COEN 252 Computer Forensics Using TCPDump / Windump

COEN 252 Computer Forensics Using TCPDump / Windump

COEN 252 Computer Forensics Using TCPDump / Windump for package analysis. TCPDump / Windump Low level package sniffer. Good, if you see a new type of attack

or try to diagnose a problem Bad, since you have to look at all these packages and learn how to interpret them. TCPDump / Windump: The Good Provides an audit trail of network activity.

Provides absolute fidelity. Universally available and cheap. TCPDump / Windump: The Bad Does not collect the payload by default. Does not scale well.

State / connections are hidden. Very Limited analysis of packages. Versions Unix Version 3.4. ftp.ee.lbl.gov/tcpdump.tar.Z Windump http://netgroup-serv.polito.it/windum

p http://netgroup-serv.polito.it/winpcap www.tcpdump.org Shadow Collects tcpdump data in hourly files. Analyzes for anomalies

Formates anomalous data in HTML Comes with Scripts Download it for free for UNIX http://www.nswc.navy.mil/ISSEC/CID/ Running TCPDump tcpdump x looks at packages in hex format Running tcpdump IP Header ICMP Header

20:20:55.778140 IP dhcp-19-211.engr.scu.edu > Bobadilla.scu.edu: icmp 108: echo request seq 4864 4500 0080 0231 0000 8001 0d0f 81d2 13d3 81d2 13c6 0800 d5ee 0200 1300 6162 6364 6566 6768 696a 6b6c 6d6e 6f70 7172 7374 7576 7761 6263 6465 6667 6869 6a6b 6c6d 6e6f 7071 7273 7475 7677 6162 6364 6566 6768 tcpdump

Use reference card to identify fields IP Version 4 Header Length (Nr * 4B) 20:20:55.778140 IP dhcp-19-211.engr.scu.edu > Bobadilla.scu.edu: icmp 108: echo request seq 4864 4500 0080 0231 0000 8001 0d0f 81d2 13d3 81d2 13c6 0800 d5ee 0200 1300 6162 6364 6566 6768 696a 6b6c 6d6e 6f70 7172 7374 7576 7761 6263 6465 6667 6869 6a6b 6c6d 6e6f 7071 7273 7475 7677 6162 6364 6566 6768

tcpdump 20B header Type of Service Total Length: 0x80 = 128decimal 20:20:55.778140 IP dhcp-19-211.engr.scu.edu > Bobadilla.scu.edu: icmp 108: echo request seq 4864 4500 0080 0231 0000 8001 0d0f 81d2 13d3 81d2 13c6 0800 d5ee 0200 1300 6162 6364

6566 6768 696a 6b6c 6d6e 6f70 7172 7374 7576 7761 6263 6465 6667 6869 6a6b 6c6d 6e6f 7071 7273 7475 7677 6162 6364 6566 6768 tcpdump Length of capture: tcpdump s 68 Default is 68B We see only 54B, because the ethernet header is 14B long.

tcpdump tcpdump e host bobadilla Shows Source MAC Destination MAC Protocol 20:37:48.124457 0:8:74:3f:2:46 0:d:56:8:e4:db ip 142: IP dhcp-19-211.engr.scu.edu > Bobadilla.scu.edu: icmp 108: echo request seq 5376

Tcpdump Fragmentation Total Length Total Length: Number of Bytes in Packet 20:42:07.217979 IP Bobadilla.scu.edu.137 > 239.255.255.250.137: udp 50 4500 004e 892b 0000 0111 aae1 81d2 13c6 efff fffa 0089 0089 003a adb9 8ce2 0000 0001 0000 0000 0000 2043 4b41 4141 4141

4141 4141 4141 4141 4141 4141 4141 4141 4141 4141 4141 4141 4100 0021 0001 Tcpdump Fragmentation Offset Header Length 0x33c = 828 Offset: 1ce8 0001 1100 1110 1000 = 7400 Multiply by 8: Offset = 59200 20:53:26.443325 IP Bobadilla.scu.edu > dhcp-19-211.engr.scu.edu: icmp (frag 35188:[email protected]) 4500 033c 8974 1ce8 8001 6627 81d2 13c6 81d2 13d3 6e6f 7071 7273 7475 7677 6162

6364 6566 6768 696a 6b6c 6d6e 6f70 7172 7374 7576 7761 6263 6465 6667 6869 6a6b 6c6d 6e6f 7071 7273 7475 7677 6162 6364 6566 TCPDump Filters

Capture only packages that are useful. Specify in the filter what items are interesting. Filters use common fields such as host or port. Filters also for individual bytes and bits in the datagram TCPDump Filters

Format 1: macro and value tcpdump port 23 Only displays packages going to or from port 23. TCPDump Filters Format 2:

[offset:length] ip[9] = 1 Selects any record with the IP protocol of 1. icmp[0] = 8 Selects any record that is an ICMP echo

requests. TCPDump Filters Reference single bits through bit masking. An example is TCP flag bits Byte 13 in a TCP header has the 8

flag fields. CWR,ECE,URG,ACK,PSH,RST,SYN,FI N TCPDump Filters Assume we want to mask out the PSH field. Translate the mask into binary. 0x04

TCPDump Filters Set filter to tcp[13] & 0x40 != 0. Your turn: Filter for packets that have the Syn or the Ack flag set.

TCPDump Filters Your turn: Filter for packets that have the Syn or the Ack flag set. tcp[13] & 0x12 != 0 TCPDump Filters

We can of course use exact values for filtering. tcp[13] = 0x20 looks only for tcppackets that have the urg flag set. TCPDump Filters

Can combine filters with the and, or, not operators (tcp and tcp[13]&0x0f != 0 and not port 25) or port 20 Filter can be written in file, specified with the F flag. NMap

Available in Windows and Unix version. Scans host with many different connections. Uses responses to determine OS. Target Acquisition. Network mapping. TCPDump

Use Filters to check for NMap activity. For example, send a TCP packet with SYN|FIN|URG|PSH options set. Use packages with the first two TCP flags set of OS-mapping

Recently Viewed Presentations

  • Advanced Lake Leaders Conference - UWSP

    Advanced Lake Leaders Conference - UWSP

    Technological Fix. Cognitive Fix. Structural Fix. The environment doesn't have problems, we as humans have problems When we. have problems with the environment, there are three ways of trying to fix them . ... Advanced Lake Leaders Conference
  • Business-to-business Exchanges

    Business-to-business Exchanges

    Business-to-Business is a transaction that occurs between a company and another company B2B is an electronic commerce between businesses Business-to-business exchanges are electronic marketplaces in which multiple buyers and multiple suppliers come together to exchange goods and services What are...
  • Language, Design, and Management Class 1: Introduction and ...

    Language, Design, and Management Class 1: Introduction and ...

    Standish Chaos Report: Success Rate. Successful 1994 1996 1998 2000 2002 2004 2006 2009 2011 0.16000000000000011 0.27 0.26 0.28000000000000008 0.34000000000000036 0.29000000000000031 0.35000000000000031 0.32000000000000056 0.37000000000000038 Challenged 1994 1996 1998 2000 2002 2004 2006 2009 2011 0.53 0.33000000000000063 0.46 0 ...
  • Political Ideology - nebula.wsimg.com

    Political Ideology - nebula.wsimg.com

    Political Ideology. A political ideology is a certain set of ethical ideals, principles, doctrines, myths or symbols of a social movement, institution, class or large group that explains how society should work, and offers some political and cultural blueprint for...
  • HR PAYROLL SYSTEM Originally known as BEACON HR

    HR PAYROLL SYSTEM Originally known as BEACON HR

    Under "My Working Time," you can enter working time and leave, request leave from your supervisor, and view and print your leave quota balances. Remember, ONLY employees at locations that are authorized to enter time/leave shall enter work time and...
  • A research agenda for (youth) violence prevention

    A research agenda for (youth) violence prevention

    VIOLENCE AND SUBSTANCE ABUSE AT A CAPE TOWN TRAUMA CENTRE. Astrid Leusink ,Andrew Nicol, Katherine Sorsdahl, Ross Hoffman, James Burger, Sean Tromp, Patricia Leighton, Robyn Richmond Cathy Ward, Richard Matzopoulos, Pradeep Navsaria, Dan Stein, Guy Lamb.
  • Happy people  Good investments A case of Shared

    Happy people Good investments A case of Shared

    Presentation. My focus today will be on the Shared Care platform, which we have developed in collaboration with IBM because we believe that this platform is a very good investment that leads to happy people.
  • Module 5 - download.microsoft.com

    Module 5 - download.microsoft.com

    A virus hoax is a message warning the recipient of non-existent computer virus threat, usually sent as a chain email that tells the recipient to forward it to everyone they know. This is a form of social engineering that plays...