Linux Blimp

By Jack M. Germain

Sep 19, 2018 5:00 AM PT

Linux and the open source business model are far different today than many of the early developers might have hoped. Neither can claim a rags-to-riches story. Rather, their growth cycles have been a series of hit-or-miss milestones.

The Linux desktop has yet to find a home on the majority of consumer and enterprise computers. However, Linux-powered technology has long ruled the Internet and conquered the cloud and Internet of Things deployments. Both Linux and free open source licensing have dominated in other ways.

Microsoft Windows 10 has experienced similar deployment struggles as proprietary developers have searched for better solutions to support consumers and enterprise users.

Meanwhile, Linux is the more rigorous operating system, but it has been beset by a growing list of open source code vulnerabilities and compatibility issues.

The Windows phone has come and gone. Apple’s iPhone has thrived in spite of stagnation and feature restrictions. Meanwhile, the Linux-based open source Android phone platform is a worldwide leader.

Innovation continues to drive demand for Chromebooks in homes, schools and offices. The Linux kernel-driven Chrome OS, with its browser-based environment, has made staggering inroads for simplicity of use and effective productivity.

Chromebooks now can run Android apps. Soon the ability to run Linux programs will further feed open source development and usability, both for personal and enterprise adoption.

One of the most successful aspects of non-proprietary software trends is the wildfire growth of container technology in the cloud, driven by Linux and open source. Those advancements have pushed Microsoft into bringing Linux elements into the Windows OS and containers into its Azure cloud environment.

“Open source is headed toward faster and faster rates of change, where the automated tests and tooling wrapped around the delivery pipeline are almost as important as the resulting shipped artifacts,” said Abraham Ingersoll, vice president of sales and solutions engineering at
Gravitational.

“The highest velocity projects will naturally win market share, and those with the best feedback loops are steadily gaining speed on the laggards,” he told LinuxInsider.

Advancement in Progress

To succeed with the challenges of open source business models, enterprises have to devise a viable way to monetize community development of reusable code. Those who succeed also have to master the formula for growing a free computing platform or its must-have applications into a profitable venture.

Based on an interesting GitLab report, 2018 is the year for open source and DevOps, remarked Kyle Bittner, business development manager at
Exit Technologies.

That forecast may be true eventually, as long as open source can dispel the security fears, he told LinuxInsider.

“With open source code fundamental to machine learning and artificial intelligence frameworks, there is a challenge ahead to convince the more traditional IT shops in automotive and oil and gas, for example, that this is not a problem,” Bittner pointed out.

The future of the open source model may be vested in the ability to curb worsening security flaws in bloated coding. That is a big “if,” given how security risks have grown as Linux-based deployments evolved from isolated systems to large multitenancy environments.

LinuxInsider asked several open source innovators to share their views on where the open source model is headed, and to recommend the best practices developers should use to leverage different OS deployment models.

Oracle’s OS Oracle

Innovative work and developer advances changed the confidence level for Oracle engineers working with hardware where containers are involved, according to Wim Coekaerts, senior vice president of operating systems and virtualization engineering at Oracle. Security of a container is critical to its reliability.

“Security should be part of how you do your application rollout and not something you consider afterward. You really need to integrate security as part of your design up front,” he told LinuxInsider.

Several procedures in packaging containers require security considerations. That security assessment starts when you package something. In building a container, you must consider the source of those files that you are packaging, Coekaerts said.

Security continues with how your image is created. For instance, do you have code scanners? Do you have best practices around the ports you are opening? When you download from third-party websites, are those images signed so you can be sure of what you are getting?

“It is common today with
Docker Hub to have access to a million different images. All of this is cool. But when you download something, all that you have is a black box,” said Coekaerts. “If that image that you run contains ‘phone home’ type stuff, you just do not know unless you dig into it.”

Yesterday Returns

Ensuring that containers are built securely is the inbound side of the technology equation. The outbound part involves running the application. The current model is to run containers in a cloud provider world inside a virtual machine to ensure that you are protected, noted Coekaerts.

“While that’s great, it is a major change in direction from when we started using containers. It was a vehicle for getting away from a VM,” he said. “Now the issue has shifted to concerns about not wanting the VM overhead. So what do we do today? We run everything inside a VM. That is an interesting turn of events.”

A related issue focuses on running containers natively because there is not enough isolation between processes. So now what?

The new response is to run containers in a VM to protect them. Security is not compromised, thanks to lots of patches in Linux and the hypervisor. That ensures all the issues with the cache and side channels are patched, Coekearts said.

However, it leads to new concerns among Oracle’s developers about how they can ramp up performance and keep up that level of isolation, he added.

Are Containers the New Linux OS?

Some view today’s container technology as the first step in creating a subset of traditional Linux. Coekaerts gives that view some credence.

“Linux the kernel is Linux the kernel. What is an operating system today? If you look at a Linux distribution, that certainly is morphing a little bit,” he replied.

What is running an operating system today? Part of the model going forward, Coekaerts continued, is that instead of installing an OS and installing applications on top, you basically pull in a Docker-like structure.

“The nice thing with that model is you can run different versions on the same machine without having to worry about library conflicts and such,” he said.

Today’s container operations resemble the old mainframe model. On the mainframe, everything was a VM. Every application you started had its own VM.

“We are actually going backward in time, but at a much lighter weight model. It is a similar concept,” Coekearts noted.

Container Tech Responds Rapidly

Container technology is evolving quickly.

“Security is a central focus. As issues surface, developers are dealing with them quickly,” Coekearts said, and the security focus applies to other aspects of the Linux OS too.

“All the Linux developers have been working on these issues,” he noted. “There has been a great communication channel before the disclosure date to make sure that everyone has had time to patch their version or the kernel, and making sure that everyone shares code,” he said. “Is the process perfect? No. But everyone works together.”

Security Black Eye

Vulnerabilities in open source code have been the cause of many recent major security breaches, said Dean Weber, CTO of
Mocana.

Open source components
are present in 96 percent of commercial applications, based on a report Black Duck released last year.

The average application has 147 different open source components — 67 percent of which are used components with known vulnerabilities, according to the report.

“Using vulnerable, open source code in embedded OT (operational technology), IoT (Internet of Things) and ICS (industrial control system) environments is a bad idea for many reasons,” Weber told LinuxInsider.

He cited several examples:

• The code is not reliable within those devices.
• Code vulnerabilities easily can be exploited. In OT environments, you don’t always know where the code is in use or if it is up to date.
• Systems cannot always be patched in the middle of production cycles.

“As the use of insecure open source code continues to grow in OT, IoT and ICS environments, we may see substations going down on the same day, major cities losing power, and sewers backing up into water systems, contaminating our drinking water,” Weber warned.

Good and Bad Coexist

The brutal truth for companies using open source libraries and frameworks is that open source is awesome, generally high-quality, and absolutely the best method for accelerating digital transformation, maintained Jeff Williams, CTO of
Contrast Security.

However, open source comes with a big *but,* he added.

“You are trusting your entire business to code written by people you don’t know for a purpose different than yours, and who may be hostile to you,” Williams told Linuxinsider.

Another downside to open source is that hackers have figured out that it is an easy attack vector. Dozens of new vulnerabilities in open source components are released every week, he noted.

Every business option comes with a bottom line. For open source, the user is responsible for the security of all the open source used.

“It is not a free lunch when you adopt it. You are also taking on the responsibility to think about security, keep it up to date, and establish other protections when necessary,” Williams said.

Best Practices

Developers need an efficient guideline to leverage different deployment models. Software complexity makes it almost impossible for organizations to deliver secure systems. So it is about covering the bases, according to Exit Technologies’ Bittner.

Fundamental practices, such as creating an inventory of open source components, can help devs match known vulnerabilities with installed software. That reduces the threat risk, he said.

“Of course, there is a lot of pressure on dev teams to build more software more quickly, and that has led to increased automation and the rise of DevOps,” Bittner acknowledged. “Businesses have to ensure they don’t cut corners on testing.”

Developers should follow the Unix philosophy of minimalist, modular deployment models, suggested Gravitational’s Ingersoll. The Unix approach involves progressive layering of small tools to form end-to-end continuous integration pipelines. That produces code running in a real target environment without manual intervention.

Another solution for developers is an approach that can standardize with a common build for their specific use that considers third-party dependencies, security and licenses, suggested Bart Copeland, CEO of
ActiveState. Also, best practices for OS deployment models need to consider dependency management and environment configuration.

“This will reduce problems when integrating code from different departments, decrease friction, increase speed, and reduce attack surface area. It will eliminate painful retrofitting open source languages for dependency management, security, licenses and more,” he told LinuxInsider.

Where Is the Open Source Model Headed?

Open source has been becoming more and more enterprise led. That has been accompanied by an increased rise in distributed applications composed from container-based services, such as Kubernetes, according to Copeland.

Application security is at odds with the goals of development: speed, agility and leveraging open source. These two paths need to converge in order to facilitate development and enterprise innovation.

“Open source has won. It is the way everyone — including the U.S. government — now builds applications. Unfortunately, open source remains chronically underfunded,” said Copeland.

That will lead to open source becoming more and more enterprise-led. Enterprises will donate their employee time to creating and maintaining open source.

Open source will continue to dominate the cloud and most server estates, predicted Howard Green, vice president of marketing for
Azul Systems. That influence starts with the Linux OS and extends through much of the data management, monitoring and development stack in enterprises of all sizes.

It is inevitable that open source will continue to grow, said Contrast Security’s Williams. It is inextricably bound with modern software.

“Every website, every API, every desktop application, every mobile app, and every other kind of software almost invariably includes a large amount of open source libraries and frameworks,” he observed. “It is simply unavoidable and would be fiscally imprudent to try to develop all that code yourself.”

Jack M. Germain has been an ECT News Network reporter since 2003. His main areas of focus are enterprise IT, Linux and open source technologies. He has written numerous reviews of Linux distros and other open source software.
Email Jack.

Source

As if e-commerce companies didn’t have enough problems with transacting securely and defending against things like fraud, another avalanche of security problems — like cryptojacking, the act of illegally mining cryptocurrency on your end servers — has begun.

We’ve also seen a rise in digital credit card skimming attacks against popular e-commerce software such as Magento. Some of the attacks are relatively naive and un-targeted, taking advantage of lax security on websites found to be vulnerable, while others are highly targeted for maximum volume.

Indeed, it’s so ridiculous that there are websites such as
MageReport.com
and
Mage Scan
that will provide scans of your website for any client-facing malware.

As for server-side problems, you might be out of luck. A lot of e-commerce software lives in a typical LAMP stack, and while there is a plethora of security software for Windows-based environments, the situation is fairly bleak for Linux.

For a long time, Linux enjoyed a kind of smug arrogance with regard to security, and its advocates pooh-poohed the notoriously hackable Windows operating system. However, it’s becoming ultra clear that it’s just as susceptible, if not more so, for specific software such as e-commerce solutions.

Bridges Falling Down

Why have things seemingly gotten so much worse lately? It is not that security controls and processes have changed dramatically. It’s more that the attacks have become more lucrative, more tempting, and easier to get away with, thanks to the rise of cryptocurrency. It allows attackers to generate money quickly, easily and, more important, anonymously.

Folks — this is the loudspeaker — our digital roads and bridges are falling down. They are old and decrepit. Our security controls and processes have not kept pace with the rapid advancement of malware, it’s ease of use, and its coupling with a new range of software that allows attackers to hide their trails more effectively.

Things like cryptocurrency, however, are just the symptom of a greater issue. That issue is the fact that the underlying software foundations we’ve been using ever since the first browsers appeared are built on a fundamentally flawed architecture.

Feature and Flaw

The general purpose operating system that allowed every company to have a whole slew of easy-to-use desktop software in the 90s, and that built up amazingly large Internet companies in the early 2000s, has an Achilles heel. It is explicitly designed to run multiple programs on the same system — such as cryptominers on the server that runs your WooCommerce or Magento application.

It is an old concept that dates back to the late 1960s, when the first general purpose operating systems, such as Unix, were introduced. Back then, the computers had a business need to run multiple programs and applications on them. The systems back then were just too big and too expensive not to. They literally filled entire walls.

That’s not the case in 2018. Today our computers are “virtual,” and they can be taken down and brought up with the push of a button — usually by other programs. It’s a completely different world.

Now for end user computing devices such as personal laptops and phones, we want this design characteristic, as we have the need to use the browser, check our email, use the calendar and such. However, on the server side where our databases and websites live, it’s a flaw.

Virtual Ransacking

This seemingly innocuous design characteristic is what allows attackers to run their programs, such as cryptominers, on your servers. It is what allows attackers to insert card skimmers into your websites. It is what allows the attackers to run malware on your servers that try and shut down other pieces of malware in order to remain the dominant attacker.

Yes, you read that right — many of these variants now have so much free rein on so many thousands of websites that they literally fight against each other for your computing resources. This is how bad it’s gotten. It’s as if the cryptocriminals threw a party at your house while you were gone and then got into a big brawl and tore up all your furniture and ransacked your house. Then they woke up the next day and laughed all the way to the bank.

This isn’t the only way to deploy software, though. Consider famous software companies such as Uber, Airbnb, Twitter and Facebook. If you talk to their engineers, they’ll tell you that they already have to isolate a given program per server — in this case, a virtual machine. Why? It’s because they simply have too much software to begin with.

Instead of dealing with a single database, they might have to deal with hundreds or thousands. Likewise, the old concept of allowing multiple users on a given system doesn’t make a lot of sense anymore. It has evolved to the point where identity access management lives outside of the single server model.

Hack Attacks Are Not Inevitable

Unikernels embrace this new model of software provisioning yet enforce it at the same time. They run only one single application per virtual machine (the server). They can not, by design, run other programs on the same server.

This completely prevents attackers from running their programs on your server. It prevents them from downloading new software onto the server and massively limits their ability to inject malicious content, such as credit card skimming scripts and cryptomining programs.

Instead of scanning for hacked systems or unpatched systems waiting to be attacked, you could even run outdated software that has known bugs in it, and these same styles of attacks would fall flat, as there would be no capability to execute them. This is all enforced at the operating system level and backed by hardware baked-in isolation.

Are we going to continue to let the cryptocriminals run free on our servers? How are you going to call the cops on people you can’t even see who might live halfway around the world? Don’t fall prey to the notion that hackers are natural disasters and it’s only inevitable that they’ll get you one day. It doesn’t need to be like that. We don’t have to deploy our software like we are using computers from the 1970s. It’s time that we rebuilt our digital infrastructure.

Ian Eyberg is CEO of
NanoVMs, based in San Francisco. A self-taught expert in computer science, specifically operating systems and mainstream security, Eyberg is dedicated to initiating a revolution and mass-upgrading of global software infrastructure, which for the most part is based on 40-year-old tired technology. Prior to cracking the code of unikernels and developing a commercial viable solution, Eyberg was an early engineer at Appthority, an enterprise mobile security company.

Source

Source

tcpdump is a well known command line packet analyzer tool. Using tcpdump command we can capture the live TCP/IP packets and these packets can also be saved to a file. Later on these captured packets can be analyzed via tcpdump command. tcpdump command becomes very handy when it comes to troubleshooting on network level.

tcpdump is available in most of the Linux distributions, for Debian based Linux, it be can be installed using apt command,

# apt install tcpdump -y

On RPM based Linux OS, tcpdump can be installed using below yum command

# yum install tcpdump -y

When we run the tcpdump command without any options then it will capture packets of all the interfaces. So to stop or cancel the tcpdump command, type “ctrl+c” . In this tutorial we will discuss how to capture and analyze packets using different practical examples,

Example:1) Capturing packets from a specific interface

When we run the tcpdump command without any options, it will capture packets on the all interfaces, so to capture the packets from a specific interface use the option ‘-i‘ followed by the interface name.

Syntax :

# tcpdump -i

Let’s assume, i want to capture packets from interface “enp0s3”

[[email protected] ~]# tcpdump -i enp0s3

Output would be something like below,

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
06:43:22.905890 IP compute-0-1.example.com.ssh > 169.144.0.1.39374: Flags [P.], seq 21952160:21952540, ack 13537, win 291, options [nop,nop,TS val 26164373 ecr 6580205], length 380
06:43:22.906045 IP compute-0-1.example.com.ssh > 169.144.0.1.39374: Flags [P.], seq 21952540:21952760, ack 13537, win 291, options [nop,nop,TS val 26164373 ecr 6580205], length 220
06:43:22.906150 IP compute-0-1.example.com.ssh > 169.144.0.1.39374: Flags [P.], seq 21952760:21952980, ack 13537, win 291, options [nop,nop,TS val 26164373 ecr 6580205], length 220
06:43:22.906291 IP 169.144.0.1.39374 > compute-0-1.example.com.ssh: Flags [.], ack 21952980, win 13094, options [nop,nop,TS val 6580205 ecr 26164373], length 0
06:43:22.906303 IP 169.144.0.1.39374 > compute-0-1.example.com.ssh: Flags [P.], seq 13537:13609, ack 21952980, win 13094, options [nop,nop,TS val 6580205 ecr 26164373], length 72
06:43:22.906322 IP compute-0-1.example.com.ssh > 169.144.0.1.39374: Flags [P.], seq 21952980:21953200, ack 13537, win 291, options [nop,nop,TS val 26164373 ecr 6580205], length 220
^C
109930 packets captured
110065 packets received by filter
133 packets dropped by kernel
[[email protected] ~]#

Example:2) Capturing specific number number of packet from a specific interface

Let’s assume we want to capture 12 packets from the specific interface like “enp0s3”, this can be easily achieved using the options “-c -i ”

[email protected] ~]# tcpdump -c 12 -i enp0s3

Example:3) Display all the available Interfaces for tcpdump

Use ‘-D‘ option to display all the available interfaces for tcpdump command,

[[email protected] ~]# tcpdump -D
1.enp0s3
2.enp0s8
3.ovs-system
4.br-int
5.br-tun
6.nflog (Linux netfilter log (NFLOG) interface)
7.nfqueue (Linux netfilter queue (NFQUEUE) interface)
8.usbmon1 (USB bus number 1)
9.usbmon2 (USB bus number 2)
10.qbra692e993-28
11.qvoa692e993-28
12.qvba692e993-28
13.tapa692e993-28
14.vxlan_sys_4789
15.any (Pseudo-device that captures on all interfaces)
16.lo [Loopback]
[[email protected] ~]#

I am running the tcpdump command on one of my openstack compute node, that’s why in the output you have seen number interfaces, tab interface, bridges and vxlan interface.

Example:4) Capturing packets with human readable timestamp (-tttt option)

By default in tcpdump command output, there is no proper human readable timestamp, if you want to associate human readable timestamp to each captured packet then use ‘-tttt‘ option, example is shown below,

[[email protected] ~]# tcpdump -c 8 -tttt -i enp0s3
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
2018-08-25 23:23:36.954883 IP compute-0-1.example.com.ssh > 169.144.0.1.39406: Flags [P.], seq 1449206247:1449206435, ack 3062020950, win 291, options [nop,nop,TS val 86178422 ecr 21583714], length 188
2018-08-25 23:23:36.955046 IP 169.144.0.1.39406 > compute-0-1.example.com.ssh: Flags [.], ack 188, win 13585, options [nop,nop,TS val 21583717 ecr 86178422], length 0
2018-08-25 23:23:37.140097 IP controller0.example.com.amqp > compute-0-1.example.com.57818: Flags [P.], seq 814607956:814607964, ack 2387094506, win 252, options [nop,nop,TS val 86172228 ecr 86176695], length 8
2018-08-25 23:23:37.140175 IP compute-0-1.example.com.57818 > controller0.example.com.amqp: Flags [.], ack 8, win 237, options [nop,nop,TS val 86178607 ecr 86172228], length 0
2018-08-25 23:23:37.355238 IP compute-0-1.example.com.57836 > controller0.example.com.amqp: Flags [P.], seq 1080415080:1080417400, ack 1690909362, win 237, options [nop,nop,TS val 86178822 ecr 86163054], length 2320
2018-08-25 23:23:37.357119 IP controller0.example.com.amqp > compute-0-1.example.com.57836: Flags [.], ack 2320, win 1432, options [nop,nop,TS val 86172448 ecr 86178822], length 0
2018-08-25 23:23:37.357545 IP controller0.example.com.amqp > compute-0-1.example.com.57836: Flags [P.], seq 1:22, ack 2320, win 1432, options [nop,nop,TS val 86172449 ecr 86178822], length 21
2018-08-25 23:23:37.357572 IP compute-0-1.example.com.57836 > controller0.example.com.amqp: Flags [.], ack 22, win 237, options [nop,nop,TS val 86178825 ecr 86172449], length 0
8 packets captured
134 packets received by filter
69 packets dropped by kernel
[[email protected] ~]#

Example:5) Capturing and saving packets to a file (-w option)

Use “-w” option in tcpdump command to save the capture TCP/IP packet to a file, so that we can analyze those packets in the future for further analysis.

Syntax :

# tcpdump -w file_name.pcap -i

Note: Extension of file must be .pcap

Let’s assume i want to save the captured packets of interface “enp0s3” to a file name enp0s3-26082018.pcap

[[email protected] ~]# tcpdump -w enp0s3-26082018.pcap -i enp0s3

Above command will generate the output something like below,

[[email protected] ~]# tcpdump -w enp0s3-26082018.pcap -i enp0s3
tcpdump: listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
^C841 packets captured
845 packets received by filter
0 packets dropped by kernel
[[email protected] ~]# ls
anaconda-ks.cfg enp0s3-26082018.pcap
[[email protected] ~]#

Capturing and Saving the packets whose size greater than N bytes

[[email protected] ~]# tcpdump -w enp0s3-26082018-2.pcap greater 1024

Capturing and Saving the packets whose size less than N bytes

[[email protected] ~]# tcpdump -w enp0s3-26082018-3.pcap less 1024

Example:6) Reading packets from the saved file ( -r option)

In the above example we have saved the captured packets to a file, we can read those packets from the file using the option ‘-r‘, example is shown below,

[[email protected] ~]# tcpdump -r enp0s3-26082018.pcap

Reading the packets with human readable timestamp,

[[email protected] ~]# tcpdump -tttt -r enp0s3-26082018.pcap
reading from file enp0s3-26082018.pcap, link-type EN10MB (Ethernet)
2018-08-25 22:03:17.249648 IP compute-0-1.example.com.ssh > 169.144.0.1.39406: Flags [P.], seq 1426167803:1426167927, ack 3061962134, win 291, options
[nop,nop,TS val 81358717 ecr 20378789], length 124
2018-08-25 22:03:17.249840 IP 169.144.0.1.39406 > compute-0-1.example.com.ssh: Flags [.], ack 124, win 564, options [nop,nop,TS val 20378791 ecr 81358
717], length 0
2018-08-25 22:03:17.454559 IP controller0.example.com.amqp > compute-0-1.example.com.57836: Flags [.], ack 1079416895, win 1432, options [nop,nop,TS v
al 81352560 ecr 81353913], length 0
2018-08-25 22:03:17.454642 IP compute-0-1.example.com.57836 > controller0.example.com.amqp: Flags [.], ack 1, win 237, options [nop,nop,TS val 8135892
2 ecr 81317504], length 0
2018-08-25 22:03:17.646945 IP compute-0-1.example.com.57788 > controller0.example.com.amqp: Flags [.], seq 106760587:106762035, ack 688390730, win 237
, options [nop,nop,TS val 81359114 ecr 81350901], length 1448
2018-08-25 22:03:17.647043 IP compute-0-1.example.com.57788 > controller0.example.com.amqp: Flags [P.], seq 1448:1956, ack 1, win 237, options [nop,no
p,TS val 81359114 ecr 81350901], length 508
2018-08-25 22:03:17.647502 IP controller0.example.com.amqp > compute-0-1.example.com.57788: Flags [.], ack 1956, win 1432, options [nop,nop,TS val 813
52753 ecr 81359114], length 0
………………………………………………………………………………………………………….

Read More on : How to Install and Use Wireshark on Debian 9 / Ubuntu 16.04

Example:7) Capturing only IP address packets on a specific Interface (-n option)

Using -n option in tcpdum command we can capture only IP address packets on specific interface, example is shown below,

[[email protected] ~]# tcpdump -n -i enp0s3

Output of above command would be something like below,

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
22:22:28.537904 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 1433301395:1433301583, ack 3061976250, win 291, options [nop,nop,TS val 82510005 ecr 20666610], length 188
22:22:28.538173 IP 169.144.0.1.39406 > 169.144.0.20.ssh: Flags [.], ack 188, win 9086, options [nop,nop,TS val 20666613 ecr 82510005], length 0
22:22:28.538573 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 188:552, ack 1, win 291, options [nop,nop,TS val 82510006 ecr 20666613], length 364
22:22:28.538736 IP 169.144.0.1.39406 > 169.144.0.20.ssh: Flags [.], ack 552, win 9086, options [nop,nop,TS val 20666613 ecr 82510006], length 0
22:22:28.538874 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 552:892, ack 1, win 291, options [nop,nop,TS val 82510006 ecr 20666613], length 340
22:22:28.539042 IP 169.144.0.1.39406 > 169.144.0.20.ssh: Flags [.], ack 892, win 9086, options [nop,nop,TS val 20666613 ecr 82510006], length 0
22:22:28.539178 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 892:1232, ack 1, win 291, options [nop,nop,TS val 82510006 ecr 20666613], length 340
22:22:28.539282 IP 169.144.0.1.39406 > 169.144.0.20.ssh: Flags [.], ack 1232, win 9086, options [nop,nop,TS val 20666614 ecr 82510006], length 0
22:22:28.539479 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 1232:1572, ack 1, win 291, options [nop,nop,TS val 82510006 ecr 20666614], length 340
22:22:28.539595 IP 169.144.0.1.39406 > 169.144.0.20.ssh: Flags [.], ack 1572, win 9086, options [nop,nop,TS val 20666614 ecr 82510006], length 0
22:22:28.539760 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 1572:1912, ack 1, win 291, options [nop,nop,TS val 82510007 ecr 20666614], length 340
……………………………………………………………….

You can also capture N number of IP address packets using -c and -n option in tcpdump command,

[[email protected] ~]# tcpdump -c 25 -n -i enp0s3

Example:8) Capturing only TCP packets on a specific interface

In tcpdump command we can capture only tcp packets using the ‘tcp‘ option,

[[email protected] ~]# tcpdump -i enp0s3 tcp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
22:36:54.521053 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 1433336467:1433336655, ack 3061986618, win 291, options [nop,nop,TS val 83375988 ecr 20883106], length 188
22:36:54.521474 IP 169.144.0.1.39406 > 169.144.0.20.ssh: Flags [.], ack 188, win 9086, options [nop,nop,TS val 20883109 ecr 83375988], length 0
22:36:54.522214 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 188:552, ack 1, win 291, options [nop,nop,TS val 83375989 ecr 20883109], length 364
22:36:54.522508 IP 169.144.0.1.39406 > 169.144.0.20.ssh: Flags [.], ack 552, win 9086, options [nop,nop,TS val 20883109 ecr 83375989], length 0
22:36:54.522867 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 552:892, ack 1, win 291, options [nop,nop,TS val 83375990 ecr 20883109], length 340
22:36:54.523006 IP 169.144.0.1.39406 > 169.144.0.20.ssh: Flags [.], ack 892, win 9086, options [nop,nop,TS val 20883109 ecr 83375990], length 0
22:36:54.523304 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 892:1232, ack 1, win 291, options [nop,nop,TS val 83375990 ecr 20883109], length 340
22:36:54.523461 IP 169.144.0.1.39406 > 169.144.0.20.ssh: Flags [.], ack 1232, win 9086, options [nop,nop,TS val 20883110 ecr 83375990], length 0
22:36:54.523604 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 1232:1572, ack 1, win 291, options [nop,nop,TS val 83375991 ecr 20883110], length 340
…………………………………………………………………………………………………………………………………

Example:9) Capturing packets from a specific port on a specific interface

Using tcpdump command we can capture packet from a specific port (e.g 22) on a specific interface enp0s3

Syntax :

# tcpdump -i port

[[email protected] ~]# tcpdump -i enp0s3 port 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
22:54:45.032412 IP compute-0-1.example.com.ssh > 169.144.0.1.39406: Flags [P.], seq 1435010787:1435010975, ack 3061993834, win 291, options [nop,nop,TS val 84446499 ecr 21150734], length 188
22:54:45.032631 IP 169.144.0.1.39406 > compute-0-1.example.com.ssh: Flags [.], ack 188, win 9131, options [nop,nop,TS val 21150737 ecr 84446499], length 0
22:54:55.037926 IP compute-0-1.example.com.ssh > 169.144.0.1.39406: Flags [P.], seq 188:576, ack 1, win 291, options [nop,nop,TS val 84456505 ecr 21150737], length 388
22:54:55.038106 IP 169.144.0.1.39406 > compute-0-1.example.com.ssh: Flags [.], ack 576, win 9154, options [nop,nop,TS val 21153238 ecr 84456505], length 0
22:54:55.038286 IP compute-0-1.example.com.ssh > 169.144.0.1.39406: Flags [P.], seq 576:940, ack 1, win 291, options [nop,nop,TS val 84456505 ecr 21153238], length 364
22:54:55.038564 IP 169.144.0.1.39406 > compute-0-1.example.com.ssh: Flags [.], ack 940, win 9177, options [nop,nop,TS val 21153238 ecr 84456505], length 0
22:54:55.038708 IP compute-0-1.example.com.ssh > 169.144.0.1.39406: Flags [P.], seq 940:1304, ack 1, win 291, options [nop,nop,TS val 84456506 ecr 21153238], length 364
…………………………………………………………………………………………………………….
[[email protected] ~]#

Example:10) Capturing the packets from a Specific Source IP on a Specific Interface

Using “src” keyword followed by “ip address” in tcpdump command we can capture the packets from a specific Source IP,

syntax :

# tcpdump -n -i src

Example is shown below,

[[email protected] ~]# tcpdump -n -i enp0s3 src 169.144.0.10
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
23:03:45.912733 IP 169.144.0.10.amqp > 169.144.0.20.57800: Flags [.], ack 526623844, win 243, options [nop,nop,TS val 84981008 ecr 84982372], length 0
23:03:46.136757 IP 169.144.0.10.amqp > 169.144.0.20.57796: Flags [.], ack 2535995970, win 252, options [nop,nop,TS val 84981232 ecr 84982596], length 0
23:03:46.153398 IP 169.144.0.10.amqp > 169.144.0.20.57798: Flags [.], ack 3623063621, win 243, options [nop,nop,TS val 84981248 ecr 84982612], length 0
23:03:46.361160 IP 169.144.0.10.amqp > 169.144.0.20.57802: Flags [.], ack 2140263945, win 252, options [nop,nop,TS val 84981456 ecr 84982821], length 0
23:03:46.376926 IP 169.144.0.10.amqp > 169.144.0.20.57808: Flags [.], ack 175946224, win 252, options [nop,nop,TS val 84981472 ecr 84982836], length 0
23:03:46.505242 IP 169.144.0.10.amqp > 169.144.0.20.57810: Flags [.], ack 1016089556, win 252, options [nop,nop,TS val 84981600 ecr 84982965], length 0
23:03:46.616994 IP 169.144.0.10.amqp > 169.144.0.20.57812: Flags [.], ack 832263835, win 252, options [nop,nop,TS val 84981712 ecr 84983076], length 0
23:03:46.809344 IP 169.144.0.10.amqp > 169.144.0.20.57814: Flags [.], ack 2781799939, win 252, options [nop,nop,TS val 84981904 ecr 84983268], length 0
23:03:46.809485 IP 169.144.0.10.amqp > 169.144.0.20.57816: Flags [.], ack 1662816815, win 252, options [nop,nop,TS val 84981904 ecr 84983268], length 0
23:03:47.033301 IP 169.144.0.10.amqp > 169.144.0.20.57818: Flags [.], ack 2387094362, win 252, options [nop,nop,TS val 84982128 ecr 84983492], length 0
^C
10 packets captured
12 packets received by filter
0 packets dropped by kernel
[[email protected] ~]#

Example:11) Capturing packets from a specific destination IP on a specific Interface

Syntax :

# tcpdump -n -i dst

[[email protected] ~]# tcpdump -n -i enp0s3 dst 169.144.0.1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
23:10:43.520967 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 1439564171:1439564359, ack 3062005550, win 291, options [nop,nop,TS val 85404988 ecr 21390356], length 188
23:10:43.521441 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 188:408, ack 1, win 291, options [nop,nop,TS val 85404988 ecr 21390359], length 220
23:10:43.521719 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 408:604, ack 1, win 291, options [nop,nop,TS val 85404989 ecr 21390359], length 196
23:10:43.521993 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 604:800, ack 1, win 291, options [nop,nop,TS val 85404989 ecr 21390359], length 196
23:10:43.522157 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 800:996, ack 1, win 291, options [nop,nop,TS val 85404989 ecr 21390359], length 196
23:10:43.522346 IP 169.144.0.20.ssh > 169.144.0.1.39406: Flags [P.], seq 996:1192, ack 1, win 291, options [nop,nop,TS val 85404989 ecr 21390359], length 196
……………………………………………………………………………..

Example:12) Capturing TCP packet communication between two Hosts

Let’s assume i want to capture tcp packets between two hosts 169.144.0.1 & 169.144.0.20, example is shown below,

[[email protected] ~]# tcpdump -w two-host-tcp-comm.pcap -i enp0s3 tcp and (host 169.144.0.1 or host 169.144.0.20)

Capturing only SSH packet flow between two hosts using tcpdump command,

[[email protected] ~]# tcpdump -w ssh-comm-two-hosts.pcap -i enp0s3 src 169.144.0.1 and port 22 and dst 169.144.0.20 and port 22

Example:13) Capturing the udp network packets (to & fro) between two hosts

Syntax :

# tcpdump -w -s -i udp and (host and host )

[[email protected] ~]# tcpdump -w two-host-comm.pcap -s 1000 -i enp0s3 udp and (host 169.144.0.10 and host 169.144.0.20)

Example:14) Capturing packets in HEX and ASCII Format

Using tcpdump command, we can capture tcp/ip packet in ASCII and HEX format,

To capture the packets in ASCII format use -A option, example is shown below,

[[email protected] ~]# tcpdump -c 10 -A -i enp0s3
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
00:37:10.520060 IP compute-0-1.example.com.ssh > 169.144.0.1.39406: Flags [P.], seq 1452637331:1452637519, ack 3062125586, win 333, options [nop,nop,TS val 90591987 ecr 22687106], length 188
E…[[email protected]@……………V.|…T….MT……
.fR..Z-….b.:..Z5…{.’p….].”}…Z..9.?…….”[email protected]<…..V..C…..{,…OKP.2.*…`..-sS..1S………..:.O[…..O..6j.d…..
.Z-..fR.
00:37:11.687543 IP controller0.example.com.amqp > compute-0-1.example.com.57800: Flags [.], ack 526624548, win 243, options [nop,nop,TS val 90586768 ecr 90588146], length 0
[email protected]@.!L…
…..(..g….c.$………..
.f>..fC.
00:37:11.687612 IP compute-0-1.example.com.57800 > controller0.example.com.amqp: Flags [.], ack 1, win 237, options [nop,nop,TS val 90593155 ecr 90551716], length 0
[email protected]@……….
…(.c.$g…….Se…..
.fW..e..
………………………………………………………………………………………………………………………………..

To Capture the packets both in HEX and ASCII format use -XX option

[[email protected] ~]# tcpdump -c 10 -XX -i enp0s3
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
00:39:15.124363 IP compute-0-1.example.com.ssh > 169.144.0.1.39406: Flags [P.], seq 1452640859:1452641047, ack 3062126346, win 333, options [nop,nop,TS val 90716591 ecr 22718257], length 188
0x0000: 0a00 2700 0000 0800 27f4 f935 0800 4510 ..’…..’..5..E.
0x0010: 00f0 5bc6 4000 4006 8afc a990 0014 a990 ..[[email protected]@………
0x0020: 0001 0016 99ee 5695 8a5b b684 570a 8018 ……V..[..W…
0x0030: 014d 5418 0000 0101 080a 0568 39af 015a .MT……..h9..Z
0x0040: a731 adb7 58b6 1a0f 2006 df67 c9b6 4479 .1..X……g..Dy
0x0050: 19fd 2c3d 2042 3313 35b9 a160 fa87 d42c ..,=.B3.5..`…,
0x0060: 89a9 3d7d dfbf 980d 2596 4f2a 99ba c92a ..=}….%.O*…*
0x0070: 3e1e 7bf7 3af2 a5cc ee4f 10bc 7dfc 630d >.{.:….O..}.c.
0x0080: 898a 0e16 6825 56c7 b683 1de4 3526 ff04 ….h%V…..5&..
0x0090: 68d1 4f7d babd 27ba 84ae c5d3 750b 01bd h.O}..’…..u…
0x00a0: 9c43 e10a 33a6 8df2 a9f0 c052 c7ed 2ff5 .C..3……R../.
0x00b0: bfb1 ce84 edfc c141 6dad fa19 0702 62a7 …….Am…..b.
0x00c0: 306c db6b 2eea 824e eea5 acd7 f92e 6de3 0l.k…N……m.
0x00d0: 85d0 222d f8bf 9051 2c37 93c8 506d 5cb5 ..”-…Q,7..Pm.
0x00e0: 3b4a 2a80 d027 49f2 c996 d2d9 a9eb c1c4 ;J*..’I………
0x00f0: 7719 c615 8486 d84c e42d 0ba3 698c w……L.-..i.
00:39:15.124648 IP 169.144.0.1.39406 > compute-0-1.example.com.ssh: Flags [.], ack 188, win 13971, options [nop,nop,TS val 22718260 ecr 90716591], length 0
0x0000: 0800 27f4 f935 0a00 2700 0000 0800 4510 ..’..5..’…..E.
0x0010: 0034 6b70 4000 4006 7c0e a990 0001 a990 [email protected]@.|…….
0x0020: 0014 99ee 0016 b684 570a 5695 8b17 8010 ……..W.V…..
0x0030: 3693 7c0e 0000 0101 080a 015a a734 0568 6.|……..Z.4.h
0x0040: 39af
……………………………………………………………..

That’s all from this article, i hope you got an idea how to capture and analyze tcp/ip packets using tcpdump command. Please do share your feedback and comments.

Source

In this tutorial, we will tell you how to install kali Linux on raspberry pi 3. Raspberry pi is a single board small computer which is portable as well. Raspberry pi 3 is the third generation Raspberry Pi. It will cost you around $35-$40 (totally worth it). It will come with handy specs.

INSTALLATION REQUIREMENTS :

STEPS:

Note: Below ( ) are used to mention the time in the video.

1. Download all files from the above links.

2. Insert SD CARD and open Win32DiskImager . Locate your kali linux image file and sd card. Hit write.

3. After the writing process is done. Insert SD card in Raspberry Pi and do setup as shown (1:21)

4. Open Network sharing (1:39) . Do the settings as shown.

5. Open cmd and type arp -a .Note your ip address. (2:38)

6. Open Putty (3:00) and do configuration as shown.

7. Commands to install GUI

apt-get update (4:20)

apt-get install lxde (4:40)

apt-get install lightdm (5:15)

8. Open Xming (5:29) and type startlxde (5:37)

9. Successfully Installed (5:52)

Source

In this tutorial we will guide you how to stay anonymous while hacking online using TOR and Proxychains. Hiding your ass while hacking is easy just require some configuration which we will gonna see in this tutorial. Just follow this as shown.

First thing First!!!!

TOR

Tor is software and an open network that helps you defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy. It gives you access to the dark web.

Dark web is nothing but the encrypted network that exists between tor servers and their clients.

For more detail : https://www.torproject.org/

PROXYCHAINS

A tool that forces any TCP connection made by any given application to follow through proxy like TOR or any other SOCKS4, SOCKS5 or HTTP(S) proxy.

Supported auth-types: “user/pass” for SOCKS4/5, “basic” for HTTP.

Lets start!

STEPS:

1. Open kali linux terminal and type

root@kali:-# sudo apt-get install tor proxychains

root@kali:-# sudo service tor start

root@kali:-# gedit /etc/proxychains.conf

Go to http://proxylist.hidemyass.com/ . Select one ip and add as shown :

root@kali:-# proxychains wget http://ipinfo.io/ip -qO-

That’s it! Now you can use proxychains with any sort of command.

Example:

root@kali:-# proxychains sqlmap -u http://www.sqldummywebsite.com/cgi-bin/item.cgi?item_id=15 –dbs

############################################

# Full Hacking Course at Huge Discount:

Click Here

#

###########################################

Source

Source

October 9, 2018

Source

Inspired by ’80s arcade cabinet games, Eternum EX aims to be a challenging retro action platformer that’s releasing this month.

The developer said they were inspired by games like Bomb Jack (Tehkan, 1984), Ghosts’n Goblins (Capcom, 1985), Baluba-louk no Densetsu (Able, 1986) and Psychic 5 (Jaleco, 1987).

About the game:

Sir Arthur has gotten old… too old. He has lost everything he had and loved, and with nothing more to lose he leaves for Samarnath, an evil subterranean kingdom (which no knight has ever returned alive) in search of treasures, adventures and the most important: five magical orbs that together provide: the Eternal youth.

Thanks to its progressive difficulty curve, and with a path divided into “worlds” of 5 levels each one, Eternum Ex is challenging, addictive and an ode to the nostalgia of the golden age of arcade games.

Hard to really judge what it will be like considering the trailer didn’t show all that much, the description and feature list we were sent don’t exactly explain the game too well either. The art does look pretty polished though, the combat looks like it can get quite intense too. It’s hard to tell, but it seems like the levels in each world might be quite small focusing on the difficulty in each one rather than having you explore.

Due for release on October 25th, the developer told us this will include Linux support on Steam.

Source

Nowadays, everything revolves around the internet. The number of bloggers and writers is continuously increasing, and they all are trying to find something new to write about. For this reason, WordPress guarantees to give you the best opportunity to share your thoughts with others.

Since its creation, WordPress has been evolving to become the best platform for bloggers and writers. It has various themes and plugins that ensure the readers enjoy following their respective bloggers and writers without numerous distractions. If you are thinking of starting a blog on WordPress, here are some of the best WordPress themes for writers and bloggers.

Grace under pressure

This is among the best WordPress themes for writers. It has unique features that ensure your writing will get all the readers’ attention. If you are a writer who focuses on writing novels, poems and other literature-related texts, this theme is the best place for starting. It contains an originally responsive design, screenplay format, live customizer, an archive with beautiful cover photos, custom typography, touch-swipe gestures, and author profiles. All these features ensure you will attract your readers and they will enjoy going through your text. Additionally, when I need help with my college essay, this theme’s responsive design is all I need. It is very readable, and SEO-friendly.

Learn More About Grace Under Pressure Get Managed WordPress Hosting for Grace Under Pressure

Pocket

If you are looking for a simple blogger WordPress theme, then Pocket is all you need. It offers your readers kindle-like, readable pages that ensure they enjoy reading. The theme has elegant style with images and mixes grey and white colors. This guarantees that your visitors will see a welcoming image all through. What makes it different from the other themes is that it is easy for customizing, has social links, multimedia support, responsive design, minimalist layout, and toolkit plugin integration.

Learn More About Pocket Get Managed WordPress Hosting for Pocket

Less

Less is built with dynamic stylesheet language. This theme is lightweight and extremely minimal. Its folder is surprisingly sparse and it is easy for navigating through. The best thing about this theme is that it allows you to plan, arrange your ideas and create a great blog. It offers you lots of white space making it a perfect place for exploring your creativity.

Learn More About Less Get Managed WordPress Hosting for Less

Worldview

This theme has an enjoyable layout, upright header, a slide-in menu, and large images. It allows you to customize everything and ensure your story will look amazing. The design is simple, easy to use for both the writer and the reader. With it, you don’t have to invest in other materials in a pursuit of making your blog welcoming. It has an automatic text contrast that allows you to differentiate and arrange your thoughts in the right order.

Learn More About Worldview Get Managed WordPress Hosting for Worldview

Decode pro

Decode pro is one of the best WordPress themes available on the market. It is suitable for both writers and bloggers thanks to its minimalist style. You can also use it for personal blogs too especially for writers who concentrate much on their writing rather than the design. It has built-in SEO settings and features unlimited color schemes to ensure you can change from one color to the other. Additionally, it has a custom logo upload feature to allow you to personalize it to your specific needs.

Learn More About Decode Pro Get Managed WordPress Hosting for Decode Pro

DW Minion

If you are a writer or blogger who wishes to show off your content in a minimal layout, this theme is all you need. It has all the features aligned on your screen to ensure you can navigate through smoothly. It accommodates different skills to ensure your writing is suitable for all the visitors.

Learn More About DW Minion Get Managed WordPress Hosting for DW Minion

Zillah

Zillah is a modern, friendly and catchy theme that will ensure your content gets more views within a short time. If you are a writer looking for a classy presence online, this stylish theme will give you that. It is lightweight and has unlimited colors for you to integrate. It is also SEO-friendly and has author boxes in each post.

Learn More About Zillah Get Managed WordPress Hosting for Zillah

Evoke

Writing or blogging entails a variety of skills. Most writers are not able to use images on their sites because of the limitations on the theme they are using. If you are a writer who wishes to use both photography and writing to pass information, Evoke is the theme for you. It has live customizer, seven layouts, unlimited colors, and responsive design. It allows you to include large images in your posts too.

Learn More About Evoke Get Managed WordPress Hosting for Evoke

Forte

Forte is a unique theme with impressive writing space and exciting visuals. With this theme, you will enjoy its stylish and modern design, which makes it the best WordPress theme. Its homepage has featured images only to ensure you can arrange your thoughts appropriately.

Learn More About Forte Get Managed WordPress Hosting for Forte

Wild book

This theme looks precisely as a book. It is elegant and beautiful to ensure your visitors enjoy their stay on your site. It is also photo-friendly to ensure you can include different images for a more engaging post.

Learn More About WIld Book Get Managed WordPress Hosting for Wild Book

Although there are several other themes from WordPress, these creative themes will ensure you can start on your writing journey smoothly with less distraction. All themes also have their free versions to help you learn their basics before committing to them entirely.

About the Author

This article was submitted to us by a third-party writer. The views and opinions expressed in this article are those of the author and do not reflect the views and opinions of ThisHosting.Rocks. If you want to write for ThisHosting.Rocks, go here.

Harry Southworth is creative writer and blogger. His education helps him to write on a variety of topics, such as Tech, Marketing, and Big DATA. His hobbies are traveling, mobile photography, and, of course, writing – his job lets him combine all these.

Source