n Describe sniffing concepts, including active and passive sniffing n Describe sniffing countermeasures n Describe signature analysis within Snort

Size: px

Start display at page:

Download "n Describe sniffing concepts, including active and passive sniffing n Describe sniffing countermeasures n Describe signature analysis within Snort"

Marjorie Carol Bates
5 years ago
Views:

1 Outline n Describe sniffing concepts, including active and passive sniffing and protocols susceptible to sniffing n Describe ethical hacking techniques for Layer 2 traffic Chapter #4: n Describe sniffing tools and understand their output n Describe sniffing countermeasures n Learn about intrusion detection system (IDS), firewall, and honeypot types, use, and placement n Describe signature analysis within Snort n Describe IDS, firewall, and honeypot evasion techniques 2 Phases of Hacking Essentials n Sniffing (also known as wiretapping) is the art of capturing packets as they pass on a wire, or over the airwaves, to review for interesting information n This information could simply be addresses to go after or information on another target n It can also be as high value as a password or other authentication code 3 4 1

2 Network Terms Network Terms n Node Any device, including routers and hosts, which runs n LAN segment A portion of a subnet consisting of a single an implementation of IP medium that is bounded by bridges or Layer 2 switches n Router A node that can forward IP packets not explicitly n Subnet One or more LAN segments that are bounded by addressed to itself On an IPv6 network, a router also typically advertises its presence and host configuration routers and use the same IP address prefix n Network Two or more subnets connected by routers information Another term for network is internetwork n Host A node that cannot forward IP packets not explicitly n Neighbor A node connected to the same subnet as addressed to itself (a non-router) A host is typically the another node source and the destination of IP traffic 5 6 Network Terms Network n Interface The representation of a physical or logical n NIC attachment of a node to a subnet Eg physical interface is n they are designed to pay attention only to unicast messages a NIC; logical interface is a tunnel interface that is used to addressed appropriately, multicast messages, or broadcast send IPv6 packets across an IPv4 network messages n it sees all the messages but only pulls its own n Address An identifier that can be used as the source or n for sniffing it needs to work in promiscuous mode destination of IP packets and that is assigned at the n needs a special driver to do that Internet layer to an interface or set of interfaces n Packet The protocol data unit (PDU) that exists at the Internet layer and comprises an IP header and payload 7 8 2

Network Network Models n Ethernet runs with

negotiating time to talk based on Carrier

(CSMA/CD) n NIC will only act on unicast

3 Network Network Models n Ethernet runs with multiple systems sharing a wire and negotiating time to talk based on Carrier Sense Multiple Access/Collision Detection (CSMA/CD) n NIC will only act on unicast messages addressed for the router shared media/hub host, and broadcast/multicast messages for the subnet A B C 9 A B C 10 TCP Packet Header 11 IP Packet Header 12 3

4 ARP ARP n ARP s entire propose is to resolve IP addresses to machine n Attackers can change cached info by sending something (MAC) addresses called a gratuitous ARP n Works on a broadcast basis n It is a special packet that updates the ARP cache of other systems before they even ask for it before they send an n Cache is dynamic updates, deletes ARP_REQUEST ARP Preparation for next class n VMWNinja2 n metasploit change phpinfophp n Exercise with Wireshark n Change of network card configuration -> advanced -> mirroring n set WinXP to source n set Kali to destination

7 There is no 100 percent secure system, and there is nothing that is foolproof! Stay Alert! 25 7

Introduction to Computer Networks. CS 166: Introduction to Computer Systems Security

Introduction to Computer Networks CS 166: Introduction to Computer Systems Security Network Communication Communication in modern networks is characterized by the following fundamental principles Packet