The document is an introduction to network forensics presented by Laura Chappell at the SHARKFEST '08 conference from March 31 to April 2, 2008. It discusses case studies of network intrusions including a company being locked out on Thanksgiving from a foreign country and examining unusual network traffic to identify data leaks. It also covers topics like where to find evidence of reconnaissance like port scans and OS fingerprinting, evidence of attacks like unusual connection pairs, and reviewing peculiar traffic patterns in trace files to identify infections. The document recommends resources for network forensic signatures and provides information on obtaining Laura's Lab Kit v9 with sample packet captures and

1. An Introduction to
Network Forensics
Identifying Reconnassance and Attack
Processes on the Network
Laura Chappell
Founder | Wireshark University
SHARKFEST '08
Foothill College
March 31 - April 2, 2008
SHARKFEST '08 | Foothill College | March 31 - April 2, 2008

2. Case Studies
1. Company servers ‘locked down’ on Thanksgiving morning; traffic
paths indicate tunnel into network from a foreign country
2. Network traffic to and from the compromised host revealed a back
back-
channel and the propagator of the malicious code
3. Excessive outbound traffic alerted the staff to a possible data leak;
examination of the data flow and the target confirmed the leak
4. Unique peer-to-peer data flow prompted the IT team to investigate;
peer
the investigation revealed improper network use, but no security leak

3. Tap-In Points
Tap-in points
Hub networks: Easy
Switch networks: Issues
Routed networks: Issues
Full-duplex: Issues

4. Evidence of Reconnaissance
UDP scans
TCP scans IP scans (excessive
(excessive ICMP
(excessive RSTs) ICMP Type 3/Code 2)
Type 3/Code 3)
OS
fingerprinting Address scans (‘dark
(ICMP type 13, 15 Application scans
IP’ or ‘dark MAC’
and 17) (unusual responses)
hits)
Download the free ICMP protocol poster:
www.packet-level.com/downloads.htm
level.com/downloads.htm

5. Evidence of Attacks and Breaches
Unusual communication pairs
Unusual protocols and ports
Excessive failed connections
Unusual inbound connections
Unusual outbound
connections
Peer-to-
Peer-to-peer traffic paths

6. Reviewing Unusual Traffic
bootup-infection.pcap (not a public trace file)
nmap-ipscan.pcap (LLK9)
active-scan.pcap (LLK9)
sick-client.pcap (LLK9)
Signature information:
www.snort.org
www.bleedingthreats.net

7. What’s Next?
Laura’s Lab Kit v9
In show bags as well as…
ISO image: www.novell.com/connectionmagazine/laurachappell.html