The moment your Linux PC powers on, it begins a silent conversation on your local network under your nose.Background system processes are checking in with servers, applications are on the hunt for new updates, and other devices on the network are signaling that they are up.Want to know what this conversation is about? Just use the following tools to know what’s under the hood.
Don’t get intimidated, as these raw data packets are constantly flying over the network.However, make sure you run these commands on your own PC (or network), or on any system you’re authorized to access.Everyone should know about these tools not because they have to monitor their networks all the time, but some days you just wanna check which smart devices are up on your network.
Or, if you feel something is suspicious, you can check which ports are open or what data packets are moving over your network.You don’t need to remember them all, but it can be helpful if you need them.Related How to See All Devices on Your Network With nmap on Linux It isn't as intuitive as a user interface, but it is more powerful.
Posts 2 By Dave McKay Nmap Let's find out what's connected to your network Close Nmap, also known as Network Mapper, is a popular open-source utility that discovers all the available devices (hosts) and open ports on your local network.It comes pre-installed on many security-focused Linux distributions like Parrot OS.If it isn’t installed, you can install it using this command: sudo apt install nmap Once installed, you can check your Linux system’s IP address and run the nmap command: hostname -I nmap <your IP Address> Eventually, this will check your PC for 1000 common TCP ports and return all the open ports.
However, if you want to check for all 65,535 ports, you can use the -p- flag: nmap -p- 192.168.1.1 You can also use -p along with a specified port number (or port numbers separated by commas) to check for its details.Beyond your system, you can even check common open ports all over your local network: sudo nmap -F -sV 192.168.0.0/24 Here's the purpose of each flag in the above nmap command: -F: this fast scan flag scans for the most common 100 TCP open ports instead of the default 1000 common ones.-sV: this combination gives you the service running on each open port along with its version number.
Apart from scanning for open ports, we can also discover available devices on the network (or a range of IP addresses): nmap -sn 192.168.0.0/24 By running the above command, you can find details such as active hosts, their IP addresses, and, where available, MAC addresses and device information.ss See what connections your Linux PC has opened Close You can use the ss (Socket Statistics) tool to list active network connection details and listening sockets on your system.It’s a built-in Linux utility to find out what services are listening for connections and what remote systems are connected to your system.
This way, you can spot suspicious background applications and network connections to investigate potential threats to your network.You can monitor all the active TCP and UDP connections without resolving hostnames or service names: ss -tun You can use this command to display all the listening TCP and UDP sockets, along with the process using each socket: ss -tulnp Additionally, you can check all the established TCP connections: ss -tn state established The ss command is believed to be a modern replacement for the netstat command, though many people still use netstat out of habit.Don’t come for me if I tell you I’m one of them occasionally.
Wireshark Peek inside your Linux PC's network traffic in real time Close We all know capturing live network traffic requires root privileges.However, running a massive GUI like Wireshark as root can be a major security risk.Wireshark uses dumpcap as its dedicated packet capture engine because it minimizes security risks by isolating elevated privileges using a capabilities-based approach.
Instead of running the entire GUI as root, the heavy lifting is handed over to this tiny utility.Linux grants dumpcap specific raw network privileges (CAP_NET_RAW and CAP_NET_ADMIN) while restricting its execution to a specific wireshark system group.Wireshark’s official documentation heavily prefers this secure approach over old methods like using setuid bits.
You can install Wireshark on your Linux system using its package manager.Most of the distribution's Wireshark packages already configure dumpcap and the wireshark group, you will only need to add your user to that group: sudo apt install wireshark -y sudo usermod -aG wireshark <username> Because Linux evaluates group memberships at login, these permissions won't take effect immediately.You aren't required to reboot your entire system.
Simply log out of your Linux desktop environment and log back in.Alternatively, you can run the newgrp wireshark command to force the group change to apply to your current terminal session instantly.Finally, you can now head to your applications and open Wireshark.
Make sure you don’t install Wireshark from sandboxed formats like Snap packages.Because Snaps run in strict isolation for security reasons, they struggle to interact correctly with native system groups or system binary paths like /usr/bin/dumpcap, which will block you from capturing traffic.In Wireshark, you can capture, filter, and analyze packets.
To do so, click on the Start Capturing Packets button in the toolbar (represented as a shark-fin icon).This will automatically capture all traffic visible to the selected network interface (or default).Once packets start capturing in real time, you can use display filters such as dns, http, and tls to narrow down your search.
You can also filter traffic by IP address using: ip.addr == 192.168.0.5 Try browsing HTTP sites and analyzing their data packets from Wireshark; if you type a username and password on such sites, you may be able to see them as plain text in captured packets.However, you won’t be able to inspect the contents of HTTPS traffic as plain text because it’s encrypted.However, you can still use Wireshark to monitor its metadata, such as the IP addresses, TLS handshake, and connection details.
tcpdump Capture network traffic straight from the terminal Close Let’s discuss a popular command-line tool, tcpdump, which uses the same libpcap library as Wireshark to capture packets from the network interfaces.You can use it if you prefer a lightweight CLI tool instead of a GUI, or if you’re working in a situation where a CLI is the only option, such as on a server.You can simply use tcpdump command on your system, as it comes pre-installed in many distributions.
If it's not, you can install it by running the following command: sudo apt install tcpdump sudo tcpdump This will start capturing packets from the default network interface; you can stop the capture by pressing Ctrl + C keys.Of course, you can specify any network interface using the -i flag: sudo tcpdump -i <any network interface> You can check available network interfaces by running the ip link command.You should only use these commands on your own system (or network) or on systems you’re authorized to access.
You can’t just run these commands against any system or network, as doing so could be considered unauthorized access and may get you into trouble.You probably don't need all four The good news is that you don’t have to use or learn all of them at once.You just need to know when to use what.
Basically, you need Nmap when you’re curious about devices connected to your network, and ss when you want a quick look at the background apps and services running on your Linux system.Though you can use both tcpdump and Wireshark for detailed packet analysis, your preference for a GUI or CLI can help you decide which one to use.
Read More
