Network Forensics

RIC MESSIER has been program director for various cyber-security and computer forensics programs at Champlain College. A veteran of the networking and computer security field since the early 1980s, he has worked at large Internet service providers and small software companies. He has been responsible for the development of numerous course materials, has served on incident response teams, and has been consulted on forensic investigations for large companies.

• Introduction xxi1 Introduction to Network Forensics 1What Is Forensics? 3Handling Evidence 4Cryptographic Hashes 5Chain of Custody 8Incident Response 8The Need for Network Forensic Practitioners 10Summary 11References 122 Networking Basics 13Protocols 14Open Systems Interconnection (OSI) Model 16TCP/IP Protocol Suite 18Protocol Data Units 19Request for Comments 20Internet Registries 23Internet Protocol and Addressing 25Internet Protocol Addresses 28Internet Control Message Protocol (ICMP) 31Internet Protocol Version 6 (IPv6) 31Transmission Control Protocol (TCP) 33Connection-Oriented Transport 36User Datagram Protocol (UDP) 38Connectionless Transport 39Ports 40Domain Name System 42Support Protocols (DHCP) 46Support Protocols (ARP) 48Summary 49References 513 Host-Side Artifacts 53Services 54Connections 60Tools 62netstat 63nbstat 66ifconfi g/ipconfi g 68Sysinternals 69ntop 73Task Manager/Resource Monitor 75ARP 77/proc Filesystem 78Summary 794 Packet Capture and Analysis 81Capturing Packets 82Tcpdump/Tshark 84Wireshark 89Taps 91Port Spanning 93ARP Spoofi ng 94Passive Scanning 96Packet Analysis with Wireshark 98Packet Decoding 98Filtering 101Statistics 102Following Streams 105Gathering Files 106Network Miner 108Summary 1105 Attack Types 113Denial of Service Attacks 114SYN Floods 115Malformed Packets 118UDP Floods 122Amplifi cation Attacks 124Distributed Attacks 126Backscatter 128Vulnerability Exploits 130Insider Threats 132Evasion 134Application Attacks 136Summary 1406 Location Awareness 143Time Zones 144Using whois 147Traceroute 150Geolocation 153Location-Based Services 156WiFi Positioning 157Summary 1587 Preparing for Attacks 159NetFlow 160Logging 165Syslog 166Windows Event Logs 171Firewall Logs 173Router and Switch Logs 177Log Servers and Monitors 178Antivirus 180Incident Response Preparation 181Google Rapid Response 182Commercial Offerings 182Security Information and Event Management 183Summary 1858 Intrusion Detection Systems 187Detection Styles 188Signature-Based 188Heuristic 189Host-Based versus Network-Based 190Snort 191Suricata and Sagan 201Bro 203Tripwire 205OSSEC 206Architecture 206Alerting 207Summary 2089 Using Firewall and Application Logs 211Syslog 212Centralized Logging 216Reading Log Messages 220LogWatch 222Event Viewer 224Querying Event Logs 227Clearing Event Logs 231Firewall Logs 233Proxy Logs 236Web Application Firewall Logs 238Common Log Format 240Summary 24310 Correlating Attacks 245Time Synchronization 246Time Zones 246Network Time Protocol 247Packet Capture Times 249Log Aggregation and Management 251Windows Event Forwarding 251Syslog 252Log Management Offerings 254Timelines 257Plaso 258PacketTotal 259Wireshark 261Security Information and Event Management 262Summary 26311 Network Scanning 265Port Scanning 266Operating System Analysis 271Scripts 273Banner Grabbing 275Ping Sweeps 278Vulnerability Scanning 280Port Knocking 285Tunneling 286Passive Data Gathering 287Summary 28912 Final Considerations 291Encryption 292Keys 293Symmetric 294Asymmetric 295Hybrid 296SSL/TLS 297Cloud Computing 306Infrastructure as a Service 306Storage as a Service 309Software as a Service 310Other Factors 311The Onion Router (TOR) 314Summary 317Index 319