Cyberstudy
PDF p.322 In progress

Packet Captures

Open PDF at p.322 19 flashcards

Summary

PDF p.322

Network traffic analysis provides valuable insights into potential breaches. This can be done at the level of individual frames or using summary statistics of traffic flows and protocol usage. SIEM tools and retrospective network analysis (RNA) solutions help in capturing and analyzing network packets.

In plain words

Supplementary — not from your PDF

Traffic can be analyzed as summaries (protocol usage, endpoint activity) or packet by packet. Usually only packets that trigger rules are kept, because full capture is huge. Retrospective network analysis (RNA) records everything if resources allow. Tools such as Wireshark show each layer's headers and the payload, helping spot unusual manipulation, data exfiltration, suspicious domains, attack tools, and extractable malware files.

Detailed explanation

PDF p.322

Network Traffic Analysis

  • Detail Level: Analyzed at individual frames or summary statistics.
  • SIEM Tools: Store selected information from network sensors, aggregate and summarize packet data to show protocol usage and endpoint activity.
  • Recording Traffic: Typically, only packets triggering firewall or IDS rules are recorded to manage data volume.

Retrospective Network Analysis (RNA)

  • Purpose: Records the totality of network events at packet header or payload level, given sufficient resources.

Packet Analysis

  • Tool: Wireshark or similar tools.
  • Process: Deep, frame-by-frame scrutiny of captured traffic.
  • Layers Analyzed
    • Data Link/MAC Layer: Header fields.
    • Network/IP Layer: Header fields.
    • Transport (TCP/UDP) Layer: Header fields.
    • Application Layer: Header data and payload contents.

Uses of Packet Analysis

  • Identify Manipulations: Detect nonstandard packet manipulations (e.g., botnet server mechanisms).
  • Inspect Protocol Payloads: Identify data exfiltration attempts or suspicious domain/URL contacts.
  • Reveal Attack Tools: Detailed packet content analysis can reveal tools used in an attack.
  • Extract Binary Files: Possible to extract potential malware for further analysis.

Important terms

taken from the text above
Detail Level
Analyzed at individual frames or summary statistics.
SIEM Tools
Store selected information from network sensors, aggregate and summarize packet data to show protocol usage and endpoint activity.
Recording Traffic
Typically, only packets triggering firewall or IDS rules are recorded to manage data volume.
Data Link/MAC Layer
Header fields.
Network/IP Layer
Header fields.
Transport (TCP/UDP) Layer
Header fields.
Application Layer
Header data and payload contents.
Identify Manipulations
Detect nonstandard packet manipulations (e.g., botnet server mechanisms).
Inspect Protocol Payloads
Identify data exfiltration attempts or suspicious domain/URL contacts.
Reveal Attack Tools
Detailed packet content analysis can reveal tools used in an attack.
Extract Binary Files
Possible to extract potential malware for further analysis.
RNA Retrospective Network Analysis

Examples & real-world scenarios

Supplementary — not from your PDF
  • Reviewing a capture of your own lab traffic in Wireshark.
  • Spotting unusual DNS queries to strange domains.
  • Extracting a downloaded file from a capture for sandbox analysis.

Scenario

An alert flags large uploads from a server at night. A packet capture shows data being sent to an unknown domain, confirming exfiltration and giving indicators to block.

Common mistakes

Supplementary — not from your PDF
  • Trying to keep full captures forever without the storage to do it.
  • Capturing traffic on networks you aren't authorized to monitor.

Practical skills

Supplementary — not from your PDF
  • Read the layers of a packet in Wireshark using your own lab traffic.

What I should remember

Key Points PDF p.322
  • Network Traffic Analysis
    • Detail Level: Individual frames, summary statistics.
    • SIEM Tools: Aggregate and summarize packet data.
    • Recording Traffic: Packets triggering firewall/IDS rules.
  • Retrospective Network Analysis (RNA)
    • Purpose: Record total network events.
  • Packet Analysis
    • Tool: Wireshark.
    • Process: Frame-by-frame scrutiny.
    • Layers: Data link/MAC, network/IP, transport (TCP/UDP), application.
  • Uses
    • Identify Manipulations: Nonstandard packet uses.
    • Inspect Payloads: Data exfiltration, suspicious contacts.
    • Reveal Tools: Attack tools.
    • Extract Files: Potential malware.