Instructor: Network forensic tools. 2 2
Network related indicators of compromise 3 3
can be gathered from packet captures, traffic flow data, 4 4
logs and alerts. 5 5
As a cybersecurity analyst, 6 6
you need to know how to analyze this information 7 7
in order to identify abnormal activity. 8 8
Now, network traffic must be captured 9 9
and its data frames decoded before you can analyze it. 10 10
To help with this, 11 11
we use something called a Switched Port Analyzer or a SPAN. 12 12
Now, a SPAN port or a mirror port 13 13
allows for the copying of ingress or egress communications 14 14
from one or more switch ports to another. 15 15
Essentially, 16 16
it makes a copy of everything coming in or out of a port, 17 17
and then puts that on a duplicate port 18 18
so you can then monitor it. 19 19
This can be done using your switch or routers configuration 20 20
as you see here on the screen. 21 21
Now, for the exam, 22 22
you do not need to know how to set this up. 23 23
But in the real world, 24 24
this is something you're going to have to do, 25 25
and your network technicians 26 26
who run your routers and switches can help you do that. 27 27
Now, once you have a SPAN port configured, 28 28
you're going to have to enable packet sniffing, 29 29
and you do this with a packet sniffer. 30 30
Now, what a packet sniffer is, 31 31
is any piece of hardware or software 32 32
that records data from frames 33 33
as they pass over the network media 34 34
using methods such as a mirrored port, 35 35
like a SPAN port, or a TAP device. 36 36
Now, these TAP devices, 37 37
what we call a network tap could be something 38 38
that looks like a hardware device, like this. 39 39
This example is a hardware port. 40 40
Now, there are both passive 41 41
and active versions of these devices 42 42
where they can collect the data going over the network 43 43
from any network cable segment, 44 44
if you're going to do it using a hardware device, 45 45
or you can use software connecting it through a SPAN port. 46 46
Now, another thing you have to think about 47 47
when you start dealing with these network sniffers 48 48
is where are you going to place them in your network. 49 49
Generally, you want to make sure your network sniffer 50 50
is placed inside the firewall, 51 51
or as close to an important server as possible. 52 52
Now, the reason for this 53 53
is because you want to be able to identify malicious traffic, 54 54
and as specifically the traffic 55 55
that's getting in through your firewall. 56 56
So, if you put the sniffer on the inside of the firewall, 57 57
the firewall will also block most of the traffic coming in, 58 58
and then you can just look and sniff at what's left. 59 59
If you put it outside the firewall, 60 60
you can become quickly overwhelmed 61 61
with all the data that's coming at your network. 62 62
And so it is much better to place it inside the firewall 63 63
where a lot of that data has already been blocked 64 64
by the firewalls ACLs. 65 65
Now, another thing to keep in mind 66 66
when you're dealing with a sniffer 67 67
is that you don't have to have just one sniffer. 68 68
You can put multiple sniffers on your network 69 69
at different positions. 70 70
For instance, you may have one 71 71
that's right behind your firewall or your router 72 72
that is going to collect the bulk of the information 73 73
for the network. 74 74
But, if you have a single device 75 75
that you're really worried about, 76 76
you can put a sniffer right in front of that device. 77 77
For instance, maybe your database server. 78 78
And that would give you additional monitoring 79 79
that has much less data that you're looking at, 80 80
just what's going to and from that database server, 81 81
and so it'll be a smaller sniffer, 82 82
and allow you to look at that much more closely. 83 83
Again, the exact deployment is going to be up to you 84 84
as a cybersecurity analyst to decide, 85 85
but you do want to be able to figure out 86 86
where it's going to going to do you the most good 87 87
based on what you care about. 88 88
And this goes back to your threat modeling 89 89
that we talked about in the last section. 90 90
Now, there are two tools that we use a lot 91 91
inside of network analysis. 92 92
These are tcpdump and Wireshark. 93 93
Now, both of these can perform a sniffer function 94 94
to perform live packet capturing. 95 95
And you can also use them afterwards 96 96
to do an analysis of the PCAP data 97 97
that you've been saving all of that packet capture. 98 98
When talking about tcpdump, 99 99
this is a data network packet analyzing computer program 100 100
that runs under a command-line interface. 101 101
And it allows the user to display TCP/IP 102 102
and other packets being transmitted 103 103
or received over the network 104 104
to which the computer is attached. 105 105
You can then dump all that information into a file 106 106
called a PCAP file or packet capture file 107 107
for later analysis. 108 108
Another tool we use a lot is Wireshark. 109 109
And Wireshark is a free and open source 110 110
GUI-based packet analyzer 111 111
that is used for network troubleshooting, analysis, 112 112
software and communication protocol development, 113 113
and further education. 114 114
Now, in the next two lessons, 115 115
I'm going to jump into my lab environment, 116 116
and I'm going to show you how to actually use tcpdump 117 117
and Wireshark as a cybersecurity analyst 118 118
to perform your job functions. 119 119
So, let's go ahead and get started.