209.85.203.113.80 > 10.0.0.179.40364: Flags means remote IP address is responding on the same ports, and the SYN and ACK flags are set.

As soon as you press enter, the other screen should explode with information.Įxperienced engineers will be able to tell a lot from this output. While the tcpdump command is running in one session, run curl -I in the other. For more expression options, see the PCAP filter manpage. In this case, only traffic to and from port 80.įor more tcpdump options, see the Tcpdump manpage.

port 80 is the expression that tells tcpdump what to capture.

-nn will make sure the output displays hostnames as numeric IP addresses (the first n) and the ports as port numbers (the second n).

sudo means run as root, which is required to capture packets.

Let’s unpack what we’re telling Tcpdump to do: In one of the sessions, execute sudo tcpdump -nn port 80. When done, open two SSH sessions in separate terminal windows. Make sure the instance has a public IP address, that the security group allows SSH from your IP, and select a valid key pair. Getting startedĭeploy an EC2 instance running Amazon Linux 2, connected directly to an Internet Gateway. Additionally, we will dive into the workings of network protocol encapsulation, one of the core principles of networking.

The goal of this exercise is to get you familliar with Tcpdump and Wireshark, which are essential tools in network engineering. Then we will download the file and analyze it with Wireshark. On the instance, we will run Tcpdump to capture some network traffic and store it in a PCAP (packet capture) file.

It will be directly connected to an Internet Gateway. In this exercise we will set up a simple EC2 instance with Amazon Linux. The exercises are built on the assumption that you’re already familiar with the AWS basics and have achieved at least one associate level AWS certification. For an explanation and overview of all exercises, see the overview post. This is exercise 2.2 for the AWS Advanced Networking Specialty training. In this exercise we will capture network traffic with Tcpdump, analyze it with Wireshark and discuss encapsulation in network protocols.

Brandenburger tor demo heute