Skip to main content

Network scanning

MigrationWe'll be using the program IPnetmonitor on the mac computers:

https://www.sustworks.com/site/prod_ipmx_overview.html

Screenshot 2025-02-02 at 12.41.43 PM.png
Screenshot 2025-02-02 at 12.41.43 PM.png

Type command-L to get to the launcher.
Let's try a few commands:
Find your iPhone on the network:
  1. join the elab network on your phone 
  2. open ipnm, and choose address scan
  3. IP addresses are "leased" to users on the network 10.14.254.0/24
  4. scan the network 10.14.254.0/24
  5. on your phone, look at the connection information for the MAC address (MAC is not a mac thing, it is the identity of the hardware in progressyour phone, it stands for machine access control)
  6. see if you can find your phone on the network
Here's what this means:
  • All IP addresses (for now) follow what is known as IPv4, where each address in the world has 4 pairs of numbers between 1-254 (this is from binary versions of 2^n)
  • Inside IP addresses are "fake" meaning they don't show up on the internet
  • Try the DNSlookup tool, for these:
  • www.apple.com
  • www.google.com
  • elab.hpa.edu
  • physics.hpa.edu
  • Notice that the outside "real addresses" have various numbers, but those inside the elab all start with 10.14.x.y
  • The IP address for your phone is borrowed for a short time while in the elab, so we can recycle the addresses.
  • Every address in the elab starts with 10 (HPA) 14 (elab) then two more sets of numbers.
  • Address scan these: 
  • 10.14.88.0/24
  • 10.14.6.0/24
  • 10.14.5.0/24

Ok, so what is the 24 all about?
  • Imagine you are in a hotel with 254 rooms all in one long hallway. 
  • Every time someone walks by, you hear them.
  • If you could instead have more floors, and shorter hallways, your room would be quieter
  • We "mask" the network to do this
  • 255.255.255.0 means 254 computers on a network, we call this a /24 network
  • 255.255.0.0 means 254x254 (65516) addresses
  • Try this from the HPA wifi network and see what address you get

Now open the network settings on your computer and notice three things:
  • IPv4 address
  • subnet mask
  • router/gateway
  • DNS servers

These are the absolute minimum needed to configure any internet device (computer, smartphone, camera, etc.) on a network
  • IPv4 address: the address of your machine, may be set to DHCP, meaning leased address (dynamic host configuration protocol)
  • subnet mask: depends on the "scope" of your network
  • router: the gateway to get out to the internet
  • DNS server: where to go to lookup or translate names into IP addresses

Look for the same things on your phone...
what do you notice?

Next, try the other tools on the launcher, like link rate and ping
You can use link rate to test your ethernet cables for speed...

Hacker Challenges:
Find your phone: Address Scan
  1. Use the address scan to find your phone, by IP and MAC address
  2. compare to what it says on your phone
  3. enable "private address" on your phone and repeat
  4. why is this useful?
Bonjour scan
  1. use the bonjour scan to locate the "imac-a" machine
  2. find all of the data about it
  3. why do some machines have more than one address?
Connections tool
  1. use the connections tool to monitor the connections your computer makes
  2. open several web pages and notice the connections made
  3. are these more than just the pages you want?
  4. why is the internet so slow?
DHCP lease tool
  1. use the DHCP lease tool to see your leased address
  2. release and renew your address, note the server that gives out the addresses
  3. is this the same as the router?
DNS lookup tool
  1. use the DNS lookup tool to lookup addresses inside and outside our network
  2. use the DNS query option to lookup elab.hpa.edu using our DNS server (look on board) and 8.8.8.8 (google DNS)
  3. why are these different?
interface info
  1. open interface info and update
  2. what do you notice about inside and external address?
  3. which would you use for a minecraft server inside our network?
  4. what is your network speed?
Link Rate
  1. test your link rate to other computers in our lab and outside
  2. what do you notice about the speed?
  3. if you like, test your ethernet cable for speed, linking to another computer, or a network switch 
Monitor
  1. monitor both your ethernet and your wireless network for traffic
  2. is there any time when traffic is zero?
  3. browse the web and watch
Ping
  1. ping devices from your address scan above
  2. note return time
  3. ping from ethernet if available
Port scan
  1. be careful with this, it is like a burglar checking unlocked doors
  2. scan a device in our room for ports (1-900) notice open ports
  3. test with one of our servers, note the ports
  4. test on a pc, notice the ports open
  5. ask about common ports, you will need these
Service scan
  1. use service scan on your device and on a server (see board)
  2. what can this tell you about a server?
  3. why is this blocked by some servers?
Subnet calculator
  1. pick a 10.14.x.y address
  2. set prefix length to 16
  3. notice the network address
  4. repeat with a 192.168.1.2 address
  5. what do you notice?
TCPdump
  1. be careful with this tool: you can watch all traffic on the network and see passwords and logins
  2. run with several options, browse the web and see if you can identify your traffic
  3. why is some traffic not readable?
TCP info
  1. this tool diagnoses internet connections
  2. notice things like dropped packets and retransmits
  3. ask about packets, we'll need to understand these
Traceroute
  1. trace the route to inside and outside addresses
  2. how could you use this to determine slow links?
  3. test using UDP, TCP and ICMP
  4. ask in class about what these mean

Network tools for raspberry pi:
We first have to make sure our pi is updated:
sudo apt update
Next try the commands ping, traceroute and nslookup (from before)

Advanced commands: you may have to install these using sudo apt install nmap for example...
  • wavemon
  • speedtest-cli (install)
  • nmap -sP 10.14.88.0/24
  • sudo arp-scan 10.14.88.0/24
  • sudo iftop
  • ping
  • nslookup
  • traceroute
  • netstat or ss
  • cat /proc/cpuinfo
  • hardinfo
  • ifconfig 
  • ip addr show (note MAC address shows up)
tcpdump is a powerful tool for watching network traffic
unencrypted passwords and logins show up using this tool:
  • sudo tcpdump -i eth0 (capture all on interface ethernet0)
  • sudo tcpdump -c 5 -i eth0 (capture 5)
  • sudo tcpdump -A -i eth0 (ascii format)
  • sudo tcpdump -D (show interfaces)
  • sudo tcpdump -XX -i eth0 (hex and ascii)
  • sudo tcpdump -w 0001.pcap -i eth0. (captures packets to a file for later cracking)
  • sudo tcpdump -n -i eth0 (addresses)
  • sudo tcpdump -i eth0 tcp  (only tcp packets)
  • sudo tcpdump -i eth0 port 22 (only see ssh traffic)
  • sudo tcpdump -i eth0 port 80 (only see web traffic)
  • sudo tcpdump -i eth0 port 443 (only see secure web traffic)
  • sudo tcpdump -i eth0 src 10.14.88.81 (only from one machine)
  • sudo tcpdump -i eth0 dst 10.14.88.81 (only to one machine)

If you have permission, go back to the mac and try tcpdump to watch your web traffic...

Nmap commands





Migrated from Apple WikiServer Wiki. Original page z585E0m.ID: z585E0m