W3-1/3 Wireshark(7/9)


   On Monday I was told to explore Wireshark and just mess around with it to get a basic feel of the program. Wireshark sees a lot of use throughout the computer science industry. It’s a free open source cross-platform packet analyzer that is good at trouble shooting and actively monitoring network traffic; it’s basically tcpdump with a GUI and some extra bells & whistles. Due to it being free and easily accessible it is a tempting tool for any user who needs to analyze packets.  Thus, experience with Wireshark can be quite useful on a resume and a good skill for anyone doing network analysis. Wireshark is great to use for incidence response and firewall testing. My previous post on application identification in network traffic can easily be applied to Wireshark.

     First a user could check using a display filter command (tcp.port == 20 or tcp.port==21 or tcp.port == 23) for any traffic among those forbidden ports I mentioned previously 20, 21, &23/tcp (FTP data, FTP, and Telnet). Notice that display filters and capture filters are written differently and work differently. Capture filters are not a dynamic feature and it must be set before the investigation begins, as it will capture all incoming traffic to wherever it has been commanded to. Whereas display filters are few just for viewing dynamically and only affects what is displayed to the user. I think the thing I find most convenient about the filter feature is that reserved ports usually have aliases (e.g. tcp.port== 80 vs HTTP). This makes it easier to search filter critical servers like SMTP, DNS, HTTP, etc. For example if you assumed there was a DDoS attack you could check for external recursive queries via “udp port 53 and (udp[10] & 1 == 1) and src net not X and src net not Y” (X and Y are variables for specifying network addresses) or if you were check for DNS amplification attacks you could check for large packets with something like “smtp.ip.len <= 4000” (just a big number as an example). (udp[10] & 1 == 1) meaning if udp index 10 address 1 is equal to 1.  Since Wireshark is effectively tcpdump it can also be used for banner grabbing of course. An analyst could easily check for brute force attacks by looking for spamming of requests. An analyst could also check any of the dark IPs on his network to make sure no traffic is going through there.

    For the most part I just played around with the display filter and checked the critical and obsolete ports. I also looked through all the detail options when looking through a packet (e.g. making data displayed as raw or hex). I also tried to familiarize myself with color code and the general tabs and buttons. I looked through a few tutorials as well just to get a better idea of the software.

   I find Wireshark to be an easy software to use that can really help someone become more familiar with network traffic in general. Its Argus-like versatility makes it a great addition to any computer scientist’s tool box.  I’m going to try to get some additional practice with Wireshark. I really want to familiarize myself with its application. I think it could be an invaluable skill to me in the future. I think I will also try to familiarize myself with the programming language it uses in its filters (Lua).


Comments

Post a Comment

Popular posts from this blog

W7-2/3 On Being Prepared & Further Recommendations (8/11)

   One can never be fully prepared. There is always more that a person can do to prepare themselves. I wish that before starting this internship that I would have had a better understanding of the basic concepts of cyber security (e.g. passive and active defense, vulnerability factors, etc.). I also wish that I had prior experience with all the tools and software I used. If you can find out the tools used at an internship, then it’s a good idea to try and learn some of those tools. Your internship will require less training and more application which will make the experience more productive for you. If you cannot find out what tools your internship will use, then it isn’t a bad idea to browse freeware related to that field (e.g. Maltego and Zed Attack Proxy for digital forensics and pen testing respectively). Most places are trying to save money, so they probably use freeware to some capacity. The most popular freeware is your best bet and even if they don’t use it, the...
Read more

W2-2/3 Network Mapping (7/5)

On Thursday we covered network mapping. The process of network mapping usually consists of four phases: identify the space of IP addresses you are monitoring and partition the space into different categories (1). Examine the IP space (2), identify blind and confusing traffic (3), and identify clients and servers (4).    During phase one the mapping of the inventory is undetermined and remains to be IP space. A security inventory should monitor every resource's address (that it is able to) on the network (i.e. anything within or on the network an attacker can access), what resources a service is running on, at the very minimum. During phase two cyber security personal should also consider enumerating roles to make searching easier; identifying VPNs, NATs, DHCP, and proxies; keep centrality or volume metrics (e.g. monthly ephemeral summaries); per-host white lists; and monitoring the versions of all services on a particular resource. Ask what addresses make up the network?...
Read more

W1-2/3 Prioritization (6/27)

   On Wednesday we covered prioritization. What is the most important thing to respond to first? How do we determine what is and what isn't more important? How do we assess the risk being taken? How much risk is too much risk? While some matters may be more general, a lot of prioritization will be based upon what the establishment is doing, who would target them, what resources does the establishment have for defense, etc. The effectiveness of cyber response teams is determined by how appropriate the prioritization of incidents is. Randomly responding and less formalized response protocols/orders (e.g. stacks/LIFO or queues/FIFO) will hinder the potential security capabilities of an establishment. One cannot prioritize for random or abstract orders and expect any type of long-term success. It is best to make decision making and risk taking as formalized as possible. What you do is just as important as what you do first. Basically, some things are more important to attend to ri...
Read more