Lab 1

1
Lab 1
2
Investigate windows

• mac address
• ipconfig
• netstat
• ping
• traceroute

3
mac address

• find it
• check http//coffer.com/mac_find/
• try to change
• in the Ethernet adapter's Properties menu, in the
  Advanced tab, as "MAC Address", "Locally
  Administered Address", "Ethernet Address",
  "Physical Address" or "Network Address".

4

• ipconfig
• Displays all current TCP/IP network configuration
  values and refreshes Dynamic Host Configuration
  Protocol (DHCP) and Domain Name System (DNS)
  settings.
• http//technet.microsoft.com/en-us/library/bb49092
  1.aspx

5
Investigate windows

• netstat
• displays network connections (both incoming and
  outgoing), routing tables, and a number of
  network interface statistics
• http//en.wikipedia.org/wiki/Netstat

6

• ping
• Verifies IP-level connectivity to another TCP/IP
  computer by sending Internet Control Message
  Protocol (ICMP) Echo Request messages. The
  receipt of corresponding Echo Reply messages are
  displayed, along with round-trip times.
• http//en.wikipedia.org/wiki/Ping
• http//en.wikipedia.org/wiki/Internet_Control_Mess
  age_Protocol

7

• traceroute (tracert on windows)
• traceroute is a computer network tool used to
  determine the route taken by packets across an IP
  network.
• sends UDP packages, listens to ICMP answers
• uses TTL field in IP
• first send packets with TTL 1, then TTL 2, TTL 3,
  etc
• One of the two ICMP messages that Traceroute
  receives is the message port unreachable. The
  second one is the message time exceeded (TTL is
  0).
• http//en.wikipedia.org/wiki/Traceroute

8

• windows netsh -c diag
• http//technet.microsoft.com/en-us/library/bb49093
  9.aspx
• help
• show
• ...

9

• arp
• windows http//www.windowsreference.com/windows-x
  p/how-to-clear-arp-cache-in-windows-vistaxp2003200
  0/
• arp -a
• Interface 220.0.0.80
•    Internet Address Physical Address Type   
  220.0.0.160 00-50-04-62-F7-23 static The Physical
  Address or MAC address as shown above in the
  format aa-bb-cc-dd-ee-ff is the unique
  manufacturer identification number. This number
  should always be a unique address.
• An example of how to change the above IP address
  220.0.0.160 to 220.0.0.161 in this case would
  be 
• arp -s 220.0.0.161 00-50-04-62-F7-23 

10

• GetArpTable
• ...
• ethereal (wireshark)
• http//www.ethereal.com/
• http//www.wireshark.com/
• dsniff
• http//www.monkey.org/7Edugsong/dsniff/
• later netfilter stuff
• www.netfilter.org