Netstat allows you to view information related to established connections or applications that are waiting for network connections on a given host. Netstat is a tool that is included on many host systems, including most versions of Windows and UNIX. Use nbtstat with no command-line options to get syntax and options help. The nbtstat command allows you to associate machine and user names with an IP address. In Firewall Policies and VPN Configurations, 2006 Windows Specific Tools When receiving data, the layers receive the data from the layer below, unpack the data, and then pass it up one level. During communication, the layers receive data formatted by the layers above, manipulate the data, and then send it down to the layer below. Each layer is responsible for a particular part of the communication process. Each layer consists of a number of components, separated into seven layers. The most powerful part of the OSI model is the “layering” concept.

Unfortunately, the network industry didn't fully comply with the OSI model, and the TCP/IP protocol suite was no exception. By strictly adhering to the OSI model, different network vendors could write code that would interoperate with other competing network vendors. The Open Systems Interconnection (OSI) model was originally designed to be a standard for developing network communication protocol suites. It's important, as we will be referencing them both throughout this chapter. For now, let's take quick refresher on the OSI model and the TCP/IP protocol suite. We discuss promiscuous mode and the libpcap library later in the “Packet Sniffing” section.

Then grabbing the packets from the network card using the libpcap library. Setting the network card into promiscuous mode. Snort needs a way to capture network traffic, and does so through two mechanisms: ▪

Use wireshark to sniff wifi traffic