Network Packet Analysis

Ahmad Muammar W.K. OSCP

Technical Workshop (21 Desember 2012)

Tuesday, January 22, 13

Agenda

• Play with Captured Network File

• Wireshark Feature

• Packet Analysis Case Study

• Another Packet Analysis Tools

• Create Wireshark Dissector

Network Packet Analysis - Ahmad Muammar W.K. OSCPTuesday, January 22, 13

• Analyze fileds within protocols

• Analyze Protocols within packets

• Analyze Packets within streams

• Reconstruct higher-layer protocols

Packet Analysis

Wireshark StatisticsUsefull Feature for Analysis

• Show Information About Data Capture

• Contain: File Information, Time package captured, Capture Information, Display Filter used, Traffic Summary, show Captured, Displayed (if display filter is set) and Marked.

Summary

• Display a hierarchical tree of protocol statistics

• Tree of all protocols captured, able to expand and collapse the subtree.

• We are able to get info about what is the most protocol in a network captured file and will be our hint.

Protocol Hierarchy

• Display a list of conversations (traffic between two endpoints)

• Support: Protocol Specific Windows, Name Resolution and Limit to Display Filter

Conversations

• Display user specified graphs (e.g number of pakets in the course of time)

• Support: 5 differently colored graphs base on Display filter.

IO Graphs

Wireshark CASE FILE : SATU

Wireshark CASE FILE : DUA

Use Wireshark Analysisplease :)

Network Packet Analysis - Ahmad Muammar W.K. OSCPNetwork Packet Analysis - Ahmad Muammar W.K. OSCPTuesday, January 22, 13

Let the packet tell the truths

Network Packet Analysis - Ahmad Muammar W.K. OSCP

CASE FILE : TIGAReference: Practical Packet Analysis

http://chrissanders.org/captures/aurora.pcap

Summary

• Victims received a targeted email from the attacker that appears to be legitimate, clicks a link within it, and sends a GET request to the attacke’s malicious site.

• The attacker’s web server issues 302 redirection to the victim, and the victim’s browser issues a GET request to the redirected URL.

Network Packet Analysis - Ahmad Muammar W.K. OSCPhttp://chrissanders.org/captures/aurora.pcap

Summary

• The Attacker’s Web Server transmits a web page containing obfuscated JavaScript code to the client that includes a vulnerability exploit and an iframe containing a link to a malicious GIF Image

• The victim issues a GET Requests for the malicious image and downloads it from server

Summary

• The javascript code transmitted earlier is deobfuscated using the malicious GIF, and the code executes on the victim’s machine, exploiting a vulnerability in Internet Explorer

• Once it exploited, the payload hidden within the obfuscated code is executed, opening a new session from the victim to the attacker on port 4321

Summary

• A command Shell is spawned from the payload and shoveled back to the attacker.

• And its called “Operation Aurora”.

http://chrissanders.org/captures/aurora.pcap

Another toolsfor packet analysis

XPLICO

• Xplico is an open source Network Forensic Analysis Tool (NFAT).

• Extract from an internet traffic capture the applications data contained. From a pcap file to extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, etc.

• xplico.org

Network Miner

• NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows (but also works in Linux / Mac OS X / FreeBSD)

• NetworkMiner can be used as a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc

• netresec.com

PCAP Sample

• http://wiki.wireshark.org/SampleCaptures

Packet AnalysisCreating Own Wireshark Dissector for Own/Others

protocol

Wireshark Dissector

• Allow Wireshark to automatically break down into various section so that it can be analyzed

• Translator, decoder

• Not work for non-standard/default port.

• Creating With LUA

• "Lua" (pronounced LOO-ah) means "Moon" in Portuguese

• Lua is a powerful, fast, lightweight, embeddable scripting language.

• Lua combines simple procedural syntax with powerful data description constructs based on associative arrays and extensible semantics

Download LUA

• LUA for Windows

• http://luaforwindows.luaforge.net/

• Install LUA

Simple LUA

• code it:

• echo “print("Hello World")” > hello.lua

• run it:

• prompt> lua hello.lua

Wireshark + LUACheck support and compatibility

Reference

• Lua Support In Wireshark - http://www.wireshark.org/docs/wsug_html_chunked/wsluarm.html

• http://wiki.wireshark.org/Lua

Network Packet Analysis

Ahmad Muammar W.K. OSCP

Technical Workshop (21 Desember 2012)

Network Packet Analysis

Technology

Transcript of Network Packet Analysis

Practical Packet Analysis Using Wireshark to Solve Real World Network Problems

Network Diagnostics Using Passive Network Monitoring and ...Active Passive Learned Predefined. Our goals Network Diagnostics Using Passive Network Monitoring and Packet Analysis 5/18

2017 Global Network Packet Brokers Market Leadership Award · 2017 Global Network Packet Brokers Market Leadership Award GLOBAL NETWORK PACKET BROKERS MARKET LEADERSHIP AWARD ...

New York Chiropractor Network Participation Packet …uni.lmhealthcare.com/.../NetPacketNYChiro.pdfNew York Chiropractor Network Participation Packet Network Management Department

Session 7. Packet Switching Networksdskim/Classes/ECE547/ln-network-ch07.pdf · Session 7. Packet Switching Networks ... Packet network topologyPacket network topology ... No link

Chapter 7 Packet-Switching Networksljilja/ENSC427/Spring15/News/Leon...Chapter 7 Packet-Switching Networks Network Services and Internal Network Operation Packet Network Topology Datagrams

Comparing the Accuracy of Network Simulators for Packet-Level Analysis using a Network Testbed Chaudhry Usman Ali UNB, Fredericton.

Manual - Robust Packet Network

Packet-based Network Traffic Monitoring & Analysis with GPUson-demand.gputechconf.com/gtc/2014/presentations/S4320... · 2014-04-07 · Packet-based Network Traffic Monitoring & Analysis

Packet analysis

Ethernet Bomber Ethernet Packet Generator for network analysis

nPrint: Standard Packet-level Network Tra c Analysis

Network “sniffing ”— packet capture and analysiscsci530l/slides/lab-sniffing-color.pdf · Network “sniffing ”— packet capture and analysis October 4, 2018 Administrative

Packet Network Performance

Performance Analysis of Packet Schedulers Analysis of Packet Schedulers Layo Olumide Babagbemi ... (UMTS) network for ... call connection/burst level based on fluid flow …

Packet analysis for network forensics: A comprehensive survey

NETWORK SNIFFING - Eman Alashwali · WHAT IS NETWORK SNIFFING ? Network analysis = Packet Analysis = Eavesdropping Capturing network traffic and inspecting it closely to determine

Manual - Robust Packetrobust-packet.net/Robust-Packet-Network-Manual.pdf · Robust Packet Network Manual update 2020-06-30 4-31 RPR-Network Europe RPN20 (Robust-Packet-Network on

Packet Network Sync v1

Performance Analysis of Packet Classification Algorithms on Network Processors