Let's start out this module by noting that we are basing our
instruction on the scenario that was covered in our Performing
Packet Sniffing Actions with Scapy module.
If you have just jumped into this module and want to review this scenario,
check out that quickly before moving forward.
So with that noted, with the previous module,
we covered how to collect information from the network
live and via a previous capture file.
With this module, we move on from this and assume you either have the packets
that you want to extract information from and/or you are ready to build new
packets based on either this information or want to perform a specific task
requiring the knowledge to build packets.
So why do you need this knowledge? As a networking security
professional, one of the many duties that you need to perform is
analyzing the networking traffic that is being transferred to and from
the different hosts that you are responsible for.
Sometimes this is done for you with the various networking security
appliances that can be deployed and sometimes things slip through these
because either those systems are configured correctly or the vector is new
and not able to be identified by them yet.
This is where tools like Python and Scapy, among others, can be used.
So to that end, with this section, we will run through how Scapy can
be used to display the information that was previously collected. To
do this, we will review several of the common commands and methods
that are available.
These will include show, summary, nsummary, hexdump,
filter, ls, show2, and sprintf.
Now let's run through these quickly.
The show method is used to display a representation of the
input variable or as a method of a variable.
The output will differ depending on the specific type of
the variable being referenced with copy.
There are a couple of different types that can be seen.
These include one specific to a packet type,
for example, in Ethernet packet, one specific to a list of packets.
This is common when performing a packet capture and one that
is specific to a send and receive list.
The summary method is used to display a summary of the packets
that are contained within the reference variable.
then summary method is a similar output to the summary,
but with the packet number appended to the beginning of the list.
The hex dump method can be used on packet lists or on send and receive
list to display the variable in a hex dump format,
similar to what you would see in the bytes pain of Wireshark The hex
dump command can be used to display a similar looking output for
individual packet variables referenced.
The filter method is used to parse the contents of a packet or a
send and receive list with a lambda function and output The
results If not piped into a variable.
The output will be shown on screen If piped into a variable.
This variable can then be further parsed with the other
commands and methods discussed here.
The LS command can be used to display the contents of a packet
variable split into the individual fields,
field types and field contents.
It is important to properly reference the packet view to have this work
correctly as it does not work on any type of packet list.
More information on this will be discussed in a few slides.
The show to method is used to display an assembled packet view.
This is often used when creating new packets.
As the show method will display a pack its contents
without calculated fields like checksum.
The show to method will calculate the checksum based on
the current contents of the packet and the final method
that we will discuss is Sprint.
F.
This method is used to format a variable based on a set of directives
that are similar to the class print F formatting,
for example, to output the TCP source ports of every packet in a list.
You would use the command shown here where the variable is referenced
inside the quotes with an opening and closing ampersand in this case TCP
dot esports references the intended field.
This is often used when you want to display information in a
specific format when looking for a pattern.
The last thing that we want to review in this section is
about how to reference specific packets inside the different
common variable types for packets.
You could use the discussed packet methods covered directly.
For example, if a was an ethernet packet type,
you could use the a dot show command to show the contents of the packet.
Or you could use the L.
S.
A.
Command to display the same information but in a different format,
if a was a packet list that contained multiple
packets for example from a capture,
then you can reference the individual packets by using a bracketed notation.
So a bracket zero would reference the first packet And a bracket
one would reference the second packet and so on.
If a was a send and receive list of packets,
then each line entry contains a list of the successful sent and
received packets referred to as results as well as a list of the
unanswered packets sent for reference the first exchanges
successful sent and received packets could be referenced using
response bracket zero bracket zero.
And to reference the first unsuccessful packet,
you would use response bracket one brackets zero.
It is important to understand the specific type of variable.
You are referencing to ensure you get the expected response.
The specific successful exchange packets from results can also
be referenced using an additional index.
For example,
the second successful sent packet could be referenced as response bracket zero
bracket one brackets zero and the second successful response would be referenced
as response bracket zero bracket one bracket one.
It is also possible to reference the same information but split into
two different variables depending on the specific command being used
as shown in the figure when this is done,
the number of indexes required are lowered in place of
different variable reference names.
In the next module we will cover the commands that can be
used to send and receive traffic on the network that will
result in this type of packet list.
Another thing that we want to add before finishing up
is a note of the Wireshark command.
While Skopje is a very flexible, easy to use and code module,
it isn't always the easiest way to see all of the data
captured when attempting to perform analysis.
Wireshark is a well respected and free sniffing,
GUI that is often used and because of this,
scabby provides a way to view the contents of a variable directly
within Wireshark by using the Wireshark command.
The input into this command is any of the variables discussed in this section.
So now to finish up,
how can this knowledge help you in your duties as a
Globomantics Network security, engineer.
The ability to capture the traffic that is being exchanged
on your networks is important and was covered in the
previous module in this section.
We covered how to display this information in multiple ways
with your knowledge of network security and methods that are
used by various attack types.
This information can be used to isolate the attack,
find out what it is attempting to do and then test your hypothesis on lab
equipment and then block it for being used in our next section,
we will be moving into our demonstration environment and showing
how each of these different commands can be used and a review of
the expected output from them.