Is this an attack? Wireshark Packet analysis // SYN Attack

[@SpragginsDesigns]

Thank you for everything, David. After two years in college I was just hired last week as a remote Web and Mobile App Designer and Developer. Because I am also OSCP certified, it drastically raised my salary and the fun level of my position. And a lot of your courses are to thank for this; college is just for the paper or "degrees"."

[@davidbombal]

That is awesome! Congratulations!!!

[@SystemDemon]

These are blessing comments! David is my IT hero and my life is changing as well. I say David is making art, and we cant thank him enough!

[@warrioratthewall1969]

I like when you ask questions David. It's often something I'm wanting to ask, or sometimes something I should be asking but didnt even ask in my mind. Thanks again!

[@piotrwikarski9401]

Thank you guys for collaborating. Chris Greer is amazing. Strange that I never came across him before. Thanks again!

[@pistol0grip0pump]

In response to the question, I'd prefer if you wrote/noted the questions for later and just let the person talk because you never know what cool lessons/tips/stories you missed out on because their flow/train of thought was stopped. Just pick up at the end LOVE the content! This has me busy and working towards real goals out of deep pit of depression I've been in for years, thank you David :)

[@itech_live]

I came across to this demo, it was really helpful for me to learn about Maxmind and integrated to my Wireshark. Thanks to you and your host for put time on making this video.

[@Alain9-1]

please don't let down those long video version i've enjoyed them a lot and waiting for more ( TCP/IP, scapy, Linux ...) 🔥🔥

[@CyberNancy]

Solid content. Knowing what normal/innocuous traffic patterns look like helps you identify the suspicious traffic patterns. Chris's focus on TTL, window size, and sequence numbers is a really great example of how a seasoned analyst approaches pcap.

[@TheStsparrow]

Something to note: Industrial control system protocols commonly utilize 20 byte header lengths. It's done for efficiency. But arguably they don't generally run on TCP port 80.... and hopefully not over the internet. Great video guys

[@warrioratthewall1969]

Like BACnet?

[@sergeyshevtsov5125]

David, every video you make is non trivial and some kind of fantastic. Thanks Chris for sharing knowledge!

[@rusnakhraj7401]

For me I prefer if u r asking question around because it gives us more information and it can help us understand topic better from other point of view. And I see that you have really good questions from student point of view David.

[@amirchegg]

As always, Thank you David! If you can please do a walkthrough series on Kali Linux Tools, that would be awesome. There was a video where you showed us how to use Wifite properly, how to configure it and also how to troubleshoot common problems (which i think is a phenomenon! No-one bothers itself to explain how to solve those problems, but you did make a separate video just to show us how to fix problems we all have encountered while working with that tool). Sience many people want to learn ethical hacking and this channel is by far my favorite resource, making a series of videos explaining each and every tool that is shipped with Kali has a really good potential. Also, the way you explain things is absolutely incredible and makes difficult things to be super easy to grasp. Thats the main reason why im asking you for this! Ive got nothing more to say and im really looking forward to see those videos!

[@davidbombal]

Thank you. Great suggestion 😄

[@jaimerosariojusticia]

Questions. Always ask, even if is a "dumb" one. The answer is what matters and what is needed. Great video (even the first 5 min are good enough) Thanks again David Bombal.

[@davidbombal]

Thank you. I'll do that 😄

[@patrickilunga3312]

Thanks David after 6 months moving in US I got job RTP because I am also CCNA certified.

[@davidbombal]

Huge congratulations Patrick! Well done!

[@marcorossi2664]

Grazie David per i contenuti che divulghi....io sono Italiano e ti seguo da un po...mi hai aperto un mondo....😊

[@Denverbi11]

Great video. Great Collaboration. I would really enjoy the nmap analysis.

[@skriptak6308]

I can't tell if that's just David's personality, but I notice he's one of those people that talk over you in a Convo lol ... Chris can't get out a full sentence before David interrupts him ..either way both of these guys are brilliant as well as the video ...love it !

[@samjones4327]

Another awesome video!!! Thank you guys for showing us how to read and interpret the packet capture in wireshark!!! I have a new and easier understanding of what I am looking at! Supurb explanation! Now I have a new toy through GOIP!! I would love to see NMAP in action in wireshark! Thanks David and Chris! Cheers!

[@GenXpress]

Thank you, David, and in this video Chris too. Your content is great, and I been following you for a while....Keep it up and keep it coming :)

[@tmusic99]

Very interesting. I have done a lot of statistical analysis in other domains. Would love to see more statistical analysis examples in Wireshark. And how to export data, filtered or not filtered, to a statistical analysis package.

[@dwaynesudduth1028]

Fantastic content once again, proving that you are a top-tier content creator for IT. Thank you and thank you Chris Greer!!

[@fritzbiederstadt4869]

I can imagine a lot more utility then just for attacks. Makes me think of EtherPeek IP Maps, the old sniffer pro ip matrix or Skitter application that is or used to be available via CAIDA - pretty cool. Did not know that feature set was available for Wireshark

[@majiddehbi9186]

Such pleasure its real chrismus to have u here guys its so instructive God bless u

[@davidbombal]

Thank you Majid!

[@brianturney2124]

This is great. I love it when you ask lots of questions. I am usually asking the same ones in my head. Perfect!

[@kjetilandreedstrm1678]

Hi! Great video! I was blown away over this! But it might be just me that is a complete noob. I just find a TCP-handshake file with 15 packets in the WireShark-link above? Should it not be the complete file from the attack Chris is using in the video?

[@davidbombal]

Thanks. Please try this link: davidbombal.wiki/tcphackers1 - looks like I made a mistake :(

[@kjetilandreedstrm1678]

@@davidbombal Hm. It looks like this link is directing to the same file as the other link??

[@zioleo9093]

Same File , Just 15 packets.

[@itsme7570]

Sometimes David asks very basic questions but I guess it doesn't hurt

[@marcsuhling9317]

wow this is so interesting to watch and learn from the pros. thanks david for this video.

[@naesone2653]

Bunch of questions is great david thank you

[@albanselaj733]

Thanks, David and Chris! Amazing content that helps us a lot in our everyday work!

[@tommyd22277]

David this was fantastic! I enjoyed that a lot. Keep bringing the excellent content. I really appreciate you!

[@tarrylim778]

Excited next video with how nmap scan

[@aquadir2830]

Thank you so much David.. I'm a big fan of yours.. Happy merry Christmas 🎄..

[@batreilangrynjah2526]

thank you David for this I learned a lot ..want some more videos like this

[@nallachi2913]

Nice conversation both of you chris and DB❤️❤️❤️ are marvelous stuff giving persons

[@davidbombal]

Thank you. Lots of fun talking with Chris about Wireshark 😄

[@gamershubke6982]

Love your videos since day one I have learnt alot from you continue doing this great work 💪

[@anthonyjohnson2607]

keep on asking questions david, we all have the same questions!

[@vyasG]

Thank you David and Chris for this amazing video. Very useful content.

[@jointherevolution5577]

Very good work mate! helped a lot with a uni assignment!

[@davidbombal]

Legit TCP flows or hacking attacks? Can Wireshark help us to decode the flows and see if the traffic is malicious? // WIRESHARK FILE // Download here: www.dropbox.com/s/pvytdvkvxl8b41n/SYNScan_GeoIP_ChrisGreer.pcapng.zip?dl=0 // MAXMIND // How to: wiki.wireshark.org/HowToUseGeoIP Maxmind: www.maxmind.com/en/home // MY STUFF // www.amazon.com/shop/davidbombal // SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: twitter.com/davidbombal Instagram: instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal KZbin: kzbin.info //CHRIS GREER // Udemy course: davidbombal.wiki/chriswireshark LinkedIn: www.linkedin.com/in/cgreer/ KZbin: kzbin.info Twitter: twitter.com/packetpioneer // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: [e-mail] Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!

[@planetbobful]

Great vid - lekker man! Love the Blue Hat training vids - greatly appreciated!

[@davidbombal]

Happy to hear that :)

[@jacobhenriksen2324]

Love these videos! Could watch for hours

[@gilbertohernandez9223]

Do you have a podcast by chance? I enjoy hearing you talk about anything computers related.

[@joerockhead7246]

more Chris. more Chris. more Chris.

[@Whit3hat]

Ask away David, most cases what I was thinking thx

[@Andrew-mh6cl]

Congrats sir we ill reach soon 1million best wishes master. ❤️❤️❤️❤️❤️❤️❤️

[@davidbombal]

Thank you!

[@avjyots2601]

Amazing analysis, thanks 👍

[@chris7691]

LOTS OF QUESTIONS

[@vikpa1211]

I think machine learning algorithms can detect those types of patterns and malicious traffic in real time

[@glenp42]

Q: Can we get copies of the wireshark profiles used?

[@tahersadeghi6773]

Hey Chris. In this video, you mention a low number in a suspicious 34000 range. Is this number randomly chosen by the server, browser, or person initiating the packet? and what if this number was in the high number range?

[@SuperPrabhdeepsingh]

what a video!! Go for nmap for the next video

[@ranganathannandakumar4463]

This is GOLD! Thank you!

[@juanrodriguez825]

Nmap

[@technoman9926]

Print ("hello David")

[@davidbombal]

Hello!

[@groovetrain397]

Ok thats great guys, so how do we block it!??

[@fifthamendment1]

If the TTL number is close, would it not mean that the source is from the same location? Perhaps the hops were changed up a bit such as sent through various VPNs?

[@killerx8902]

Great stuff and I vote for nmap

[@ashersilver7388]

I havnt watched the whole video. But yes, ASK AWAY!!!

[@Ak4sh07]

Love You David Bombal

[@davidbombal]

Thank you!

[@faran_siddiqui-d3t]

David and chris are the best

[@davidbombal]

Thank you!

[@scottsparling2591]

so, if UDP is connection-less, but QUIC is happening over UDP, AND has a connection ID and session ID (TLS), are we now to consider UDP in some cases connection oriented, or just consider QUIC connection oriented? I hope my question makes sense to others.

[@vivekkrishnan9794]

From my understanding, quic is a protocol with connection oriented properties running over udp. UDP itself is not connection oriented

[@smokestudio1408]

Really interesting stuff ☺️

[@davidbombal]

Thank you!

[@mohamedaymenzebouchi]

Yeh, ask questions

[@davidbombal]

Thanks. I'll do that 😄

[@Firoz900]

Great. Thank you guru.

[@omkhard1833]

Great Video Sir David ....

[@davidbombal]

Glad you liked it!

[@RayzDEV]

Thanks for video :) very informative.

[@davidbombal]

Glad it was helpful!

[@refaiabdeen5943]

Cheers Mate.

[@mmaranta785]

Wonderful!

[@majiddehbi9186]

One more question for Chris what's u re idealy profile in whshark in order to get a max of infos when we try to track the wierd packets thx

[@davidbombal]

I'll ask Chris to cover Wireshark profiles in another video 😄

[@majiddehbi9186]

@@davidbombal GOd bless u David and have wonderful Christmas with all u re be loved ones

[@Ak4sh07]

Great Content

[@davidbombal]

Thank you!

[@fairplay8347]

Sir Love from India Iam a CCNP student Should I learn python for future

[@symshark]

The trace file in the download link only contains the TCP Handshake with 15 packets. Is the trace file used in this video available to download?

[@davidbombal]

Please try again using this link: davidbombal.wiki/tcphackers1 - NOTE please that your browser may cache the incorrect link so you may need to use a private / incognito window or different browser if it doesn't work for you

[@ThePumbaadk]

What a great video, very nice 👍🏻

[@davidbombal]

Thank you very much!

[@KevinCrabb]

Hi, David and Chris, I'm having a hard time making it work on my Windows version of Wireshark. I downloaded it for MMDB but it was formatted in tar.gz not .mmdb. So I formatted it to .mmdb, point it to my path folder, restarted Wireshark but no luck. Is there something I'm missing?

[@davidbombal]

There was a problem with the download link. Please try downloading again using the Dropbox link in the video description. It is a zip file that you need to download

[@trevorhenrytrey]

How do you stop the traffic once you notice this is not normal traffic. Or it's not real time analysis

[@mouridmostapha9378]

You the best david keep 🔥❤

[@danynite9736]

Hello David I have a problem with Kali Linux in VMBox. When I use firefox, my CPU is 100% overloaded . What can I do against it?

[@adolfor5427]

Mannnn, this is just cool

[@fahadbawazir1771]

David sir, I like that..

[@davidbombal]

Really happy to hear that

[@ArSiddharth]

I have a question, I'm a beginner, And I do not understand where should I start, from where should I study? I don't understand anything..... Love❤️ from india 🇮🇳

[@davidbombal]

Network+ or CCNA are a great way to start learning basics. Watch this video for more tips: kzbin.info/www/bejne/iXfFh2qpibh0oqM

[@ArSiddharth]

@@davidbombal ohh men, thanks a lot, I didn't think you would reply to my comment ,Thanks sir, ♥️♥️

[@Thriller627]

Cheers! P;S. Keep on asking questions.. d ; } #DavidBombal

[@yeteldonn4649]

thx u.

[@DevrajSingh-rs7fn]

Hi Big fan of you and your videos

[@davidbombal]

Thank you so much 😀

[@abdulrahmanfaisal288]

Keep going

[@davidbombal]

Thank you!

[@sohilshrestha3089]

how to stop my terminal from saving history in kali linux 2021.4

[@originals2747]

informative

[@davidbombal]

Glad you enjoyed the video 😄

[@jackjohn8323]

Can you share the link to PCAP file please. The one shared only has the Videos but not PCAP

[@davidbombal]

Thanks. I've fixed the link. Please download again. davidbombal.wiki/tcphackers1

[@randommiser3310]

David from South af

[@ArSiddharth]

Sir I'm your Big fan

[@davidbombal]

Thank you!

[@ArSiddharth]

Nice video

[@davidbombal]

Thank you very much!

[@JarppaGuru]

3:50 now give compare very popular website are they 1 second part.

[@SOC_Pavi]

Hello David, Seems the pcap file that was uploaded to Dropbox only showing 15 packets. I not applied any filters. Could you please check and assist on this.

[@davidbombal]

Please try this link: davidbombal.wiki/tcphackers1

[@zioleo9093]

@@davidbombal Same 15 Packets only. 😢

[@SOC_Pavi]

@@davidbombalOnly 15 packets in the PCAP file

[@sayedislam8117]

Love from 🇧🇩

[@davidbombal]

Thank you and welcome!

[@CheeseLayong]

NMAP.

[@UrRealestCritic]

Can I use witeshark on the new M1 MacBook?

[@gabethedog4043]

yes

[@UrRealestCritic]

@@gabethedog4043 thanks bro.

[@theconfusedhamster]

Imagine heart and comment from Devid Sir

[@davidbombal]

You got it! Now what?

[@theconfusedhamster]

@@davidbombal now I am Gonna Fall in love for You

[@alapanroy1114]

I want question ans conversion

[@mohamedaymenzebouchi]

Yaaah

[@davidbombal]

Hope you enjoy the video!

[@mohamedaymenzebouchi]

@@davidbombalI did !!!!

[@fahadbawazir1771]

Good

[@davidbombal]

Thank you Fahad!

[@julianllouve4835]

you the best

[@tyalva1814]

phone verification not working on discord