Скачать или смотреть Project 18 - Detecting Port Scans w/ Wireshark

Commands used (in the order they appear in the video):

1. On Windows machine click on Wireshark desktop icon and select Ethernet 0

2. Make sure traffic is being captured and switch to Kali machine (to begin generating necessary traffic)

3. Open terminal and run ifconfig to see our IP address (in eth0)

4. Then nmap 172.16.0.15 (to perform nmap scan against Windows machine)

5. Switch back to Windows Server Machine and notice the traffic

6. Use filter tcp.port == 135 (to see only RPC related traffic)

7. Remote Procedure Protocol (RPC) - helps other devices discover services on a network and their assigned ports

8. Use filter ip.addr == 172.16.0.5 && ip.addr == 172.16.0.15 (to enumerate communication between the IPs)

9. Notice Kali starts the TCP handshake