1 1 00:00:00,480 --> 00:00:02,790 Network forensic tools. 2 2 00:00:02,790 --> 00:00:04,800 Network related indicators of compromise 3 3 00:00:04,800 --> 00:00:07,800 can be gathered from packet captures, traffic flow data, 4 4 00:00:07,800 --> 00:00:09,600 logs and alerts. 5 5 00:00:09,600 --> 00:00:11,100 As a cybersecurity analyst, 6 6 00:00:11,100 --> 00:00:13,620 you need to know how to analyze this information 7 7 00:00:13,620 --> 00:00:16,530 in order to identify abnormal activity. 8 8 00:00:16,530 --> 00:00:18,660 Now, network traffic must be captured 9 9 00:00:18,660 --> 00:00:22,290 and its data frames decoded before you can analyze it. 10 10 00:00:22,290 --> 00:00:23,160 To help with this, 11 11 00:00:23,160 --> 00:00:27,660 we use something called a Switched Port Analyzer or a SPAN. 12 12 00:00:27,660 --> 00:00:29,610 Now, a SPAN port or a mirror port 13 13 00:00:29,610 --> 00:00:33,210 allows for the copying of ingress or egress communications 14 14 00:00:33,210 --> 00:00:35,760 from one or more switch ports to another. 15 15 00:00:35,760 --> 00:00:36,593 Essentially, 16 16 00:00:36,593 --> 00:00:39,540 it makes a copy of everything coming in or out of a port, 17 17 00:00:39,540 --> 00:00:41,550 and then puts that on a duplicate port 18 18 00:00:41,550 --> 00:00:43,020 so you can then monitor it. 19 19 00:00:43,020 --> 00:00:46,170 This can be done using your switch or routers configuration 20 20 00:00:46,170 --> 00:00:47,730 as you see here on the screen. 21 21 00:00:47,730 --> 00:00:48,840 Now, for the exam, 22 22 00:00:48,840 --> 00:00:51,120 you do not need to know how to set this up. 23 23 00:00:51,120 --> 00:00:52,290 But in the real world, 24 24 00:00:52,290 --> 00:00:54,450 this is something you're going to have to do, 25 25 00:00:54,450 --> 00:00:55,680 and your network technicians 26 26 00:00:55,680 --> 00:00:58,170 who run your routers and switches can help you do that. 27 27 00:00:58,170 --> 00:01:00,450 Now, once you have a SPAN port configured, 28 28 00:01:00,450 --> 00:01:02,730 you're going to have to enable packet sniffing, 29 29 00:01:02,730 --> 00:01:04,920 and you do this with a packet sniffer. 30 30 00:01:04,920 --> 00:01:06,210 Now, what a packet sniffer is, 31 31 00:01:06,210 --> 00:01:08,160 is any piece of hardware or software 32 32 00:01:08,160 --> 00:01:09,900 that records data from frames 33 33 00:01:09,900 --> 00:01:12,030 as they pass over the network media 34 34 00:01:12,030 --> 00:01:13,980 using methods such as a mirrored port, 35 35 00:01:13,980 --> 00:01:17,070 like a SPAN port, or a TAP device. 36 36 00:01:17,070 --> 00:01:18,510 Now, these TAP devices, 37 37 00:01:18,510 --> 00:01:20,700 what we call a network tap could be something 38 38 00:01:20,700 --> 00:01:23,340 that looks like a hardware device, like this. 39 39 00:01:23,340 --> 00:01:25,530 This example is a hardware port. 40 40 00:01:25,530 --> 00:01:26,790 Now, there are both passive 41 41 00:01:26,790 --> 00:01:29,250 and active versions of these devices 42 42 00:01:29,250 --> 00:01:31,680 where they can collect the data going over the network 43 43 00:01:31,680 --> 00:01:33,540 from any network cable segment, 44 44 00:01:33,540 --> 00:01:35,520 if you're going to do it using a hardware device, 45 45 00:01:35,520 --> 00:01:38,640 or you can use software connecting it through a SPAN port. 46 46 00:01:38,640 --> 00:01:40,200 Now, another thing you have to think about 47 47 00:01:40,200 --> 00:01:42,030 when you start dealing with these network sniffers 48 48 00:01:42,030 --> 00:01:44,400 is where are you going to place them in your network. 49 49 00:01:44,400 --> 00:01:46,620 Generally, you want to make sure your network sniffer 50 50 00:01:46,620 --> 00:01:48,630 is placed inside the firewall, 51 51 00:01:48,630 --> 00:01:51,450 or as close to an important server as possible. 52 52 00:01:51,450 --> 00:01:52,740 Now, the reason for this 53 53 00:01:52,740 --> 00:01:55,710 is because you want to be able to identify malicious traffic, 54 54 00:01:55,710 --> 00:01:57,180 and as specifically the traffic 55 55 00:01:57,180 --> 00:01:59,130 that's getting in through your firewall. 56 56 00:01:59,130 --> 00:02:02,520 So, if you put the sniffer on the inside of the firewall, 57 57 00:02:02,520 --> 00:02:05,430 the firewall will also block most of the traffic coming in, 58 58 00:02:05,430 --> 00:02:07,950 and then you can just look and sniff at what's left. 59 59 00:02:07,950 --> 00:02:09,660 If you put it outside the firewall, 60 60 00:02:09,660 --> 00:02:11,070 you can become quickly overwhelmed 61 61 00:02:11,070 --> 00:02:13,560 with all the data that's coming at your network. 62 62 00:02:13,560 --> 00:02:16,170 And so it is much better to place it inside the firewall 63 63 00:02:16,170 --> 00:02:18,180 where a lot of that data has already been blocked 64 64 00:02:18,180 --> 00:02:19,830 by the firewalls ACLs. 65 65 00:02:19,830 --> 00:02:21,060 Now, another thing to keep in mind 66 66 00:02:21,060 --> 00:02:22,140 when you're dealing with a sniffer 67 67 00:02:22,140 --> 00:02:24,630 is that you don't have to have just one sniffer. 68 68 00:02:24,630 --> 00:02:26,820 You can put multiple sniffers on your network 69 69 00:02:26,820 --> 00:02:28,110 at different positions. 70 70 00:02:28,110 --> 00:02:29,430 For instance, you may have one 71 71 00:02:29,430 --> 00:02:31,830 that's right behind your firewall or your router 72 72 00:02:31,830 --> 00:02:33,690 that is going to collect the bulk of the information 73 73 00:02:33,690 --> 00:02:34,800 for the network. 74 74 00:02:34,800 --> 00:02:36,390 But, if you have a single device 75 75 00:02:36,390 --> 00:02:37,650 that you're really worried about, 76 76 00:02:37,650 --> 00:02:40,170 you can put a sniffer right in front of that device. 77 77 00:02:40,170 --> 00:02:42,270 For instance, maybe your database server. 78 78 00:02:42,270 --> 00:02:43,860 And that would give you additional monitoring 79 79 00:02:43,860 --> 00:02:46,080 that has much less data that you're looking at, 80 80 00:02:46,080 --> 00:02:48,360 just what's going to and from that database server, 81 81 00:02:48,360 --> 00:02:49,950 and so it'll be a smaller sniffer, 82 82 00:02:49,950 --> 00:02:52,260 and allow you to look at that much more closely. 83 83 00:02:52,260 --> 00:02:54,690 Again, the exact deployment is going to be up to you 84 84 00:02:54,690 --> 00:02:56,760 as a cybersecurity analyst to decide, 85 85 00:02:56,760 --> 00:02:58,470 but you do want to be able to figure out 86 86 00:02:58,470 --> 00:02:59,940 where it's going to going to do you the most good 87 87 00:02:59,940 --> 00:03:01,470 based on what you care about. 88 88 00:03:01,470 --> 00:03:03,330 And this goes back to your threat modeling 89 89 00:03:03,330 --> 00:03:04,950 that we talked about in the last section. 90 90 00:03:04,950 --> 00:03:06,900 Now, there are two tools that we use a lot 91 91 00:03:06,900 --> 00:03:08,880 inside of network analysis. 92 92 00:03:08,880 --> 00:03:11,670 These are tcpdump and Wireshark. 93 93 00:03:11,670 --> 00:03:14,100 Now, both of these can perform a sniffer function 94 94 00:03:14,100 --> 00:03:16,170 to perform live packet capturing. 95 95 00:03:16,170 --> 00:03:18,030 And you can also use them afterwards 96 96 00:03:18,030 --> 00:03:20,040 to do an analysis of the PCAP data 97 97 00:03:20,040 --> 00:03:23,160 that you've been saving all of that packet capture. 98 98 00:03:23,160 --> 00:03:24,840 When talking about tcpdump, 99 99 00:03:24,840 --> 00:03:28,380 this is a data network packet analyzing computer program 100 100 00:03:28,380 --> 00:03:30,570 that runs under a command-line interface. 101 101 00:03:30,570 --> 00:03:32,970 And it allows the user to display TCP/IP 102 102 00:03:32,970 --> 00:03:34,740 and other packets being transmitted 103 103 00:03:34,740 --> 00:03:36,510 or received over the network 104 104 00:03:36,510 --> 00:03:38,310 to which the computer is attached. 105 105 00:03:38,310 --> 00:03:40,650 You can then dump all that information into a file 106 106 00:03:40,650 --> 00:03:42,900 called a PCAP file or packet capture file 107 107 00:03:42,900 --> 00:03:44,640 for later analysis. 108 108 00:03:44,640 --> 00:03:46,950 Another tool we use a lot is Wireshark. 109 109 00:03:46,950 --> 00:03:49,080 And Wireshark is a free and open source 110 110 00:03:49,080 --> 00:03:50,940 GUI-based packet analyzer 111 111 00:03:50,940 --> 00:03:53,430 that is used for network troubleshooting, analysis, 112 112 00:03:53,430 --> 00:03:55,620 software and communication protocol development, 113 113 00:03:55,620 --> 00:03:57,570 and further education. 114 114 00:03:57,570 --> 00:03:58,980 Now, in the next two lessons, 115 115 00:03:58,980 --> 00:04:00,960 I'm going to jump into my lab environment, 116 116 00:04:00,960 --> 00:04:03,027 and I'm going to show you how to actually use tcpdump 117 117 00:04:03,027 --> 00:04:05,820 and Wireshark as a cybersecurity analyst 118 118 00:04:05,820 --> 00:04:07,560 to perform your job functions. 119 119 00:04:07,560 --> 00:04:09,310 So, let's go ahead and get started.