In this lesson,
we're going to take a look at a network log
and see if we can find something malicious or suspicious
inside of it.
Now for this example, I have a network log from a router
that's going to show us a couple of key pieces of information.
You'll have the first column which is the date,
the second column which is the time,
the third column which is the interface,
the fourth column which is the action,
and the fifth column which is the details.
When we look at the interface,
you see that this is Gi0/1 or Gi0/2,
and these are two ports on our router.
There's another one of Gi0/3 in there.
So we have three different ports that are being used
on this particular router.
Then we have the action.
Is it an allow action, a deny action,
or something like an ARP replay
as you see here on the screen?
And then we have our details.
And the details is going to give you information about
where the traffic is coming from or going to,
over which ports, and what protocol,
or other things like that.
So let's go through this
and read from the action and the details column
to see what we think might be malicious.
Here we see there's an allow action
for inbound traffic going from 192.168.1.105
to 192.168.1.10 on TCP port 80.
Now you may think it might be unusual
that there is a internal address to an internal address,
such as 192.168.1.105 going to 192.168.1.10.
If you work as a network administrator in the real world,
you may see that and go, "Hey, they're both internal.
We shouldn't need a router for that."
But as you know, there may be two different subnets here
and a router would still be used.
Also when you're dealing with an exam,
many times they don't want to use any public IP addresses
because they don't want anybody saying
that we are calling them malicious
because we happen to use their IP address on the exam.
And so a lot of times,
they'll use things like a 10.something,
a 172.something, or 192.something
because those are all considered private IP addresses,
but they'll still use those as public IP addresses
in the exam for those purposes.
So in the logs, if you see that,
don't worry too much about that
and just think about the fact
that we're going from one system to another.
The second line, we have an outbound traffic
going from 192.168.1.15 over to an external IP of 8.8.8.8
on UDP port 53.
And that makes sense to me because 8.8.8.8
is Google's DNS server and it operates over UDP port 53,
which is what we use for DNS.
The next two lines are ARP replies,
and we have 192.168.1.10 is at,
and then it has a MAC address.
The second line is saying 192.168.1.10
is at a different MAC address.
That to me is a little suspicious. Why?
Because normally the MAC address is hardcoded
into your network adapter, and if it changes like this,
somebody had to tell it to change.
And the fact that it's changing
within just a couple of seconds of each other
tells me they may be using a MAC changing software
to be able to spoof their MAC
to be able to do some kind of an ARP spoof.
So that's what I'm thinking right now
as I'm going through these logs.
The next line we have is the three allow lines
going for inbound traffic, outbound traffic,
and inbound traffic.
And, again, we just have some other traffic happening
on this router,
like going from an internal server to another server
on TCP port 443, which is a secure web server.
We see one using ICMP,
which is essentially what we use for pinging.
And then we have another one that we use on TCP port 22,
which is an SSH connection.
Then we have two more ARP replies,
and here we're seeing 192.168.1.10,
that same system is once again reverting itself back
to the original MAC address
and then changing it again about five seconds later.
So again, that seems pretty suspicious to me.
The next one we have is the allow line on Gi0/2,
which is a different interface,
and we're allowing outbound traffic from 192.168.1.13
to 8.8.4.4, which again is Google's DNS server,
it's their secondary DNS server,
and this is on UDP port 53.
So again, that doesn't seem very suspicious to me.
Once again, we're seeing two more ARP replies
and it's the same system once again, 192.168.1.10,
and again, we're seeing the first MAC address
and then the second MAC address.
So it seems like they're switching themself one more time.
The next line we see is a deny statement,
which is denying inbound traffic from 192.168.1.105
to 192.168.1.255, which is the broadcast, over UDP Port 137,
which is NetBIOS.
Again, this doesn't really seem suspicious,
and even if it was, it was denied
so we're not too worried about it.
The next one we have is going to be an allow statement
going from 192.168.1.105 over to 192.168.1.20
on port 80 using TCP
and this is an inbound traffic going to a web server
based on that port and it was being allowed.
So I'm going to assume that the server at 192.168.1.20
is a web server because we're seeing
that traffic over port 80 being allowed.
And then finally, we have another ARP reply.
And here we see 192.168.1.10
and that MAC address went back to the second one again,
which again is an indication of that spoofing.
And so that's what I think this log is showing us,
is that we're looking at a possible ARP spoof event.
And that's about the level of analysis
you'll be asked to perform on the exam.
And if you get a question like this,
this would be actually considered one
of the harder questions on the exam
because an ARP spoof is one that is pretty difficult
to determine.
But the fact that we're looking at network log
and the only thing we're seeing is ARP reply
repeated a couple of times,
and with the same IP address
going to two different MAC addresses,
that would be an indication of some kind
of an ARP spoofing attack.
And so that's what you should be selecting
if you see something on the exam that looks like this.