192 168 0.65 if I just wanted to test that this ip address was up and running and that
the interface was up and running I would say ping 192 168 0.65 now if I hit enter here this is just
going to continually ping and ping and ping and ping and ping and ping what I'll have to do here is
I'll have to stop this so I'll say control z now we can see here some of the information which I
talked about right here we can see the destination we pinged we can see the size of the packet that's
64 bytes we can see the icmp sequence number like I say this is the first one we sent the second one
the third one we can also see the time it took for this ping and we can see this ttl value and we can
see here the value is 64 64 being a very common ttl value depending on the application you're using
some happen to use 128 some use 64 it really just does depend but straight away we can infer from this
output here that we absolutely have connectivity with this ip address which is unsurprising we have
our interface and the upstates the ip address is configured clearly so this is no surprise at all
now if I happen to say ip root show I can see my default gateway of 192 1680.1 if I wanted to test
that I could reach my default gateway well I could just use the same command I could say ping 192
1680.1 and once again we can see the output of this command now what if I wanted to ping a
remote network so I actually have connectivity to the internet what I will do is I will ping
the ip address for google or google's dns server should I say so I'll ping 8.8.8.8 if I hit enter
we can see the output coming back now as it transpires the ttl is a little bit larger that is
because we're not actually pinging within a remote network the value may start off at a higher value
which it has I'm assuming that the value happened to be 128 and it has been decremented every single
time it's passing through a router so now we're seeing a value this time of 114 now if I tried to
ping an address on my local network for example that doesn't actually exist we should see some
information here to check this out so if I do 192 1680.0 this would mean that I'm pinging within my
own network but I'll ping a host address which is not configured so there's no one on my network
with this ip address of .24 if I hit enter now check this out we're getting destination host
unreachable simply put there is no way to reach this host because this host does not exist now
one thing they actually can do with the ping command is we can actually control the amount of
pings we want to send as well as other things like the interval between each ping you'll notice
that when I happen to send a ping say for example to my default gateway the actual interval as they
come through is one second apiece I'll just stop this if I wanted to send them in quicker succession
for example I could change this interval so if we go into the man page and say man ping we can see
these different options we can do things like use an ipv6 only we can use an audible ping which
will actually give you the sound of the ping we can specify the count this is how many echo requests
we should send we can do dash d to print a particular timestamp we can control the interval as you
can see here let me just scroll up one thing to note here that I always like to point out
is that be careful when you're trying to have the interval very very short if you try to have
an interval shorter than 0.2 seconds you must have super user privileges the reason for this is that
you can actually overwhelm a system if you happen to be sending a whole bunch of pings maybe say
50 milliseconds apart it just can become overwhelming we can also specify the source interface we want
to be pinging from and we have a whole bunch of other options things like being able to change
information relating to the quality of service now similarly we can also control the ttl value
so as opposed to having that default value of maybe say 64 we can actually toggle that value
and specify it ourselves so let's actually try some of these commands if I say ping and I say dash
c 3 and I do 192 1680.1 and hit enter once this pings out we do 123 we can see here
that the ping actually ends we do not have to interrupt it manually and we get this nice little
summary of statistics at the end we transmitted three packets three were received we had a 0%
packet loss that is very good we get the average time and we get the round trip time average now
if I wanted to maybe send more packets I could say send 20 packets okay so I could
hit enter but of course this would take 20 whole seconds to fully complete so let me just stop
this here and I could say let's speed up the interval so I'll say dash I and I will send this at 0.2
seconds so 200 milliseconds so when I hit enter now you'll notice the ping command are coming
through much more rapidly because the interval has been shortened substantially now like I say if
I try to lower this even lower than 0.2 say for example the 0.1 the ping command is not going
to allow me to do this unless I specify super user privileges again because this can be abused and we
can overwhelm systems so if I type in my password right now and hit enter this is going much much
quicker but again requires super user privileges now we can actually just ping a targeted host say
for example 192.1680.1 however what if we wanted to discover all of the devices within our local
network that were actually responding to a ping so we could maybe see if those hosts were potentially
alive well what we could do is we could ping all the hosts in the network at once now if you do
recall from your lpik one studies we have the concept of a broadcast address now what the
broadcast address does it means that if you ping the broadcast address every one on that network
is going to respond to that ping so anyone who is alive and listening will ultimately reveal themselves
and ping you back now we can actually do this using the ping command now if we just try to ping the
broadcast address now you may recall that the broadcast address is the very last address
within the network so if our network is 192.1680.something the broadcast address would be 255
but if I tried to ping this just as it is and hit enter it says do you want to ping a broadcast
then you have to use the dash b flag the reason being is that this is another one which can be
abused simply put because all the hosts in the network will be prompted to ping you back to your
original ping this can cause a lot of processing power on your local machine and what an attacker
may do is they may spoof your source ip address and ping a really really massive network whereby
thousands and thousands and thousands of devices will respond to that spoofed ping request and begin
flooding that poor host with thousands of icmp replies which could effectively bog down their
computer and potentially knock them offline so if we want to use this particular feature albeit
it can be useful just be careful with it and know that if we want to use it with the ping command we
would have to explicitly specify the dash b flag so we can say ping dash b 192.1680.255 if we hit
enter now it tells us a warning that we're pinging a broadcast address notice that we're only seeming
to be getting responses from 192.1680.1 that happens to be the only host alive on my network
except from myself that is my default gateway but if there were other devices on this network that
would be alive say for example 192.1680.5 for example you would also see the output here for 192.1680.5
also responding so you can easily discover all the alive hosts within your network so very very
useful if used carefully and with the correct purpose so we'll stop this right now so as we
can see here the ping command is a very very useful command there is a lot of very important
information that you can peel out from the responses you get from this command by looking at the
sequence numbers and the time to lives and the messages such as the destination host being
unreachable and we have different parameters that we can use to control and toggle the way in which
the ping command is actually going to work we can change the interval we can change the count
type we can ping broadcast addresses we can ping ipv6 based addresses and many many more so what I
would do is encourage you as always to read the man page explore the command have some fun and
lab it up okay doc so I hope it's been informative for you and I'd like to thank you for viewing