Iptraf-ng stands out as an excellent alternative to Wireshark and tcpdump, offering a robust set of features for comprehensive network traffic analysis. This versatile tool gathers a wide range of information, including TCP connection details, interface statistics, and TCP/UDP traffic breakdowns.
Its key features make it a compelling choice:
IP Traffic Monitoring:
Provides real-time insights into IP traffic across your network.
Detailed Interface Statistics:
Displays comprehensive statistics on IP, TCP, UDP, ICMP, non-IP packets, and more.
TCP and UDP Service Monitoring:
Monitors incoming and outgoing packets for commonly used TCP and UDP application ports.
LAN Statistics Module:
Identifies active hosts on the LAN, offering data activity statistics.
Protocol Display Filters:
Enables users to customize displays for specific protocols like TCP, UDP, and others.
Logging Capabilities:
Allows for the logging of network activity, facilitating detailed analysis.
As a user-friendly and efficient network monitoring tool, iptraf-ng presents itself as a valuable alternative to Wireshark and tcpdump. Its capabilities make it particularly well-suited for those seeking a reliable solution for network analysis and troubleshooting. The example screenshot of the IP traffic monitor underscores its user-friendly interface and robust functionality, positioning iptraf-ng as a commendable choice in the realm of network monitoring tools.
OpenSSH is a free and open-source software that allows secure communication between computers over an unsecured network. It is widely used on Linux and Unix systems, but it is also available for Windows systems. In this article, we will show you how to install and configure OpenSSH on a Windows 2022 server.
Step 1: Install OpenSSH
The first step is to install OpenSSH on your Windows server. To do this, follow these steps:
# Install the OpenSSH Server
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
# Start the sshd service
Start-Service sshd
# OPTIONAL but recommended:
Set-Service -Name sshd -StartupType 'Automatic'
# Confirm the Firewall rule is configured. It should be created automatically by setup. Run the following to verify
if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue | Select-Object Name, Enabled)) {
Write-Output "Firewall Rule 'OpenSSH-Server-In-TCP' does not exist, creating it..."
New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
} else {
Write-Output "Firewall rule 'OpenSSH-Server-In-TCP' has been created and exists."
}
Step 2: Configure OpenSSH
Once OpenSSH is installed on your server, you need to configure it to allow secure communication. Follow these steps to configure OpenSSH:
Open notepad
Open the configuration file C:\ProgramData\ssh\sshd_config
Remove the “#” at the beginning of the line #PubkeyAuthentication yes to uncomment it:PubkeyAuthentication yes
Locate the line that starts with #PasswordAuthentication yes and remove the “#” at the beginning of the line to uncomment it and change it to NO: PasswordAuthentication no
Add the “#” at the beginning of the line AuthorizedKeysFile PROGRAMDATA/ssh/administrators_authorized_keys to comment it out:#AuthorizedKeysFile PROGRAMDATA/ssh/administrators_authorized_keys
Save the changes and close the configuration file.
Restart the service
# Restart the sshd service
Restart-Service sshd
Step 3: Configure the Administrator for key-based authentication
After the configuration is complete, you need to configure the public key.
Optional: If you don’t have a public/private keypair use this command to create the files on your client:
ssh-keygen -t rsa -b 4096
Open the Explorer and go to C:\Users\<Username>\
Create a folder .ssh
Create a text file (without extension!) authorized_keys
Open the file in notepad
Paste your ssh-rsa public key in this authorized_keys file (this is the content of id_rsa.pub)
Save the file
Remove the inheritance so that only the user and system has full permission
Step 4: Test OpenSSH
To test if OpenSSH is installed and configured correctly, follow these steps:
Open a Command Prompt window.
Type “ssh username@<server>” and press Enter.
If the connection is successful, you should see a welcome message.
Congratulations! You have successfully installed and configured OpenSSH on your Windows 2022 server and configure it securely with key-based authentication.
Optional: change CMD to Powershell
If you want to connect directly in PowerShell instead of the default command use this PowerShell command
Are you in a situation where you need to capture and analyze network traffic, but don’t have Wireshark or TCPDump at your disposal? Don’t worry, there’s still a solution. Enter pktmon.
While it may not be the most sophisticated tool out there, pktmon is a viable option for monitoring traffic in real-time. With its lightweight and efficient design, you can quickly capture and analyze packets without the need for any additional software installations.
So, how exactly does pktmon work? It uses the Windows Filtering Platform (WFP) to capture network traffic at the packet level. This allows you to examine specific details about each packet, such as its source and destination address, protocol, and payload.
But what makes pktmon really stand out is its ability to filter traffic based on specific criteria. For example, you can use it to only capture traffic from a specific IP address, port, or protocol. This makes it a powerful tool for troubleshooting network issues or identifying potential security threats.
While pktmon may not be the most robust traffic monitoring tool out there, it’s certainly a valuable option to have in your arsenal and its already installed 🙂 So the next time you find yourself in need of capturing and analyzing network traffic, give pktmon a try – you might just be surprised by what it can do.
#start the traffic capture
pktmon start -c
#stop the traffic capture
pktmon stop
#convert the file so you can view it in notepad
pktmon etl2txt <etl file>
I was working for an elementary website of a friend of mine. I pushed the website to GitHub so it’s was way easier to maintain the site.
But I thought it must be easier than transferring all the changes every time by an FTP program. So I found git-ftp and of course FTPS didn’t work out of the box 😉
Windows
What you have to do to enable GIT FTP (on Windows)
First start an ssh sessions from powershell
ssh username@SOMEHOSTNAME
This will add the public key to you known host. Otherwise you will get this error later
And the next time you make a change you only have to do
git ftp push
When you get an errors like these:
zo 19 dec 2021 23:11:50 CET: Retrieving last commit from sftp://******:***@s*******/public/sites/*********/.
* Trying *********:22...
* Connected to ******* (********) port 22 (#0)
* Found host ******** in /home/******/.ssh/known_hosts
* Set "ecdsa-sha2-nistp256" as SSH hostkey type
* Closing connection 0
curl: (79) Error in the SSH layer
zo 19 dec 2021 23:11:50 CET: fatal: Could not get last commit. Use 'git ftp init' for the initial push. Can't access remote 'sftp://******:***@********'. Network down? Wrong URL? exiting..
I had to check my DHCP configuration for a Dell Wyse Thin Client. But when you configure specific options like 161 and 162 you don’t see that options in a Wireshark capture during a Windows DHCP request.
I like Wireshark. But I don’t like to install software on a server for troubleshooting purposes. Especially when you need software like PCAP to sniff some network data.
But what you can do is capture data data with netsh, copy the data to your workstation, convert the data so you can read it with wireshark and do you thing.
Capture the data
Run this command to capture the data (elevated command prompt)
For me, this was a pain in the ass for a long time. When I connect to a Windows server through RDP/RDS it sometimes takes more than 2 minutes to connect to a server. Today after some waiting, and waiting and some more waiting I did a deep dive with Wireshark to figure out why it was so slow.
My setup
Azure domain joined Windows 10 device (Laptop)
Connection over a Cisco Anyconnect VPN
Remote Desktop Manager (Devolutions)
Native RDP client
MremoteNG
Remote VS local
I know for sure the issue should be in my setup. Because when I connect first to a jump host (RDP) and then connect to other domain-joined servers everything was connected almost immediately after I put in my user credentials.
What to do (TL;DR)
There are four things you have to modify to speed up the initial remote desktop connection speed:
Disable SSL / TLS1.0
Disable Netbios on the VPN network adapter
Disable automatic proxy settings in Windows
Change the credential to domain.local\admin or [email protected] instead of domain\admin
Disable SSL / TLS1.0
No, you don’t have to negotiate what protocol you have to use to connect a server. Use TLS1.2 or I don’t want to connect with you 😉 So:
How to
Start > Run > Regedit
Go to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client
If the TLS 1.0 and Client folders doesn’t exists create these keys
Create a 32 DWORD value with the name Enabled
Value data: 0 (Hex)
Restart the client
Enabled = 0
Disable Netbios on the VPN adapter
What I was seeing in my Wireshark capture is that RDP was trying to broadcast to get information over NETBIOS. You have a DNS server so you don’t need a legacy broadcast protocol! Unfortunately, I don’t have any screenshot of the capture but you can always check yourself 😉
How to
Change the VPN Adapter and reboot the computer:
Disable Netbios
Disable the proxy
After connection to a server with RDP and you enter the credentials Windows is trying constantly to WPAD.domain.local to autoconfigure itself. WPAD stands for Web Proxy Auto-Discovery and I think you never want to autoconfigure a MITM ehh proxy device. You always want to have full control of your device. So, disable this to speed up the connection and make your device more secure.
Wireshark Capture WPAD A record
How to
Go to settings
Search for proxy
Switch the Automatically detect settings to Off
Restart Windows
Turn WPAD off
Change the login name
I found out that this is the most annoying and time consuming one. I always use DOMAIN\User when I connect to a server. But this is what happens:
Domain.Domain.TLD
Kerberos is doing a DNS query on _kerberos._tcp.dc._msdcs.domain.domain.tld and of course he will never can find that double domain A record. But if you change the logon name to domain.tld\admin or [email protected] Kerberos will find the A record and connects immediately 🙂
Top speed!
Kerberos
And even now it’s possible to tune the Kerberos authentication further and fix the last KRB5KDC_ERR_PREAUTH_REQUIRED error you can see in the screenshot. Maybe next time but for now I’m happy with the initial connection speed 🙂
It can be fun to reverse engineer some android applications. I think it’s better to do this on your workstation instead of your phone because it’s way more flexible and you don’t ruin your phone when you break things 😉
In my case, I use Debian 11. But of course, you can do this with any OS.
Requirements
An app you want to debug
OWASP ZAP Proxy
Genymotion
NPM
APK Export (Android App)
OWASP ZAP Proxy
I use the snap package for ZAP because it’s easy to install and you’ve always the latest version.
$ sudo snap install zaproxy --classic
Start ZAP and export the dynamic certificate (tools > options)
Dynamic SSL Certificate
Click on the save button an place the file somewhere on your disk.
Follow the wizards, create an genymotion account and create a new virtual device. In my example I used a google Pixel 3 with Android 10.
Overview virtual devices
Now it’s time to configure the proxy within the android device!
Configure proxy in Android
Start the created virtual genymotion android device and copy the certificate file we create earlier with a simple drag and drop.
drag & drop the certificate file
Succesfull copy
Now we can can configure the proxy in the wifi settings.
Go to settings > search for certificate and install the certificate.
settings > find >certificates
Import the certificate
Edit the wifi connection, add the proxy and restart the wifi.
Edit the Wifi
Go to the advance options
Set the proxy to Manual
The IP is always: 10.0.3.2This is the “localhost” setting for the genymotion host server
Port 8080
Genymotion Proxy Settings
When you (re)connect the the wifi you have the accept the proxy error (but this is a good thing).
Sign in the the wifi
Accept the warning
Now you will see all the traffic. But only the traffic for the apps who respect the android HTTP_PROXY settings. So this is what you can do when an app don’t respect this setting:
Rebuild the APK with APK-MITM
Now everything is in place. So the last thing we need to do is rebuild the APK file so we can proxing all the network traffic. So:
Everything is in place now. So the only thing you have to do is drag & drop the *-patched.apk file to genymotion, install this file and you are fully in control 🙂