Network Network sniffing sniffing packet capture and - - PDF document
Network Network sniffing sniffing packet capture and analysis packet capture and analysis October 2, 2020 Administrative submittal instructions submittal instructions Administrative answer the lab
1
October 2, 2020
answer the lab assignment’s questions in written report
deadline is start of your lab session the following week reports not accepted (zero for lab) if late submit via D2L
2
re-download the script files' zip to obtain the new vmconfigure scripts for this "sniffing" exercise
3
A tool that captures, interprets, and stores
also known as
is intimately “network-y”
conventional wisdom
reality
but don’t forget, however
4
purely local dimensions
– physical security – BIOS/bootloader security – boot process security (TPM, MS Secure Boot) – filesystem permissions – execution jails – encrypted filesystems – application vulnerabilities – etc
network aspects
– packet sniffing – remote backup and logging – port scanning – tunnels
principal author Gerald Combs
– his 2019 product background Sharkfest keynote: https://sharkfestus.wireshark.org/sf19
equivalent linux, Windows, Apple versions
5
pcap – the underlying library – pcap captures the packets – Wireshark displays them (graphically) tcpdump – rides on pcap like Wireshark – displays what pcap captures (character mode) – very widespread
– tshark, character mode version in Wireshark’s stable – Network Monitor - Microsoft – snoop - Sun Microsystems – ettercap – snort
6
a “general purpose” client and server there’s more than one (hobbit’s, GNU’s)
cryptcat
for you to generate something to send a server
a client program
network application
application logic half
matching server program
network application
network
half
7
network network
the network mechanism that clients and servers use, stand-alone and generic
(non-
network) applications
network local stdin an application
network local stdout a matching application
8
creates an encrypted network conversation for you to compare with an unencrypted one
by capturing both
are what Wireshark is for capturing a.k.a. packets, datagrams, segments, protocol
they come in nested groups
9
Packets
10
Wireshark knows the structures for ~3000 protocols turns byte dump into intelligible decode,
in the details pane
11
packet list pane packet details pane packet bytes pane
packet 6’s details packet 6’s bytes
network transport data link application physical
highest-layer protocol that each packet contains
12
probe takes measurement “where it is” sees whatever is at the interface (e.g, NIC) sees nothing else does not see “what’s on the network” limits value on host connected to a switch
13
wire shark
involuntary: can’t capture what doesn’t appear
voluntary: packet filter expressions
14
host 200.2.2.1 src host 200.2.2.2 dst host 200.2.2.2 ‘ip[16]>=224’ ‘ip[2:2]>512’ ‘ether[0]&1=1’
ip tcp udp icmp
15
and
not
capture filters (during capture)
display filters (after the fact)
like this one”)
16
enter capture filter here before capturing enter display filter here while displaying
with key with key without key without key
… …but where do we get the key? but where do we get the key?
17
make sure NIC is in promiscuous mode
– not your choice if you’re not net admin use a switch with a management/spanning
capture there, analyze here sniff by remote command-line access on computers elsewhere in the network with e.g. tcpdump or tshark, save the capture to a file, transfer it to local Wireshark for analysis
http://www.wireshark.org/ http://wiki.wireshark.org/ “Packet Sniffing In a Switched Environment”
https://www.sans.org/reading-room/whitepapers/networkdevs/packet- sniffing-switched-environment-244
“SSL/TLS: What's Under the Hood”
https://www.sans.org/reading- room/whitepapers/authentication/paper/34297