Hello everyone and welcome to on video of Expert Malware analysis and reverse engineering course. In this 1
video 2
We're going to talk about Packet capture and how we analyzed those packet captures. 3
So the bigger question for us to answer is what exactly is a packet capture packet capture is nothing 4
but a replica of the traffic that is flowing over your network. 5
It can either be to a single device either your laptop or your desktop or it can be a capture 6
of the entire traffic of a network of different machines that are sitting in the network. 7
So why packet captures. 8
There is a popular saying in the information security community or other the network security community 9
that if you do not have packet capture or any security incident you just consider that the incident 10
never happened. 11
And this is said because packet captures can be really vital in investigating any breach or any security 12
incident that might happen inside network. 13
packet capture can give us a very clear indication as to what was the direction in which the traffic 14
flowed. 15
What are the machines that might have been infected you might be able to capture just one machine but 16
there can be many more machines that might have been infected to the same malware. 17
And those things becomes easy to identify if you have the packet captures because the malware definitely 18
be communicating outside with its host. 19
So there will be some other network activity from all the infected machines. 20
And that's where packet captures can be really really useful in determining what all the machines have 21
been infected in the network. 22
And that's packet capture has become one of the most widely resources. 23
When you're doing manual analyses or analyzing any security incident. 24
So what can be the different aspects of packet capture. 25
We can do small scale Packet capturers which basically involves the analysis of any existing protocols. 26
For example if you want to analyze the headers of let's say a DNS protocol and you can do that using 27
any kind of packet capture tool or if let's say you are designing some new protocols or if you are 28
designing the tools that are involved in network communication you can use packet capture for these 29
kinds of activities and there can be large scale packet captures as well. 30
These was traffic analysis and gaining statistics over your network. 31
How much of traffic is flowing within your network. 32
What is the classification of all the traffic and things like that. 33
You can also do a lot of capacity planning using large scale packet captures and you can basically create 34
and implement traffic policies around your network activity by using the capture packets. 35
The third aspect is network attack and the attack prevention and that's where the malware analysis and the 36
incident response people come into picture. 37
So the packet captures can help you in identifying attacks that can help you in designing rules designing 38
policies that can prevent attacks. 39
It can help you in capturing of credentials which are not encrypted. 40
It can also help you in setting up and applying security policies across your network. 41
So one of the considerations for captioning packets we have to make sure that we do not introduce 42
any latency into our network because of our packet capturing because we don't want the network to be 43
slowed down because of the ongoing process of replicating the packet captures in your software or 44
hardware. You'll capture device can only capture traffic that reaches its network interface. 45
You just cannot capture network traffic that is not hitting your interface. 46
For example if you are trying to capture traffic from your laptop you're only going to capture their 47
traffic that in and out of a laptop you cannot really capture the traffic that is flowing in and 48
out of that let's a second laptop that is being used in your home network. 49
The usual behavior of packet capturing is that it will just filter out the traffic that doesn't match 50
an interface address and it only captures the traffic and there is a particular match. 51
So these are some of the considerations for packet captures. 52
Now what are the ways by which the packet capture can be done. 53
There can be two ways. 54
One is hardware oriented where you set up a separate appliance that is capable of capturing the packet 55
in your network. 56
The appliance is basically a custom host with multiple network interfaces. 57
The appliance can be inserted into an existing network link 58
And once it's sitting inside your network it can basically start capturing all the activities that are 59
going on in the network. 60
Most are hardware appliances use software for that analysis. 61
So these hardware tools have lot of analysis capabilities as well. 62
For example they can give you an indication of the amount of traffic that is flowing in and out, what 63
are the classifications of the traffic, which are the top talking hosts inside your network and 64
things like that. 65
So usually for all these kinds of analysis the hardware capturing devices use specialized software that 66
are present inside them. 67
The second type of capturing is software capture where an existing host has captured software installed 68
on the machine and it can help you in capturing the packets without 69
needing any specialized hardware. 70
And one most common example of this is packet capturing tools like 71
tcpdump and wireshark. We'll be going into much more details on software capturing in the later videos. 72
The host interface is operated promiscuously. 73
So what this means is that basically the filtering of packets is completely disabled. 74
So this allows the software packet capturing tool to capture all packets without dropping anything. 75
We have the example of captures scenarios. 76
So if you look here's the diagram on the entire of the left is basically an hardware captioning scenario 77
where you have a separate hardware that sits at the entry point of network. 78
The data basically enters from the left it goes into the hardware where you have a three-port bridge from there, 79
the copy of the packet capture received onto the disk and then there is an analyzer software that 80
does the networking analysis work and after that the traffic basically goes into the network. On the 81
right hand side if you look at the top. 82
It's basically normal 83
capturing scenario where promiscuous mode is not enabled. 84
So you are basically bridging the network and the host so that whatever traffic comes in and goes out 85
gets basically captured. 86
Something similar happens in the promiscuous mode as well. 87
There you have a software based packet capturing where you are again bridging your interface and your 88
host to intercept all the traffic that goes in and out. 89
So this was just a quick presentation of how exactly the packet capture can happen in different scenarios. 90
We will be more focusing on a local software packet capturing scenarios and the same concepts and same 91
ideas can be implemented on large scale hardware captures as well. 92
So one tool that is very helpful in packet capture that is Wireshark. 93
It's a free protocol analyzer software that is available for both Windows and Linux platforms. 94
And in the later videos we'll start going into much more details of Wireshark and how to set it up in 95
our virtual environment and how we can begin capturing by using it. 96
So there's sort of a quick introduction to packet captures. 97
That's it for this video. 98
Thanks a lot for watching.