Is this an attack? Wireshark Packet analysis // SYN Attack

[@SpragginsDesigns]

Thank you for everything, David. After two years in college I was just hired last week as a remote Web and Mobile App Designer and Developer. Because I am also OSCP certified, it drastically raised my salary and the fun level of my position. And a lot of your courses are to thank for this; college is just for the paper or "degrees"."

[@davidbombal]

That is awesome! Congratulations!!!

[@SystemDemon]

These are blessing comments! David is my IT hero and my life is changing as well. I say David is making art, and we cant thank him enough!

[@warrioratthewall1969]

I like when you ask questions David. It's often something I'm wanting to ask, or sometimes something I should be asking but didnt even ask in my mind. Thanks again!

[@CyberNancy]

Solid content. Knowing what normal/innocuous traffic patterns look like helps you identify the suspicious traffic patterns. Chris's focus on TTL, window size, and sequence numbers is a really great example of how a seasoned analyst approaches pcap.

[@itech_live]

I came across to this demo, it was really helpful for me to learn about Maxmind and integrated to my Wireshark. Thanks to you and your host for put time on making this video.

[@Pay-No-Mind]

In response to the question, I'd prefer if you wrote/noted the questions for later and just let the person talk because you never know what cool lessons/tips/stories you missed out on because their flow/train of thought was stopped. Just pick up at the end LOVE the content! This has me busy and working towards real goals out of deep pit of depression I've been in for years, thank you David :)

[@piotrwikarski9401]

Thank you guys for collaborating. Chris Greer is amazing. Strange that I never came across him before. Thanks again!

[@brianturney2124]

This is great. I love it when you ask lots of questions. I am usually asking the same ones in my head. Perfect!

[@sergeyshevtsov5125]

David, every video you make is non trivial and some kind of fantastic. Thanks Chris for sharing knowledge!

[@TheStsparrow]

Something to note: Industrial control system protocols commonly utilize 20 byte header lengths. It's done for efficiency. But arguably they don't generally run on TCP port 80.... and hopefully not over the internet. Great video guys

[@warrioratthewall1969]

Like BACnet?

[@Alain9-1]

please don't let down those long video version i've enjoyed them a lot and waiting for more ( TCP/IP, scapy, Linux ...) 🔥🔥

[@GenXpress]

Thank you, David, and in this video Chris too. Your content is great, and I been following you for a while....Keep it up and keep it coming :)

[@marcorossi2664]

Grazie David per i contenuti che divulghi....io sono Italiano e ti seguo da un po...mi hai aperto un mondo....😊

[@jaimerosariojusticia]

Questions. Always ask, even if is a "dumb" one. The answer is what matters and what is needed. Great video (even the first 5 min are good enough) Thanks again David Bombal.

[@davidbombal]

Thank you. I'll do that 😄

[@rusnakhraj7401]

For me I prefer if u r asking question around because it gives us more information and it can help us understand topic better from other point of view. And I see that you have really good questions from student point of view David.

[@samjones4327]

Another awesome video!!! Thank you guys for showing us how to read and interpret the packet capture in wireshark!!! I have a new and easier understanding of what I am looking at! Supurb explanation! Now I have a new toy through GOIP!! I would love to see NMAP in action in wireshark! Thanks David and Chris! Cheers!

[@dwaynesudduth1028]

Fantastic content once again, proving that you are a top-tier content creator for IT. Thank you and thank you Chris Greer!!

[@tommyd22277]

David this was fantastic! I enjoyed that a lot. Keep bringing the excellent content. I really appreciate you!

[@Denverbi11]

Great video. Great Collaboration. I would really enjoy the nmap analysis.

[@albanselaj733]

Thanks, David and Chris! Amazing content that helps us a lot in our everyday work!

[@majiddehbi9186]

Such pleasure its real chrismus to have u here guys its so instructive God bless u

[@davidbombal]

Thank you Majid!

[@naesone2653]

Bunch of questions is great david thank you

[@vyasG]

Thank you David and Chris for this amazing video. Very useful content.

[@aquadir2830]

Thank you so much David.. I'm a big fan of yours.. Happy merry Christmas 🎄..

[@marcsuhling9317]

wow this is so interesting to watch and learn from the pros. thanks david for this video.

[@amirchegg]

As always, Thank you David! If you can please do a walkthrough series on Kali Linux Tools, that would be awesome. There was a video where you showed us how to use Wifite properly, how to configure it and also how to troubleshoot common problems (which i think is a phenomenon! No-one bothers itself to explain how to solve those problems, but you did make a separate video just to show us how to fix problems we all have encountered while working with that tool). Sience many people want to learn ethical hacking and this channel is by far my favorite resource, making a series of videos explaining each and every tool that is shipped with Kali has a really good potential. Also, the way you explain things is absolutely incredible and makes difficult things to be super easy to grasp. Thats the main reason why im asking you for this! Ive got nothing more to say and im really looking forward to see those videos!

[@davidbombal]

Thank you. Great suggestion 😄

[@gamershubke6982]

Love your videos since day one I have learnt alot from you continue doing this great work 💪

[@skriptak6308]

I can't tell if that's just David's personality, but I notice he's one of those people that talk over you in a Convo lol ... Chris can't get out a full sentence before David interrupts him ..either way both of these guys are brilliant as well as the video ...love it !

[@patrickilunga3312]

Thanks David after 6 months moving in US I got job RTP because I am also CCNA certified.

[@davidbombal]

Huge congratulations Patrick! Well done!

[@gibsonswe]

Love these videos! Could watch for hours

[@tarrylim778]

Excited next video with how nmap scan

[@nallachi2913]

Nice conversation both of you chris and DB❤️❤️❤️ are marvelous stuff giving persons

[@davidbombal]

Thank you. Lots of fun talking with Chris about Wireshark 😄

[@jointherevolution5577]

Very good work mate! helped a lot with a uni assignment!

[@planetbobful]

Great vid - lekker man! Love the Blue Hat training vids - greatly appreciated!

[@davidbombal]

Happy to hear that :)

[@batreilangrynjah2526]

thank you David for this I learned a lot ..want some more videos like this

[@kjetilandreedstrm1678]

Hi! Great video! I was blown away over this! But it might be just me that is a complete noob. I just find a TCP-handshake file with 15 packets in the WireShark-link above? Should it not be the complete file from the attack Chris is using in the video?

[@davidbombal]

Thanks. Please try this link: davidbombal.wiki/tcphackers1 - looks like I made a mistake :(

[@kjetilandreedstrm1678]

@@davidbombal Hm. It looks like this link is directing to the same file as the other link??

[@zioleo9093]

Same File , Just 15 packets.

[@tmusic99]

Very interesting. I have done a lot of statistical analysis in other domains. Would love to see more statistical analysis examples in Wireshark. And how to export data, filtered or not filtered, to a statistical analysis package.

[@avjyots2601]

Amazing analysis, thanks 👍

[@tahersadeghi6773]

Hey Chris. In this video, you mention a low number in a suspicious 34000 range. Is this number randomly chosen by the server, browser, or person initiating the packet? and what if this number was in the high number range?

[@glenp42]

Q: Can we get copies of the wireshark profiles used?

[@FJB_KJV]

I can imagine a lot more utility then just for attacks. Makes me think of EtherPeek IP Maps, the old sniffer pro ip matrix or Skitter application that is or used to be available via CAIDA - pretty cool. Did not know that feature set was available for Wireshark

[@anthonyjohnson2607]

keep on asking questions david, we all have the same questions!

[@Andrew-mh6cl]

Congrats sir we ill reach soon 1million best wishes master. ❤️❤️❤️❤️❤️❤️❤️

[@davidbombal]

Thank you!

[@itsme7570]

Sometimes David asks very basic questions but I guess it doesn't hurt

[@ranganathannandakumar4463]

This is GOLD! Thank you!

[@fifthamendment1]

If the TTL number is close, would it not mean that the source is from the same location? Perhaps the hops were changed up a bit such as sent through various VPNs?

[@gilbertohernandez9223]

Do you have a podcast by chance? I enjoy hearing you talk about anything computers related.

[@groovetrain397]

Ok thats great guys, so how do we block it!??

[@Whit3hat]

Ask away David, most cases what I was thinking thx

[@faran_siddiqui-d3t]

David and chris are the best

[@davidbombal]

Thank you!

[@majiddehbi9186]

One more question for Chris what's u re idealy profile in whshark in order to get a max of infos when we try to track the wierd packets thx

[@davidbombal]

I'll ask Chris to cover Wireshark profiles in another video 😄

[@majiddehbi9186]

@@davidbombal GOd bless u David and have wonderful Christmas with all u re be loved ones

[@trevorhenrytrey]

How do you stop the traffic once you notice this is not normal traffic. Or it's not real time analysis

[@RayzDEV]

Thanks for video :) very informative.

[@davidbombal]

Glad it was helpful!

[@symshark]

The trace file in the download link only contains the TCP Handshake with 15 packets. Is the trace file used in this video available to download?

[@davidbombal]

Please try again using this link: davidbombal.wiki/tcphackers1 - NOTE please that your browser may cache the incorrect link so you may need to use a private / incognito window or different browser if it doesn't work for you

[@SuperPrabhdeepsingh]

what a video!! Go for nmap for the next video

[@mouridmostapha9378]

You the best david keep 🔥❤

[@smokestudio1408]

Really interesting stuff ☺️

[@davidbombal]

Thank you!

[@ThePumbaadk]

What a great video, very nice 👍🏻

[@davidbombal]

Thank you very much!

[@Ak4sh07]

Love You David Bombal

[@davidbombal]

Thank you!

[@joerockhead7246]

more Chris. more Chris. more Chris.

[@scottsparling2591]

so, if UDP is connection-less, but QUIC is happening over UDP, AND has a connection ID and session ID (TLS), are we now to consider UDP in some cases connection oriented, or just consider QUIC connection oriented? I hope my question makes sense to others.

[@vivekkrishnan9794]

From my understanding, quic is a protocol with connection oriented properties running over udp. UDP itself is not connection oriented

[@killerx8902]

Great stuff and I vote for nmap

[@jackjohn8323]

Can you share the link to PCAP file please. The one shared only has the Videos but not PCAP

[@davidbombal]

Thanks. I've fixed the link. Please download again. davidbombal.wiki/tcphackers1

[@KevinCrabb]

Hi, David and Chris, I'm having a hard time making it work on my Windows version of Wireshark. I downloaded it for MMDB but it was formatted in tar.gz not .mmdb. So I formatted it to .mmdb, point it to my path folder, restarted Wireshark but no luck. Is there something I'm missing?

[@davidbombal]

There was a problem with the download link. Please try downloading again using the Dropbox link in the video description. It is a zip file that you need to download

[@danynite9736]

Hello David I have a problem with Kali Linux in VMBox. When I use firefox, my CPU is 100% overloaded . What can I do against it?

[@Firoz900]

Great. Thank you guru.

[@SOC_Pavi]

Hello David, Seems the pcap file that was uploaded to Dropbox only showing 15 packets. I not applied any filters. Could you please check and assist on this.

[@davidbombal]

Please try this link: davidbombal.wiki/tcphackers1

[@zioleo9093]

@@davidbombal Same 15 Packets only. 😢

[@SOC_Pavi]

@@davidbombalOnly 15 packets in the PCAP file

[@davidbombal]

Legit TCP flows or hacking attacks? Can Wireshark help us to decode the flows and see if the traffic is malicious? // WIRESHARK FILE // Download here: www.dropbox.com/s/pvytdvkvxl8b41n/SYNScan_GeoIP_ChrisGreer.pcapng.zip?dl=0 // MAXMIND // How to: wiki.wireshark.org/HowToUseGeoIP Maxmind: www.maxmind.com/en/home // MY STUFF // www.amazon.com/shop/davidbombal // SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: twitter.com/davidbombal Instagram: instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal KZbin: kzbin.info //CHRIS GREER // Udemy course: davidbombal.wiki/chriswireshark LinkedIn: www.linkedin.com/in/cgreer/ KZbin: kzbin.info Twitter: twitter.com/packetpioneer // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: [e-mail] Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!

[@mmaranta785]

Wonderful!

[@chris7691]

LOTS OF QUESTIONS

[@refaiabdeen5943]

Cheers Mate.

[@Thriller627]

Cheers! P;S. Keep on asking questions.. d ; } #DavidBombal

[@UrRealestCritic]

Can I use witeshark on the new M1 MacBook?

[@gabethedog4043]

yes

[@UrRealestCritic]

@@gabethedog4043 thanks bro.

[@omkhard1833]

Great Video Sir David ....

[@davidbombal]

Glad you liked it!

[@juanrodriguez825]

Nmap

[@technoman9926]

Print ("hello David")

[@davidbombal]

Hello!

[@JarppaGuru]

3:50 now give compare very popular website are they 1 second part.

[@mohamedaymenzebouchi]

Yeh, ask questions

[@davidbombal]

Thanks. I'll do that 😄

[@tyalva1814]

phone verification not working on discord

[@sohilshrestha3089]

how to stop my terminal from saving history in kali linux 2021.4

[@vikpa1211]

I think machine learning algorithms can detect those types of patterns and malicious traffic in real time

[@Ak4sh07]

Great Content

[@davidbombal]

Thank you!

[@omharwalkar4868]

Sir how to hack any Android phone by sending image file. It's possible

[@shlokjhunjhunwala7082]

Is it possible?

[@hack4peace]

Yes

[@raghavendraraaghu7908]

No it's not possible since we can't have a backdoor like processing the payload as a backdoor when the img is opened if I'm not wrong!

[@omharwalkar4868]

@@shlokjhunjhunwala7082 but how

[@omharwalkar4868]

@@hack4peace but how

[@yeteldonn4649]

thx u.

[@ashersilver7388]

I havnt watched the whole video. But yes, ASK AWAY!!!

[@adolfor5427]

Mannnn, this is just cool

[@alapanroy1114]

I want question ans conversion

[@fairplay8347]

Sir Love from India Iam a CCNP student Should I learn python for future

[@originals2747]

informative

[@davidbombal]

Glad you enjoyed the video 😄

[@fahadbawazir1771]

David sir, I like that..

[@davidbombal]

Really happy to hear that

[@ArSiddharth]

I have a question, I'm a beginner, And I do not understand where should I start, from where should I study? I don't understand anything..... Love❤️ from india 🇮🇳

[@davidbombal]

Network+ or CCNA are a great way to start learning basics. Watch this video for more tips: kzbin.info/www/bejne/iXfFh2qpibh0oqM

[@ArSiddharth]

@@davidbombal ohh men, thanks a lot, I didn't think you would reply to my comment ,Thanks sir, ♥️♥️

[@DevrajSingh-rs7fn]

Hi Big fan of you and your videos

[@davidbombal]

Thank you so much 😀

[@fahadbawazir1771]

Good

[@davidbombal]

Thank you Fahad!

[@JasonConnel]

Ask questions please

[@MrDullBull]

Greetings from Russia! You put us on the map! LOL

[@mohamedaymenzebouchi]

Yaaah

[@davidbombal]

Hope you enjoy the video!

[@mohamedaymenzebouchi]

@@davidbombalI did !!!!

[@Unknwn_Light_]

👨🏻‍💻

[@ArSiddharth]

Nice video

[@davidbombal]

Thank you very much!

[@abdulrahmanfaisal288]

Keep going

[@davidbombal]

Thank you!

[@ArSiddharth]

Sir I'm your Big fan

[@davidbombal]

Thank you!

[@sayedislam8117]

Love from 🇧🇩

[@davidbombal]

Thank you and welcome!