Hey guys and welcome back. So in the previous nugget we talked about port scanning and in
this nugget we're going to explore some additional tools that we can use with respect to our
network settings and configurations. Now when you want to be able to view and monitor the
activity within your local area network there are some very useful commands that you can use.
The first one is the netstat command. Now netstat happens to be one of those commands that are
now deprecated but we do have to be aware of it. It has since been replaced by the SS command.
Another command which is useful is the netcat command otherwise known as NC as well as the
LSOF command. So how about we do a little bit of exploration into these commands and see what
they can actually bring us. So let's first begin with the netstat command and so what we will do
here the dash s flag this allows us to see a summary of all the packets traversing our network
and have that sorted by the actual protocol in play. So if I hit enter check this out we can
actually see information per protocol say for example here we have UDP we can see we have
339 UDP packets received 40 packets to an unknown port and we can see information relating to the
errors. If I scroll on up we can see the same thing for TCP we can see we have two active
connection openings as well as a whole bunch of other information things like the segments
received and the segments sent out. Scrolling up further we can see information relating to ICMP
which is what we use for our PIN commands as well as our general IP packet information. So this
information can be very very useful when we want to be able to neatly sort out our network
traffic and view it on a per protocol basis try to remember this flag. Now if I happen to say
netstat dash L we can see all of the listening sockets here remember a socket being an endpoint
that is an IP address with a particular port number and as we can see here with respect to all
of our data everything here is in the listening state as specified by that dash L flag. Now as
opposed to seeing information such as SSH if you want to be able to see the numeric port value
that is being used here what I could do here is actually change this and say dash N. If I scroll
on up now instead we actually see port 22 for our SSH session and again this is an established
connection. Similarly if we just want to be able to see particular information relating to maybe
say TCP we can say dash AT to display only the TCP port information and you'll notice on the left
hand side the protocol everyone is TCP or TCP6 and similarly if we change this to AU for UDP now
we're only seeing information relating to our UDP connections. Now just like the root command which
was deprecated which we can use to see the kernel IP routing table you can also retrieve this
information directly via the netstat command by saying netstat dash R if we hit enter we get the
exact same information the kernel IP routing table just via a different tool. Now like I say the
netstat command has been replaced by the SS command the SS command if we go into the man page here
we can see this is for socket statistics and again if we scroll on down we can see all of the
different options that we have available to us a lot of similar information dash T for TCP sockets
or dash dash TCP so on so forth so we could say SS dash T here is our established TCP connections
again the server connecting on the SSH port and here is my Windows machine connecting in with its
socket IP and port number we can also do dash S for a summary of our connections one of which is
established this is my current SSH session so really the SS command and the netstat command going to
give you very similar pieces of information relating to your network and socket statistics.
Now another command we can use is the LSOF command if I just use the command on its own this is going
to give you an absolute ton of information this is ultimately going to list all of the open files
on your system now the reality is this is pretty much too verbose to have any real meaningful
use you really have to be able to understand the different options available with this command
to really yield any benefits so what I could do to shorten the output I could list the files
opened by processes that belong to a specific user and I can do this using the dash U flag
so I can say LSOF dash U and my username is IPv0 if I enter now we just see processes relating to
IPv0 as we can see here on this column everyone IPv0 if I happen to specify the root user now we
just see files that are opened by processes related to the root user now you happen to see here
that being able to open this directory we have permission denied so we may perhaps want to do
sudo lsof dash U root and now once I type in my password and hit enter now this information has
been revealed so we can see here at the bottom a lot of these shared object files if I scroll on up
notice that everyone is belonging to the root user now for the purposes of the lpik2 examination
you don't have to be an expert in this output ultimately you just want to be aware of what
this command is actually going to do for you i.e it can list the open files on the system and you
have the ability to control this output with particular filters such as the dash U flag
to specify a particular user what I could also do is I could say LSOF dash U and then if I use the
carrots this ultimately inverts the logic so I can say not root i.e show me all the open files
belonging to everyone except for the root user so I could hit enter now we're going to see all of
these ipv0 processes now again the only user on the system happens to be ipv0 and the root user
so all we're seeing here is ipv0 and on the right hand side the actual information that is being
opened but if we happen to have multiple users on the system using this type of filtering can be
very very useful so you can target a particular user or you could say for example exclude a
particular user as well as combining this information if you want with the grep commands
so what I could say is maybe you know grep for the word home so now we're actually filtering this
output a little bit further we're now seeing users that are not the root user i.e in my case ipv0 but
we're also filtering on open files associated with the home directory here if we scroll on up this
is all home directory related and again you can just keep chaining this information together now
one of the best tools that you could use to test and investigate issues relating to your network
is the nc command if i say man nc it says nc otherwise known as netcat as we can see here
is used for pretty much everything relating to tcp udp or unix based sockets so we can see here a
nice little summary the common uses with this command is we can create simple tcp proxies we
can create shell script based htp clients and servers we can test our network daemons as well as
a whole bunch of other stuff now let's say that you wanted to test if a particular port was accessible
maybe there was an issue with the firewall who knows where it may be well what you can do is you
can set up a socket to listen on that particular port so you could say nc dash l for listen and then
we can test the port so let's just try the port i don't know four five six seven and if i hit enter
we are now just listening on that particular port so if we happen to actually engage this port from
another computer we would be able to test if the connection has been allowed say for example through
the firewall so what i have here is another linux machine effectively this is the windows
subsystem for linux if i do an ip adder and i grep for 192 1680 and hit enter we can see here
the ip address of this machine here is 039 so what i'll do is i'll try to ping my machine so i'll
ping 0.65 we have connectivity let's now see if we can get through any supposed firewall and see if
we can connect to this particular port here four five six seven so on this machine here i will say
nc and i'll just type in the ip address 192 1680.65 and then i'll do a space and specify the port i
want to connect to so say four five six seven and i hit enter and now i should have an established
connection with this machine so what i could do is i could just say testing this connection
and hit enter if i go and check my other machine here look what's actually happened the text has
ultimately came through but able to shuttle this information through this open port so from my
zubuntu machine i will send a message to the other computer and say looking good here in fact let me
move this over so we can see the two machines at the same time let me send one to you and to enter
look at the left hand side we can see here that indeed we have been able to establish a connection
open up a socket and we do have this communication channel so we can see here indeed there is no
firewall issues relating to being able to reach port four five six seven on our local machine and we're
able to easily test this by spinning up a socket using netcat now honestly there is no way to cover
all the things that we could actually possibly do with netcats it is a massive tool and if you happen
to if i just press the control z if you go into man nc and run through the actual man page you
will be able to see all the different potential options that you can use with this command but
really for the purposes of the examination just understand that nc or netcat is going to allow
you to open tcp connections send udp packets it's going to allow you to listen on particular ports
to test connections it can even also do port scanning just like you can do with nmap albeit
not quite as advanced as nmap cam so honestly we do have a lot of various
utilities that we can use with respect to our network connections like i say we have the net
stack command which was replaced by the ss command both do similar things if we want to list our open
files this can also reveal to us open network connections via sockets since everything on linux
is ultimately a file and we can see here with the nc command otherwise known as netcat command
we have massive control and the ability to manipulate tcp udp and unix based sockets so really for
the examination do not be overwhelmed or bogged down by all the details of these commands they are
very expansive and 99 percent of what these commands can do are out with the scope of the
examination just be able to identify these tools and have a good general awareness of their purpose
and utility okay docks i hope this has been informative for you and i'd like to thank you for viewing