Duration
5 days
OUTLINE
Fundamentals of Traffic Analysis: Part I
Day 1 provides a refresher or introduction, depending on your background, to TCP/IP. It describes the need to understand packet structure and content. It covers the essential foundations such as the TCP/IP communication model, theory of bits, bytes, binary and hexadecimal, an introduction. We introduce the use of open source Wireshark and tcpdump for analysis.
We begin our exploration of the TCP/IP communication model with the study of the link layer, the IP layer, both IPv4 and IPv6 and packet fragmentation in both. We describe the layers and analyze traffic not just in theory and function, but from the perspective of an attacker and defender.
All traffic is discussed and displayed using the two open source tools, Wireshark and tcpdump. Students can follow along with the instructor viewing the sample traffic capture files supplied. Six hands-on exercises, one after each major topic, offer you the opportunity to reinforce what you just learned.
Topics
Concepts of TCP/IP
- Why is it necessary to understand packet headers and data?
- TCP/IP communications model
- Data encapsulation/de-encapsulation
- Discussion of bits, bytes, binary, and hex
Introduction to Wireshark
- Navigating around Wireshark
- Examination of Wireshark statistics
- Stream reassembly
- Finding content in packets
Network Access/Link Layer: Layer 2
- Introduction to 802.x link layer
- ARP spoofing
IP Layer: Layer 3
- IPv4
- Examination of fields in theory and practice
- Checksums and their importance, especially for an IDS/IPS
- Fragmentation: IP header fields involved in fragmentation, composition of the fragments, fragmentation attacks
- IPv6
- Comparison with IPv4
- IPv6 addresses
- Neighbor discovery protocol
- Extension headers
- IPv6 in transition
Day 2 continues where the previous day ended in understanding the TCP/IP model. Two essential tools, Wireshark and tcpdump, are further explored, using their advanced features to give you the skills to analyze your own traffic. The focus of these tools on Day 2 is filtering traffic of interest in Wireshark using display filters and in tcpdump using Berkeley Packet Filters. We proceed with our exploration of the TCP/IP layers covering TCP, UDP, and ICMP. Once again, we describe the layers and analyze traffic not just in theory and function, but from the perspective of an attacker and defender.
Once again, students can follow along with the instructor viewing the sample capture files supplied. Four hands-on exercises, one after each major topic, offer you the opportunity to reinforce what you just learned.
Topics
Wireshark Display Filters
- Examination of some of the many ways that Wireshark facilitates creating display filters
- Composition of display filters
Writing tcpdump Filters
- Format of tcpdump filters
- Use of bit masking
TCP
- Examination of fields in theory and practice
- Packet dissection
- Checksums
- Normal and abnormal TCP stimulus and response
- Importance of TCP reassembly for IDS/IPS
UDP
- Examination of fields in theory and practice
- UDP stimulus and response
ICMP
- Examination of fields in theory and practice
- When ICMP messages should not be sent
- Use in mapping and reconnaissance
- Normal ICMP
- Malicious ICMP
Day 3 introduces the versatile packet crafting tool Scapy. It is a very powerful Python-based tool that allows the manipulation, creation, reading, and writing packets. Scapy can be used to craft packets to test the detection capability of an IDS/IPS, especially important when a new user-created IDS rule is added, for instance for a recently announced vulnerability.
The examination of TCP/IP culminates with an exploration of the application protocol layer. The concentration is on some of the most widely used, and sometimes vulnerable, crucial application protocols: DNS, HTTP(S), SMTP, and Microsoft communications. Our focus is on protocol analysis, a key skill in intrusion detection.
IDS/IPS evasions are the bane of the analyst, so the theory and possible implications of evasions at different protocol layers are examined.
Again, students can follow along with the instructor viewing the sample traffic capture files supplied. Four hands-on exercises, one after each major topic, offer you the opportunity to reinforce what you just learned.
Topics
Scapy
- Packet crafting and analysis using Scapy
- Writing a packet(s) to the network or a pcap file
- Reading a packet(s) from the network or from a pcap file
Advanced Wireshark
- Exporting web objects
- Extracting SMTP attachment content
- Wireshark investigation of an incident
- Tshark
Detection Methods for Application Protocols
- Pattern matching, protocol decode, and anomaly detection challenges
DNS
- Its vital role in the Internet
- The resolution processes
- Caching
- DNSSEC
- Malicious DNS, including cache poisoning
Microsoft Protocols
- SMB/CIFS
- MSRPC
- Detection challenges
HTTP(2)/TLS
- Protocol format
- Detection challenges
SMTP
- Protocol format
- STARTTLS
- Sample of attacks
- Detection challenges
IDS/IPS Evasion Theory
- Theory and implications of evasions at different protocol layers
- Sampling of evasions
- Necessity for target-based detection
Four hands-on exercises, one after each major topic, offer you the opportunity to reinforce what you just learned.
The fundamental knowledge gained from the first three days provides a fluid progression into one of the most popular days SEC503. Snort and Bro are widely deployed open source IDS/IPS solutions that have been industry standards for many years.
The day begins with a discussion on network architecture including the features of intrusion detection and prevention devices along with a discussion about options and requirement of devices that can sniff and capture the traffic for inspection. Next, the topic of the analyst's role in the detection process is examined. Before Snort and Bro are discussed, the capabilities and limitations are considered.
Snort detection flow, running Snort, and rules are explored with an emphasis on writing efficient rules. It is likely that false positives and negatives will occur and tips for dealing with them are presented.
Bro's unique capability to use its own scripting language to write code to analyze patterns of event-driven behavior is one of the most powerful detection tools available to the analyst. We discuss how this enables monitoring and correlating activity and demonstrate with examples.
The Day 4 format has less instruction and longer hands-on exercises to encourage you to become more comfortable with a less guided and more independent approach to analysis. This is intended to simulate the environment of an actual incident investigation that you may encounter at your sites.
Four hands-on exercises, one after each major topic, offer you the opportunity to reinforce what you just learned.
Topics
Network Architecture
- Instrumenting the network for traffic collection
- IDS/IPS deployment strategies
- Hardware to capture traffic
Introduction to IDS/IPS Analysis
- Function of an IDS
- The analyst's role in detection
- Flow process for Snort and Bro
- Similarities and differences between Snort and Bro
Snort
- Introduction to Snort
- Running Snort
- Writing Snort rules
- Solutions for dealing with false negatives and positives
- Tips for writing efficient rules
Bro
- Introduction to Bro
- Bro Operational modes
- Running Bro
- Bro output logs and how to use them
- Bro scripting
- Using Bro to monitor and correlate related activity
Five hands-on exercises, one after each major topic, offer you the opportunity to reinforce what you just learned.
The penultimate day continues the format of less instruction and more hands-on training using three separate incidents that must be analyzed. The three incident scenarios are introduced with some new material to be used in the related hands-on analysis.
This material includes an introduction to network forensics analysis for the first scenario. It continues with using network flow records to assist in analysis of the traffic from the second scenario. It concludes with the third scenario where Command and Control channels are discussed and managing analysis when very large packet capture files are involved.
Topics
Introduction to Network Forensics Analysis
- Theory of network forensics analysis
- Phases of exploitation
Using Network Flow Records
- What is the open source tool SiLK?
- How to use SiLK for analysis
Examining Command and Control traffic
- Introduction to command and control traffic
- Covert DNS tunnel software dnscat2
- Tunneling software The Onion Router (TOR)
Analysis of large pcaps
- The challenge of analyzing large pcaps
Three separate incident scenario pcaps are analyzed by the students.
Programme scope, delivery arrangements and suitability are confirmed during enquiry.