TCP For Hackers: The Basics! (with @ChrisGreer!)

### Overview In this session, host Ben invites packet analysis expert Chris Greer to break down the fundamentals of Wireshark, examine packet capture (pcap) data, and understand how TCP network traffic reveals security-relevant activities. Building on a previous discussion about how Nmap functions, the episode focuses on viewing network traffic from both defensive and offensive security perspectives, highlighting why both red and blue teamers need to understand what tools transmit onto the wire.

### Key Topics - **Wireshark User Interface and Architecture**: Wireshark is an open-source, widely adopted packet analysis tool available at wireshark.org. It features a three-pane layout: a top summary pane listing packets line by line, a bottom-left pane detailing decoded protocol fields, and a bottom-right pane presenting raw packet data in hexadecimal and ASCII. - **Profiles and Display Filters**: Wireshark supports custom profiles to tune columns and visibility depending on the task (such as troubleshooting versus cybersecurity analysis). It also provides a display filter bar and quick-access filter buttons to isolate protocols such as TCP, UDP, specific IP addresses, or combinations of criteria. - **Nmap Port Scan Signatures**: Network reconnaissance leaves specific protocol artifacts. A stealth SYN scan generates distinctive TCP parameters that differ from normal TCP traffic patterns.

### Technical Details Chris analyzes a captured stealth SYN scan targeting services like FTP and port 8080 to demonstrate how Nmap fingerprints itself on the wire: - **Conflicting TCP Window and MSS Values**: In a default Nmap SYN packet, the TCP receive window size is advertised as 1024 bytes. Simultaneously, Nmap provides a TCP Maximum Segment Size (MSS) option of 1460 bytes. Telling the destination host that the maximum segment per packet is 1460 bytes while declaring a total receive buffer limit of only 1024 bytes is contradictory behavior rarely seen in standard real-world TCP stacks, serving as an immediate signature of an Nmap scan. - **Wireshark Filter Construction**: Chris shows how to drag and drop packet fields directly into the filter bar to build detection queries. He constructs a filter combining the specific window size and the SYN flag: `tcp.window_size_value == 1024 and tcp.flags.syn == 1`. He explains that running this filter across large traffic volumes (such as terabytes of traffic) identifies default Nmap SYN scans with near certainty.

### Takeaways - **Offensive Awareness**: Red teamers and penetration testers must know what their scanning tools transmit on the wire. Relying on default scan settings without customization creates obvious signatures that trigger alerts or get IPs blocked. - **Defensive and Internal Detection**: Blue teamers and analysts can use targeted TCP filters to catch unauthorized port scanning and lateral movement within an internal network—such as identifying a compromised internal device or printer scanning adjacent network hosts behind IDS/IPS defenses. - **Future Focus**: Deep dives into custom filter creation and the top 10 recommended Wireshark filters are planned for the subsequent episode.