Packet Capture Analysis Download packet cap here http://www.filedropper.com/pack
ID: 3864510 • Letter: P
Question
Packet Capture Analysis
Download packet cap here http://www.filedropper.com/packetcap
Identify any suspicious activity in the packet capture. You are to answer the questions below, in as much detail as possible. If there's a 'mole' in the organization we want to know, and what, if anything, might have been stolen or compromised.
Here are the details regarding the network:
Employee
Title
IP address
Server
Server
172.16.235.131
Philo Farnsworth
President
172.16.235.129
James Garrett
Network Admin
172.16.235.130
Allen Beard
Vice President
172.16.235.128
Questions
1. What is occurring in packets 21-26? Is it evidence of an intrusion? Provide an interpretation of what is occurring, and the possible uses of the information gained. If there’s nothing suspicious, tell me so, and explain why it’s normal traffic.
2. Is the activity occurring in packets 75-95 evidence of an intrusion? Provide a detailed interpretation of what is occurring, and the possible uses of the information gained. What ports are involved? What information would be gained, and how would it be used by an attacker? What tool did the ‘attacker’ use? (Covered in a video.) Note there are several questions here to be answered.
3. Is the activity starting in packet 101 evidence of an intrusion? (Hint: Select the packet, right-click, Follow->TCP Stream). Provide a detailed interpretation of what is occurring, and the possible consequences. THERE IS A LOT GOING ON. TELL ME WHAT HAPPENED!
4. Is the activity starting in packet 507 evidence of an intrusion? (Note: this is a TCP stream so you can select the first packet, right click your mouse, select "Follow -> TCP Stream", and Wireshark will extract those packets and form a single readable stream.) Provide a detailed interpretation of what is occurring, and the possible consequences. THERE IS A LOT GOING ON. TELL ME WHAT HAPPENED!
5. Is the activity starting in packet 661 evidence of an intrusion? (Note: this is a TCP stream so you can select the packet, right click your mouse, select "Follow TCP Stream", and Wireshark will extract those packets and form a single readable stream.) Provide a detailed interpretation of what is occurring, and the possible consequences. Look for human readable text (a lot of what you see are formatting commands.). What text was added? To what file? What was the purpose of adding the text to this file, and who might see it? (there are a lot of questions to answer there).
6. Is the activity starting in packet 804-805 abnormal? Why or why not?
7. Is the activity starting in 1713 through 1719 a sign of an attack? Why or why not?
8. Is the activity starting in packet 2367 a sign of an attack (Note: if it’s sign of an attack, tell me why. If you can’t tell, tell me why you can’t). (Use Follow TCP Stream).
9. Is the activity starting in packet 2519 (to the end of the packet capture) evidence of an intrusion or attack? Provide a detailed description of what is occurring, and the possible consequences. What did the attacker do?
10. Who was the attacker, and were his skills low, moderate, or high? Defend your answer based on the evidence. How much is Philo Farnsworth’s salary?
Employee
Title
IP address
Server
Server
172.16.235.131
Philo Farnsworth
President
172.16.235.129
James Garrett
Network Admin
172.16.235.130
Allen Beard
Vice President
172.16.235.128
Explanation / Answer
On wired broadcast LANs, such as Ethernet, Token Ring, and FDDI networks, depending on the network structure (hub or switch),[2] one can capture traffic on all or parts of the network from a single machine on the network. However, some methods avoid traffic narrowing by switches to gain access to traffic from other systems on the network (e.g., ARP spoofing). For network monitoring purposes, it may also be desirable to monitor all data packets in a LAN by using a network switch with a so-called monitoring port that mirrors all packets that pass through all ports of the switch when systems are connected to a switch port. To use a network tap is an even more reliable solution than to use a monitoring port, since taps are less likely to drop packets during high traffic load.
On wireless LANs, one can capture traffic on a particular channel, or on several channels using multiple adapters.
On wired broadcast and wireless LANs, to capture traffic other than unicast traffic to the machine running the sniffer, multicast traffic to a multicast group that machine is monitoring, or broadcast traffic—the network adapter capturing the traffic must be in promiscuous mode. Some sniffers support this, but not all. On wireless LANs, even if the adapter is in promiscuous mode, packets not for the service set the adapter is configured for are usually ignored. To see those packets, the adapter must be in monitor mode.[citation needed]
When traffic is captured, either the entire contents of packets are recorded, or the headers are recorded without recording the total content of the packet. This can reduce storage requirements, and avoid legal problems, yet provide sufficient information to diagnose problems.
Captured information is decoded from raw digital form into a human-readable format that lets users easily review exchanged information. Protocol analyzers vary in their abilities to display data in multiple views, automatically detect errors, determine root causes of errors, generate timing diagrams, reconstruct TCP and UDP data streams, etc.[citation needed]
Some protocol analyzers can also generate traffic and thus act as the reference device. These can act as protocol testers. Such testers generate protocol-correct traffic for functional testing, and may also have the ability to deliberately introduce errors to test the DUT's ability to handle errors.[citation needed]
Protocol analyzers can also be hardware-based, either in probe format or, as is increasingly common, combined with a disk array. These devices record packets (or a slice of the packet) to a disk array. This allows historical forensic analysis of packets without users having to recreate any fault.[citation needed]
Uses[edit]
Packet sniffers can:[citation needed]
Packet capture can be used to fulfill a warrant from a law enforcement agency (LEA) to produce all network traffic generated by an individual. Internet service providers and VoIP providers in the United States must comply with CALEA (Communications Assistance for Law Enforcement Act) regulations. Using packet capture and storage, telecommunications carriers can provide the legally required secure and separate access to targeted network traffic and are able to use the same device for internal security purposes. Collecting data from a carrier system without a warrant is illegal due to laws about interception. By using end-to-end encryption, communications can be kept confidential from telecommunication carriers and legal authorities.
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.