Network forensics overview

Introduction

Network forensics in a nutshell is the combined activities regarding capturing, recording, and analyzing network packets in order to determine the source of attacks.

Steps of network forensic examinations

·        Identification

·        Preservation

·        Collection

·        Examination

·        Analysis

·        Presentation

·        Incident Response

Types of analysis performed on network level:

·        Data-link and physical layer (Ethernet)

Methods are achieved with eavesdropping bitstreams on the Ethernet layer of the OSI model. Monitoring tools or network sniffers such as Wireshark or Tcpdump are used. These help to capture traffic data from a network card interface configured in promiscuous mode.

·        Transport and network layer (TCP/IP)

Network layer provides router information from routing table present as well as log evidence. These help a great deal in providing information on compromised packets, identifying sources etc.

·        Traffic examined based on internet

The internet is a rich source of digital evidence, which can be identified via checking logs of servers deployed on the internet

Network forensics tools & resources and their abilities:

·        Network traffic capturing and analysis

·        Evaluation of network performance

·        Detection of anomalies and misuse of resources

·        Determination of network protocols in use

·        Aggregating data from multiple sources

·        Security investigations and incident response

·        Protection of intellectual property

Some network forensics tools are listed below such as:

General-purpose tools

·        Packet sniffers- dumpcap, pcapdump, and netsniff-ng. These help record packets from the network

·        Protocol analyzers- tcpdump, wireshark/tshark and tstat. These help inspect recorded traffic.

·        Network Forensic Analysis (NFAT) tools -Xplico and NetworkMiner. These help analyze the traffic content.

Specific Tasks Tools

·        Extract SSL information (ssldump)

·        Intrusion detection tools (snort, suricata, bro)

·        Match regular expressions (ngrep)

·        Extract emails artifacts (mailsnarf, smtpcat)

·        Print network/packet statistics (ntop, tcpstat, tstat)

·        Reconstruct TCP flows (tcpflow, tcpick)

·        Fingerprinting (p0f, prads)

·        Extract files (nfex) or pictures (driftnet)

·        Sniff passwords over HTTP sessions (dsniff, firesheep, ettercap, creds)

·        Libraries and Frameworks

·        Python libraries(Libpcap, Scapy)