Original subtitles

All right.

So now we're moving into layer four which is the transport layer of the OS side model and we're going

to talk about what is TGP and what is UDP.

So what type that in here DCP vs. UDP so DCP is what is known as the Transmission Control Protocol.

And you could think of that as a connection oriented protocol.

And we also have UDP which is the user data Graham protocol.

And this is a connection less protocol.

So when we have these two protocols one is best suited when it comes to high reliability.

That's TCB DCP is connection oriented.

We want to make a connection win high reliability so you can get something like a Web site which is

HDP or HDP s or you can think of something like SS age or f T.P. the file transfer protocol.

Those all utilize TTP when you think about UDP you might think about something like a streaming service

that's connection lists or DNS connections or voice over IP is connection lists.

And when this comes into the importance of scanning scanning is super important we're going to be scanning

both DCP and UDP as a penetration tester.

And don't worry about scanning right now when we get into the scanning section that will make a lot

more sense.

But we need to know what DCP and TPR and define them broadly.

So the most commonly commonly used protocol that you're going to be scanning is going to be C P.

Now TTP works on what is called a three way handshake.

Now if we look at the three way handshake it's going to look something like this.

We're going to first send out a sin packet and then we're going to receive back a sin ACH packet.

And finally we're going to send an act packet.

Now how does this work.

Now you could think of this as an interaction.

So let's say you have a friend or a neighbor and you go to your neighbor and you say hello.

That's a sin.

Now sin act is going to be the response it's going to say hey sin I acknowledge you that's your neighbor

waving hello back.

And then you know you are good to go start a conversation so that's the acknowledgment.

Now when we think about this in terms of ports now port is a item that could be open on a machine.

It's a way to communicate with certain protocols.

For example if you think about HDP that's over port 80 if you think about HP s that's over port for

4 3 there's a lot of different protocols and there are sixty five thousand plus ports that can utilize

these protocols.

So everything related here is has to do with these ports.

Now let's say that you want to connect to port for four for three on a Web site you're going to send

out a send packet to that Web site you're going to say hey I want to connect to you on port four for

three and if for four or three is open and available for connection they're going to say hey you can

go ahead and connect to me.

And when you want to actually establish that connection you're going to send that acknowledgement packet

back.

Now let's make more sense of this.

Let's go ahead and open up a tool called wire charger.

So this is built into Cally Linux.

I'm just going to type in wires shark and provide an ampersand here just so I have Shell access if I

need it in the background and all I'm going to do is capture packet data.

So this is going to be listening in on my neck and it's going to say Hey what's he doing.

Let's capture all that data.

So we're going to capture that.

I'm going to start a capture here.

You're gonna start to see a bunch of traffic coming through.

You can see the different protocols here.

You could see UDP is coming through right now.

But we're gonna go establish a connection.

So let's go out to the World Wide Web.

And I've got Google up I'm just going to refresh Google.

You can see a lot of traffic start coming through.

So I'm going to go ahead just stop this right here.

Look at all the data packets that get sent when you're using your computer.

This is what's going on in the background.

You don't even think about it.

So we could see some sense and acts there those are in the gray.

Let's see if we can find a good one.

OK so here is one right here.

So what we're gonna do actually let's find a better one.

So we're going to come down to here and we're going to say OK so here we are we're our source IP is

1 9 2 1 6 8 4 7 3 9.

We're going out to destination is seventy four one twenty five twenty one one fifty five.

We're saying hey I've got this port here I want to connect to your port so important for 4.

This is a web page.

We're sending a send packet if that port is open and available for connection and communication what's

going to happen back is that IP address is going to say hey here I am.

All of you to connect on this port.

And if we make that final connection we're gonna go ahead and send the Act packet back which is right

here.

It's going to say Ach so that is the three way handshake please do you remember this is going to come

back into play when we get into scanning and we'll talk about stealth scanning and how we modify the

three way handshake to actually do some scanning.

So that is it for this lesson.

I will catch you over in the next one.