Commands used in Assessing Network layout & Security
- 1. Friendly Tip: Please take notes to better remember concepts In this video we will learn about Commands used in Assessing Network layout & Security Core Cyber Security Concepts
- 2. Network Reconnaissance Tools Network reconnaissance is a term for testing for potential vulnerabilities in a computer network. Network reconnaissance tools are used to scan the network to probe for open ports and other vulnerabilities that can be taken advantage of to gain access to the network.
- 3. What is Organizational Security assessment? Organizational security assessment is the process of testing & analyzing an organization's security policy and security controls in place to determine how secure the organization is from Cyber Attacks.
- 4. " The first step of performing security assessment is to identify the network layout. It is vital to understand the network architecture and the security controls in place " Network Layout Detection
- 5. To understand & see the network layout we can use the following commands with respect to the operating system. In computers running windows OS we can use the code ipconfig in command prompt to view the device's IP address and Subnet mask. Similarly In computers operating on Linux OS, we can use the code ifconfig in terminal to view the network layout. ipconfig/ifconfig command
- 6. Ping command Ping command is used to test the connectivity/ reach- ability between devices. It is used to test/verify the connection b/w the host and the target machine.
- 7. How does ping command work? The ping command operates by sending/pinging Internet Control Message Protocol (ICMP) Echo Request messages to the destination computer and waits for a response., to hear back from the target computer. The two major pieces of information that the ping command provides are how many ICMP echo responses are returned and how long it took for them to return. For example, you might find no responses when pinging a network printer, only to find out that the printer is offline and its cable needs replaced. Or maybe you need to ping a router to verify that your computer can connect to it to, so you don't have to worry about a potential networking issue
- 8. -> ping command options
- 9. -> ping command example C:Userslearningwithray>www.google.com In this example, the ping command is used to ping the target google.com By default 4 ICMP requests are sent to www.google.com and in this case we heard back from all the requests and the time it took to hear back from the target is mentioned below
- 10. route command In computing, route is a command used to view and manipulate the IP routing table in Unix-like and Microsoft Windows operating systems.
- 11. trace route command The Traceroute command (tracert on Windows) is a small network diagnostic software that you have built-in on your device and servers for tracing the route, hop by hop to a target.To access the traceroute, you will need to use the Terminal (Linux and macOS) or the Command Prompt You can use the Traceroute and see the full route that the packets take to their destination (domain or IP address). Apart from that, you will see the hostnames and IPs of the routers on the way and the latency, the time it takes for each device to receive and resend the data.
- 12. With trace route command You will be able to see all the routers on the way, with their IP addresses and the time it took. You can better understand the network and check if you can reach target device. You can see how much time it took in each hop. So you can see a spot that significantly slows your network. You can fix the problem or add more presence in the area.
- 13. ARP protocol in short is a procedure that connects an ever-changing Internet Protocol (IP) address to a fixed/permament physical machine address, known as a media access control (MAC) address, in a local-area network (LAN). Address Resolution Protocol To put it simply, what happens is , in a LAN connection there are devices with different IP addresses and MAC addresses. The router allots the dynamic/ever changing IP addresses to the connected devices mac addresses. Within the LAN, each device forwards its data request to the router and router fetches the results.
- 14. But the problem is, even after fetching the results how is the router supposed to know how and who to send the data packets without a means of identifying who/what device requested for which info. ARP protocol addresses this issue. The router forwards an internet request, put forward by the connected devices and fetches the requests from the internet.
- 15. After receiving all the information requests, the router broadcasts/asks the ARP program to find a MAC address that matches the destination IP address, where the network traffic is supposed to go to. After the request is made by the router within the LAN, asking/inquiring who has the particular dynamic IP address linked to their MAC address, and the device with the requested/matching IP address steps forward, claiming it has the MAC address that matches the destination IP address. Only then the router transfers the data requested by the device.
- 16. ARP broadcasts a request packet to all the machines on the LAN and asks if any of the machines are using that particular IP address. When a machine recognizes the IP address as its own, it sends a reply to the broadcast, so ARP can update the cache for future reference and proceed with the communication i.e transfer data packets/network traffic. To sum it up : A table called the ARP cache maintains a record of each IP address and its corresponding MAC address.
- 17. ARP Table is used to keep the record of the IP address and MAC address of the devices (source and destination device). For the communication between two devices, it is necessary that the IP address and the MAC address of the source and the destination device should be stored in an ARP table. If there is no record in the table, an ARP broadcast is sent by the source to all the devices in a network. All the devices compare their own IP address with the IP address of the destination device. When the IP address of the device matches with each other, that device sent the response, which is then updated in an ARP table.