Is this an attack? Wireshark Packet analysis // SYN Attack

[@SpragginsDesigns]

Thank you for everything, David. After two years in college I was just hired last week as a remote Web and Mobile App Designer and Developer. Because I am also OSCP certified, it drastically raised my salary and the fun level of my position. And a lot of your courses are to thank for this; college is just for the paper or "degrees"."

[@davidbombal]

That is awesome! Congratulations!!!

[@SystemDemon]

These are blessing comments! David is my IT hero and my life is changing as well. I say David is making art, and we cant thank him enough!

[@davidbombal]

Legit TCP flows or hacking attacks? Can Wireshark help us to decode the flows and see if the traffic is malicious? // WIRESHARK FILE // Download here: www.dropbox.com/s/pvytdvkvxl8b41n/SYNScan_GeoIP_ChrisGreer.pcapng.zip?dl=0 // MAXMIND // How to: wiki.wireshark.org/HowToUseGeoIP Maxmind: www.maxmind.com/en/home // MY STUFF // www.amazon.com/shop/davidbombal // SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: twitter.com/davidbombal Instagram: instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal KZbin: kzbin.info //CHRIS GREER // Udemy course: davidbombal.wiki/chriswireshark LinkedIn: www.linkedin.com/in/cgreer/ KZbin: kzbin.info Twitter: twitter.com/packetpioneer // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: [e-mail] Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!

[@warrioratthewall1969]

I like when you ask questions David. It's often something I'm wanting to ask, or sometimes something I should be asking but didnt even ask in my mind. Thanks again!

[@CyberNancy]

Solid content. Knowing what normal/innocuous traffic patterns look like helps you identify the suspicious traffic patterns. Chris's focus on TTL, window size, and sequence numbers is a really great example of how a seasoned analyst approaches pcap.

[@itech_live]

I came across to this demo, it was really helpful for me to learn about Maxmind and integrated to my Wireshark. Thanks to you and your host for put time on making this video.

[@pistol0grip0pump]

In response to the question, I'd prefer if you wrote/noted the questions for later and just let the person talk because you never know what cool lessons/tips/stories you missed out on because their flow/train of thought was stopped. Just pick up at the end LOVE the content! This has me busy and working towards real goals out of deep pit of depression I've been in for years, thank you David :)

[@Alain9-1]

please don't let down those long video version i've enjoyed them a lot and waiting for more ( TCP/IP, scapy, Linux ...) 🔥🔥

[@piotrwikarski9401]

Thank you guys for collaborating. Chris Greer is amazing. Strange that I never came across him before. Thanks again!

[@sergeyshevtsov5125]

David, every video you make is non trivial and some kind of fantastic. Thanks Chris for sharing knowledge!

[@TheStsparrow]

Something to note: Industrial control system protocols commonly utilize 20 byte header lengths. It's done for efficiency. But arguably they don't generally run on TCP port 80.... and hopefully not over the internet. Great video guys

[@warrioratthewall1969]

Like BACnet?

[@rusnakhraj7401]

For me I prefer if u r asking question around because it gives us more information and it can help us understand topic better from other point of view. And I see that you have really good questions from student point of view David.

[@tommyd22277]

David this was fantastic! I enjoyed that a lot. Keep bringing the excellent content. I really appreciate you!

[@dwaynesudduth1028]

Fantastic content once again, proving that you are a top-tier content creator for IT. Thank you and thank you Chris Greer!!

[@samjones4327]

Another awesome video!!! Thank you guys for showing us how to read and interpret the packet capture in wireshark!!! I have a new and easier understanding of what I am looking at! Supurb explanation! Now I have a new toy through GOIP!! I would love to see NMAP in action in wireshark! Thanks David and Chris! Cheers!

[@jaimerosariojusticia]

Questions. Always ask, even if is a "dumb" one. The answer is what matters and what is needed. Great video (even the first 5 min are good enough) Thanks again David Bombal.

[@davidbombal]

Thank you. I'll do that 😄

[@majiddehbi9186]

Such pleasure its real chrismus to have u here guys its so instructive God bless u

[@davidbombal]

Thank you Majid!

[@jacobhenriksen2324]

Love these videos! Could watch for hours

[@GenXpress]

Thank you, David, and in this video Chris too. Your content is great, and I been following you for a while....Keep it up and keep it coming :)

[@brianturney2124]

This is great. I love it when you ask lots of questions. I am usually asking the same ones in my head. Perfect!

[@marcorossi2664]

Grazie David per i contenuti che divulghi....io sono Italiano e ti seguo da un po...mi hai aperto un mondo....😊

[@amirchegg]

As always, Thank you David! If you can please do a walkthrough series on Kali Linux Tools, that would be awesome. There was a video where you showed us how to use Wifite properly, how to configure it and also how to troubleshoot common problems (which i think is a phenomenon! No-one bothers itself to explain how to solve those problems, but you did make a separate video just to show us how to fix problems we all have encountered while working with that tool). Sience many people want to learn ethical hacking and this channel is by far my favorite resource, making a series of videos explaining each and every tool that is shipped with Kali has a really good potential. Also, the way you explain things is absolutely incredible and makes difficult things to be super easy to grasp. Thats the main reason why im asking you for this! Ive got nothing more to say and im really looking forward to see those videos!

[@davidbombal]

Thank you. Great suggestion 😄

[@Denverbi11]

Great video. Great Collaboration. I would really enjoy the nmap analysis.

[@marcsuhling9317]

wow this is so interesting to watch and learn from the pros. thanks david for this video.

[@patrickilunga3312]

Thanks David after 6 months moving in US I got job RTP because I am also CCNA certified.

[@davidbombal]

Huge congratulations Patrick! Well done!

[@vyasG]

Thank you David and Chris for this amazing video. Very useful content.

[@gamershubke6982]

Love your videos since day one I have learnt alot from you continue doing this great work 💪

[@naesone2653]

Bunch of questions is great david thank you

[@albanselaj733]

Thanks, David and Chris! Amazing content that helps us a lot in our everyday work!

[@jointherevolution5577]

Very good work mate! helped a lot with a uni assignment!

[@aquadir2830]

Thank you so much David.. I'm a big fan of yours.. Happy merry Christmas 🎄..

[@planetbobful]

Great vid - lekker man! Love the Blue Hat training vids - greatly appreciated!

[@davidbombal]

Happy to hear that :)

[@skriptak6308]

I can't tell if that's just David's personality, but I notice he's one of those people that talk over you in a Convo lol ... Chris can't get out a full sentence before David interrupts him ..either way both of these guys are brilliant as well as the video ...love it !

[@tarrylim778]

Excited next video with how nmap scan

[@tmusic99]

Very interesting. I have done a lot of statistical analysis in other domains. Would love to see more statistical analysis examples in Wireshark. And how to export data, filtered or not filtered, to a statistical analysis package.

[@ranganathannandakumar4463]

This is GOLD! Thank you!

[@batreilangrynjah2526]

thank you David for this I learned a lot ..want some more videos like this

[@Ak4sh07]

Love You David Bombal

[@davidbombal]

Thank you!

[@fritzbiederstadt4869]

I can imagine a lot more utility then just for attacks. Makes me think of EtherPeek IP Maps, the old sniffer pro ip matrix or Skitter application that is or used to be available via CAIDA - pretty cool. Did not know that feature set was available for Wireshark

[@avjyots2601]

Amazing analysis, thanks 👍

[@nallachi2913]

Nice conversation both of you chris and DB❤️❤️❤️ are marvelous stuff giving persons

[@davidbombal]

Thank you. Lots of fun talking with Chris about Wireshark 😄

[@itsme7570]

Sometimes David asks very basic questions but I guess it doesn't hurt

[@kjetilandreedstrm1678]

Hi! Great video! I was blown away over this! But it might be just me that is a complete noob. I just find a TCP-handshake file with 15 packets in the WireShark-link above? Should it not be the complete file from the attack Chris is using in the video?

[@davidbombal]

Thanks. Please try this link: davidbombal.wiki/tcphackers1 - looks like I made a mistake :(

[@kjetilandreedstrm1678]

@@davidbombal Hm. It looks like this link is directing to the same file as the other link??

[@zioleo9093]

Same File , Just 15 packets.

[@anthonyjohnson2607]

keep on asking questions david, we all have the same questions!

[@faran_siddiqui-d3t]

David and chris are the best

[@davidbombal]

Thank you!

[@glenp42]

Q: Can we get copies of the wireshark profiles used?

[@joerockhead7246]

more Chris. more Chris. more Chris.

[@killerx8902]

Great stuff and I vote for nmap

[@smokestudio1408]

Really interesting stuff ☺️

[@davidbombal]

Thank you!

[@Andrew-mh6cl]

Congrats sir we ill reach soon 1million best wishes master. ❤️❤️❤️❤️❤️❤️❤️

[@davidbombal]

Thank you!

[@mouridmostapha9378]

You the best david keep 🔥❤

[@ThePumbaadk]

What a great video, very nice 👍🏻

[@davidbombal]

Thank you very much!

[@omkhard1833]

Great Video Sir David ....

[@davidbombal]

Glad you liked it!

[@Whit3hat]

Ask away David, most cases what I was thinking thx

[@mmaranta785]

Wonderful!

[@Firoz900]

Great. Thank you guru.

[@Ak4sh07]

Great Content

[@davidbombal]

Thank you!

[@RayzDEV]

Thanks for video :) very informative.

[@davidbombal]

Glad it was helpful!

[@groovetrain397]

Ok thats great guys, so how do we block it!??

[@refaiabdeen5943]

Cheers Mate.

[@gilbertohernandez9223]

Do you have a podcast by chance? I enjoy hearing you talk about anything computers related.

[@fifthamendment1]

If the TTL number is close, would it not mean that the source is from the same location? Perhaps the hops were changed up a bit such as sent through various VPNs?

[@adolfor5427]

Mannnn, this is just cool

[@tahersadeghi6773]

Hey Chris. In this video, you mention a low number in a suspicious 34000 range. Is this number randomly chosen by the server, browser, or person initiating the packet? and what if this number was in the high number range?

[@vikpa1211]

I think machine learning algorithms can detect those types of patterns and malicious traffic in real time

[@SuperPrabhdeepsingh]

what a video!! Go for nmap for the next video

[@scottsparling2591]

so, if UDP is connection-less, but QUIC is happening over UDP, AND has a connection ID and session ID (TLS), are we now to consider UDP in some cases connection oriented, or just consider QUIC connection oriented? I hope my question makes sense to others.

[@vivekkrishnan9794]

From my understanding, quic is a protocol with connection oriented properties running over udp. UDP itself is not connection oriented

[@juanrodriguez825]

Nmap

[@sayedislam8117]

Love from 🇧🇩

[@davidbombal]

Thank you and welcome!

[@DevrajSingh-rs7fn]

Hi Big fan of you and your videos

[@davidbombal]

Thank you so much 😀

[@ashersilver7388]

I havnt watched the whole video. But yes, ASK AWAY!!!

[@technoman9926]

Print ("hello David")

[@davidbombal]

Hello!

[@trevorhenrytrey]

How do you stop the traffic once you notice this is not normal traffic. Or it's not real time analysis

[@danynite9736]

Hello David I have a problem with Kali Linux in VMBox. When I use firefox, my CPU is 100% overloaded . What can I do against it?

[@theconfusedhamster]

Imagine heart and comment from Devid Sir

[@davidbombal]

You got it! Now what?

[@theconfusedhamster]

@@davidbombal now I am Gonna Fall in love for You

[@chris7691]

LOTS OF QUESTIONS

[@abdulrahmanfaisal288]

Keep going

[@davidbombal]

Thank you!

[@symshark]

The trace file in the download link only contains the TCP Handshake with 15 packets. Is the trace file used in this video available to download?

[@davidbombal]

Please try again using this link: davidbombal.wiki/tcphackers1 - NOTE please that your browser may cache the incorrect link so you may need to use a private / incognito window or different browser if it doesn't work for you

[@ArSiddharth]

Nice video

[@davidbombal]

Thank you very much!

[@majiddehbi9186]

One more question for Chris what's u re idealy profile in whshark in order to get a max of infos when we try to track the wierd packets thx

[@davidbombal]

I'll ask Chris to cover Wireshark profiles in another video 😄

[@majiddehbi9186]

@@davidbombal GOd bless u David and have wonderful Christmas with all u re be loved ones

[@KevinCrabb]

Hi, David and Chris, I'm having a hard time making it work on my Windows version of Wireshark. I downloaded it for MMDB but it was formatted in tar.gz not .mmdb. So I formatted it to .mmdb, point it to my path folder, restarted Wireshark but no luck. Is there something I'm missing?

[@davidbombal]

There was a problem with the download link. Please try downloading again using the Dropbox link in the video description. It is a zip file that you need to download

[@fahadbawazir1771]

David sir, I like that..

[@davidbombal]

Really happy to hear that

[@julianllouve4835]

you the best

[@ArSiddharth]

Sir I'm your Big fan

[@davidbombal]

Thank you!

[@yeteldonn4649]

thx u.

[@sohilshrestha3089]

how to stop my terminal from saving history in kali linux 2021.4

[@ArSiddharth]

I have a question, I'm a beginner, And I do not understand where should I start, from where should I study? I don't understand anything..... Love❤️ from india 🇮🇳

[@davidbombal]

Network+ or CCNA are a great way to start learning basics. Watch this video for more tips: kzbin.info/www/bejne/iXfFh2qpibh0oqM

[@ArSiddharth]

@@davidbombal ohh men, thanks a lot, I didn't think you would reply to my comment ,Thanks sir, ♥️♥️

[@jackjohn8323]

Can you share the link to PCAP file please. The one shared only has the Videos but not PCAP

[@davidbombal]

Thanks. I've fixed the link. Please download again. davidbombal.wiki/tcphackers1

[@mohamedaymenzebouchi]

Yeh, ask questions

[@davidbombal]

Thanks. I'll do that 😄

[@originals2747]

informative

[@davidbombal]

Glad you enjoyed the video 😄

[@fairplay8347]

Sir Love from India Iam a CCNP student Should I learn python for future

[@SOC_Pavi]

Hello David, Seems the pcap file that was uploaded to Dropbox only showing 15 packets. I not applied any filters. Could you please check and assist on this.

[@davidbombal]

Please try this link: davidbombal.wiki/tcphackers1

[@zioleo9093]

@@davidbombal Same 15 Packets only. 😢

[@SOC_Pavi]

@@davidbombalOnly 15 packets in the PCAP file

[@Thriller627]

Cheers! P;S. Keep on asking questions.. d ; } #DavidBombal

[@omharwalkar4868]

Sir how to hack any Android phone by sending image file. It's possible

[@shlokjhunjhunwala7082]

Is it possible?

[@traderboy006]

Yes

[@raghavendraraaghu7908]

No it's not possible since we can't have a backdoor like processing the payload as a backdoor when the img is opened if I'm not wrong!

[@omharwalkar4868]

@@shlokjhunjhunwala7082 but how

[@omharwalkar4868]

@@traderboy006 but how

[@UrRealestCritic]

Can I use witeshark on the new M1 MacBook?

[@gabethedog4043]

yes

[@UrRealestCritic]

@@gabethedog4043 thanks bro.

[@MrDullBull]

Greetings from Russia! You put us on the map! LOL

[@alapanroy1114]

I want question ans conversion

[@tyalva1814]

phone verification not working on discord

[@fahadbawazir1771]

Good

[@davidbombal]

Thank you Fahad!

[@JarppaGuru]

3:50 now give compare very popular website are they 1 second part.

[@samxaiver9852]

So, I can findout if people are trying to spy on my activities. COOL!