Cheatsheet

Display routing table

  • ip r[oute]

    or

  • route -n

    or

  • routel

HTTP/2 support check

  • curl -I --http2 <URL>

    If the site does support HTTP/2, you will see HTTP/2 200 in the header instead of HTTP/1.1 200.

Cheatsheet - Windows

Packet Monitor (pktmon)

pktmon is a modern built-in packet capture tool, and it doesn't need any installation or setup, and therefore is the latest and preferred packet capture tool in Windows.

pktmon - Show current status

pktmon status

pktmon - List all filters

pktmon filter list

pktmon - Add a filter for TCP

  • If we have multiple rules, the individual filter lines will be treated as OR statements.
  • For the individual components to be treated as AND statements, they need to be entered on the same filter line.
pktmon filter add $filter_name -t $protocol -p $port

pktmon - Lists all active networking components that can be monitored

pktmon list -a

pktmon - Start packet capture

pktmon start -c -f $etl_file

pktmon - Convert ETL to PCAPNG

pktmon etl2pcap $ETL_FILE -o $PCAPNG_FILE

TCP/IP (opens in a new tab)

Application Layer

HTTP

HTTP - CONNECT

Internet Layer

IP

Get public IP address
  • curl ifconfig.co
Subnet
Routing

Transport Layer

TCP

TCP - PROXY
TCP - Cheatsheet
TCP - Cheatsheet - Send a raw TCP packet
TCP - Cheatsheet - Packet capture on Windows

pktmon is a modern built-in packet capture tool and should be preferred.

  1. Start capture

    • Option 1: Using Network shell (netsh)

      netsh trace start capture=yes tracefile=C:\Temp\NetTraces\capture.etl persistent=yes maxsize=4096

    • Option 2: Using Packet Monitor (pktmon)

      pktmon filter add $filter_name -t $protocol -p $port
      pktmon start -c -f $ETL_FILE

  2. Stop capture

    • Option 1: Using Network shell (netsh)

      netsh trace stop

    • Option 2: Using Packet Monitor (pktmon)

      pktmon stop

  3. Convert ETL to PCAPNG

    • Option 1: Use etl2pcapng

      Install etl2pcapng from GitHub - microsoft/etl2pcapng (opens in a new tab)

      scoop install main/etl2pcapng
      etl2pcapng $ETL_FILE $PCAPNG_FILE

    • Option 2: Use pktmon to convert ETL to PCAPNG

      pktmon etl2pcap PktMon.etl -o PktMon.pcapng

  4. Open PCAPNG in Wireshark

TCP - Implementation

Network troubleshooting

  • There are many tools available but focus on the following ones:

    • traceroute: works with TCP and UDP too

    • lsof

    • ss

    • ncat: modern Netcat replacement

  • Connection refused

    • Connection refused means that the port you are trying to connect to is not actually open.

    • Connection refused is usually due to one of the following reasons:

      • The port is not open on the destination host.

      • A firewall is blocking the connection on the host or an intermediate network device.

      • The port is not open on the source host.

      • The source host's firewall is blocking the connection.

Applications

Chromium-based browsers

chrome://net-internals

Networks tools

chrome://net-export

Capture net logs

Firefox

Cheatsheet - Firefox

Honour system host file (/etc/hosts)
about:config
 
# Set to false
network.dns.offline-local = false

Linux

iptables

  • Debian-based distributions such as Ubuntu can use a front-end program called Uncomplicated FireWall (ufw) for managing the iptables/Netfilter firewall stack. As its name implies, ufw is designed to make managing iptables rules easy (that is, uncomplicated).

Verifying the iptables Kernel Module is loaded

lsmod | grep ip_tables

Windows

Check Open TCP/IP Ports in Windows

Exclude a port occupied by Hyper-V

dism.exe /Online /Disable-Feature:Microsoft-Hyper-V
 
# Enable the target port
netsh int ipv4 add excludedportrange protocol=tcp startport=<PORT> numberofports=1
 
dism.exe /Online /Enable-Feature:Microsoft-Hyper-V /All

Check System Proxy Settings

  • netsh winhttp show proxy (Does not work for PAC script)
  • In Google Chrome: chrome://net-internals/#proxy
  • In the case of PAC (opens in a new tab), download the script via the link specified in system proxy config, and find the proxy address and port in the script code. The script is written in JavaScript.

WSL - Networking with host

Library

Socket abstraction, broker-less

IPC

UNIX Domain Socket

Performance

DPDK

Wireshark

Wireshark - Display Filter Reference

Wireshark - Install on Fedora

Quantum Computing