Book Image

Hands-On Network Forensics

By : Nipun Jaswal

2 (2)

Book Image

Hands-On Network Forensics

2 (2)

By: Nipun Jaswal

Overview of this book

Network forensics is a subset of digital forensics that deals with network attacks and their investigation. In the era of network attacks and malware threat, it’s now more important than ever to have skills to investigate network attacks and vulnerabilities. Hands-On Network Forensics starts with the core concepts within network forensics, including coding, networking, forensics tools, and methodologies for forensic investigations. You’ll then explore the tools used for network forensics, followed by understanding how to apply those tools to a PCAP file and write the accompanying report. In addition to this, you will understand how statistical flow analysis, network enumeration, tunneling and encryption, and malware detection can be used to investigate your network. Towards the end of this book, you will discover how network correlation works and how to bring all the information from different types of network devices together. By the end of this book, you will have gained hands-on experience of performing forensics analysis tasks.

Preface

Who this book is for

What this book covers

To get the most out of this book

Free Chapter

Section 1: Obtaining the Evidence

Section 1: Obtaining the Evidence

Introducing Network Forensics

Introducing Network Forensics

Technical requirements

Network forensics investigation methodology

Source of network evidence

Wireshark essentials

Exercise 1 – a noob's keylogger

Exercise 2 – two too many

Questions and exercises

Further reading

Technical Concepts and Acquiring Evidence

Technical Concepts and Acquiring Evidence

Technical requirements

The inter-networking refresher

Log-based evidence

Case study – hack attempts

Questions and exercises

Further reading

Section 2: The Key Concepts

Section 2: The Key Concepts

Deep Packet Inspection

Deep Packet Inspection

Technical requirements

Protocol encapsulation

Analyzing packets on TCP

Analyzing packets on UDP

Analyzing packets on ICMP

Case study – ICMP Flood or something else

Questions and exercises

Further reading

Statistical Flow Analysis

Statistical Flow Analysis

Technical requirements

The flow record and flow-record processing systems (FRPS)

Sensor deployment types

Analyzing the flow

Further reading

Combatting Tunneling and Encryption

Combatting Tunneling and Encryption

Technical requirements

Decrypting TLS using browsers

Decoding a malicious DNS tunnel

Decrypting 802.11 packets

Decoding keyboard captures

Questions and exercises

Further reading

Section 3: Conducting Network Forensics

Section 3: Conducting Network Forensics

Investigating Good, Known, and Ugly Malware

Investigating Good, Known, and Ugly Malware

Technical requirements

Dissecting malware on the network

Intercepting malware for fun and profit

Behavior patterns and analysis

A real-world case study – investigating a banking Trojan on the network

Questions and exercises

Further reading

Investigating C2 Servers

Investigating C2 Servers

Technical requirements

Decoding the Metasploit shell

Case study – decrypting the Metasploit Reverse HTTPS Shellcode

Analyzing Empire C2

Case study – CERT.SE's major fraud and hacking criminal case, B 8322-16

Questions and exercises

Further reading

Investigating and Analyzing Logs

Investigating and Analyzing Logs

Technical requirements

Network intrusions and footprints

A case study – defaced servers

Questions and exercises

Further reading

WLAN Forensics

Technical requirements

The 802.11 standard

Packet types and subtypes

Locating wireless devices

Identifying rogue access points

Identifying attacks

Case study – identifying the attacker

Further reading

Automated Evidence Aggregation and Analysis

Automated Evidence Aggregation and Analysis

Technical requirements

Automation using Python and Scapy

Automation through pyshark – Python's tshark

Merging and splitting PCAP data

Large-scale data capturing, collection, and indexing

Questions and exercises

Further reading

Other Books You May Enjoy

Other Books You May Enjoy

Leave a review - let other readers know what you think

Assessments

Chapter 1: Introducing Network Forensics

Chapter 6: Investigating Good, Known, and Ugly Malware

Chapter 7: Investigating C2 Servers

Chapter 9: WLAN Forensics

Customer Reviews

2 (2)

5 star

0

4 star

0

3 star

50%

2 star

0

1 star

50%

Analyzing packets on ICMP

Let's take a look at the Internet Control Message Protocol (ICMP). It is one of the most popular protocols, and is better known for being used in ping commands, which is where an ICMP echo request is sent to an IP address with some random data, and it then denotes whether the system is alive. A typical ICMP packet would look like this:

The ICMP has many messages, which are identified by the Type of Message field. The Code field indicates the type of message. The Identifier and Sequence Number can be used by the client to match the reply with the request that caused the reply.

The Data field may contain a random string or a timestamp to compute the round-trip time in a stateless manner. Let's ping https://www.google.com/ and analyze it in Wireshark:

We can see that we have four Echo request and four Echo reply packets. Let...