nmap

ex-1_iptables.adoc

@@ -1,4 +1,4 @@
-= Iptables !
+= Scan and network statistics !
 Apostolos rootApostolos@swarmlab.io
 // Metadata:
 :description: Intro and Install
@@ -31,7 +31,6 @@ Assuming you're already logged in
 
 == Find IP
 
-.Step 1 (find local IP)
 [source,bash]
 ----
 # ifconfig
@@ -57,7 +56,6 @@ TIP: inet ***172.21.0.2***  netmask 255.255.0.0  broadcast 172.21.255.255
 
 == Find live hosts
 
-.Step 2 (find live hosts on network)
 [source,bash]
 ----
 nmap -sP 172.21.0.*
@@ -103,7 +101,6 @@ See https://en.wikipedia.org/wiki/Nmap
 
 == Scan Ports
 
-.Step 3 (find open ports)
 === Scan a Single Port, All Ports, or Series
 
 [source,bash]
@@ -162,8 +159,166 @@ Because the ports into your computer can cause a security risk, it’s critical
 
 ====
 
+== netstat
 
+=== Listing TCP Ports connections
 
+[source,bash]
+----
+netstat -at
+----
+
+.Netstat
+[NOTE]
+====
+Netstat command displays various network related information such as network connections, routing tables, interface statistics, masquerade connections, multicast memberships etc.,
+====
+
+
+=== Listing UDP Ports connections
+
+[source,bash]
+----
+netstat -au
+----
+
+
+=== Listing all LISTENING Connections
+
+[source,bash]
+----
+netstat -l
+----
+
+
+=== Listing all TCP Listening Ports
+
+[source,bash]
+----
+netstat -lt
+----
+
+=== Listing all UDP Listening Ports
+
+[source,bash]
+----
+netstat -lu
+----
+
+
+=== Listing all UNIX Listening Ports
+
+[source,bash]
+----
+netstat -lx
+----
+
+
+=== Showing Statistics by Protocol
+
+[source,bash]
+----
+netstat -s
+----
+
+=== Showing Statistics by TCP Protocol
+
+[source,bash]
+----
+netstat -st
+----
+
+=== Showing Statistics by UDP Protocol
+
+[source,bash]
+----
+netstat -su
+----
+
+=== Displaying Service name with PID
+
+[source,bash]
+----
+netstat -tp
+----
+
+
+=== Displaying Promiscuous Mode
+
+Displaying Promiscuous mode with -ac switch, netstat print the selected information or refresh screen every five second. Default screen refresh in every second. + 
+
+[source,bash]
+----
+ netstat -ac 5 | grep tcp
+----
+
+=== Setting Promiscuous Mode
+
+[source,bash]
+----
+ ifconfig eth0 promisc
+----
+
+=== Remove Promiscuous Mode
+
+[source,bash]
+----
+ ifconfig eth0 –promisc
+----
+
+
+.Promiscuous Mode
+[NOTE]
+====
+Promiscuous mode is a mode for a wired network interface controller (NIC) or wireless network interface controller (WNIC) that causes the controller to pass all traffic it receives to the central processing unit (CPU) rather than passing only the frames that the controller is specifically programmed to receive. 
+
+When a capable NIC is placed in Promiscuous Mode, it allows the NIC to intercept and read each arriving network packet in its entirety. 
+
+If the NIC is not in Promiscuous Mode, it will only receive packets that are specifically addressed to the NIC. Promiscuous Mode must be supported by the NIC and by the operating system and any associated driver. Not all NICs support Promiscuous Mode, however it is pretty easy to determine if you have a NIC and OS capable of Promiscuous Mode.
+====
+
+
+=== check if promiscuous mode is enabled on network interface
+
+[source,bash]
+----
+
+netstat -i
+
+Iface      MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
+eth0      1500     8352      0      0 0         12677      0      0      0 BMRU
+lo       65536    14656      0      0 0         14656      0      0      0 LRU
+
+ifconfig eth0 promisc
+
+netstat -i
+
+Iface      MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
+eth0      1500     8352      0      0 0         12677      0      0      0 BMPRU
+lo       65536    14696      0      0 0         14696      0      0      0 LRU
+
+ifconfig eth0 -promisc
+
+netstat -i
+
+Iface      MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
+eth0      1500     8353      0      0 0         12677      0      0      0 BMRU
+lo       65536    15232      0      0 0         15232      0      0      0 LRU
+
+
+----
+
+.Promiscuous Mode
+[NOTE]
+====
+Look under the last column “Flg” for value “P”. If it’s there, it means promiscuous mode is enabled for that network interface + .
+B flag is for broadcast + 
+M flag is for multicast + 
+P flag is for promisc mode + 
+R is for running + 
+U is for up + 
+
+====
 
 
 
@@ -171,7 +326,7 @@ Because the ports into your computer can cause a security risk, it’s critical
 [appendix]
 == How to use Nmap
 
-There is a wide range of free network monitoring utilities and vulnerability scanners available to network administrators and security auditors. While the basis of Nmap's functionality is port scanning, it allows for a variety of related capabilities including:
+While the basis of Nmap's functionality is port scanning, it allows for a variety of related capabilities including:
 
 - Network mapping: Nmap can identify the devices on a network (also called host discovery), including servers, routers and switches, and how they're physically connected.
 - OS detection: Nmap can detect the operating systems running on network devices (also called OS fingerprinting), providing the vendor name, the underlying operating system, the version of the software and even an estimate of devices' uptime.