Đang chuẩn bị liên kết để tải về tài liệu:
Network Traffic Analysis Using tcpdump Introduction to tcpdump

Không đóng trình duyệt đến khi xuất hiện nút TẢI XUỐNG Tải xuống

The objectives of this course are to introduce you to the fundamentals and benefits of using tcpdump as a tool to analyze your network traffic. We’ll start with introducing concepts and output of tcpdump. One of the most important aspects of using tcpdump is being able to write tcpdump filters to look for specific traffic. Filter writing is fairly basic unless you want to examine fields in an IP datagram that don’t fall on byte boundaries. So, that is why an entire section is devoted to the art of writing filters | Network Traffic Analysis Using tcpdump Introduction to tcpdump Judy Novak Johns Hopkins University Applied Physics Laboratory jhnovak@ix.netcom.com 1 All material Copyright Novak 2000 2001. All rights reserved. 1 Table of Contents Topics Introduction to tcpdump Writing tcpdump Filters Examination of Datagram Fields Beginning Analysis Real World Examples Step by Step Analysis References 2 2 Course Objectives Introduce the fundamentals of tcpdump Explain how to write tcpdump filters Examine fields in datagram for uses misuses Analyze traffic by placing it in categories Demonstrate real-world analysis using tcpdump Let you participate in the analysis process 3 The objectives of this course are to introduce you to the fundamentals and benefits of using tcpdump as a tool to analyze your network traffic. We ll start with introducing concepts and output of tcpdump. One of the most important aspects of using tcpdump is being able to write tcpdump filters to look for specific traffic. Filter writing is fairly basic unless you want to examine fields in an IP datagram that don t fall on byte boundaries. So that is why an entire section is devoted to the art of writing filters. Before we start to use tcpdump to analyze traffic we ll examine many of the fields found in the IP datagram. This is done to familiarize you with those fields in theory and also how they might be used in practice. We ll study how and why fields might be changed and for what purpose. Next we ll start the basic analysis process by looking at tcpdump output and categorizing the kind of traffic that you can see. Then we ll take a look at some real-world examples and of how tcpdump was used on monitored networks to discover what was happening. Next the analysis process will be inspected step by step often with missteps to get you comfortable with it. As a note all tcpdump output shown in this course is activity that actually occurred. Source and destination hosts IP s have been altered to obfuscate the true