Network Traffic Analysis Using tcpdump, Wireshark, and Snort for Security Assessment

Practical Implementation of tcpdump

Execute packet capture using tcpdump to monitor traffic during access to www.163.com. The objective involves determining how many distinct web servers are contacted and their respective IP addresses.

The analysis revealed 7 unique server IP addresses were accessed during the homepage retrieval process. This was accomplished by configuring the tool to capture packets on the primary network interface while monitoring specific protocols used by web browsers.

Command executed:

sudo tcpdump -n -i eth0 src 192.168.200.4 and 'tcp port 80 or tcp port 443' and 'tcp[13] & 2 != 0'

Wireshark Analysis of Telnet Protocol

Capture and analyze Telnet communication when connecting to a BBS server. Using the example server bbs.mysmth.net on port 23, the connection process demonstrates clear text vulnerability.

Execution command:

telnet bbs.mysmth.net 23

After establishing the conenction with guest credentials, the captured data shows the username transmission in plain text. The actual character sequence transmitted appears as gguueesstt, demonstrating how each character gets duplicated during the negotiation phase.

Filtering for telnet protocol and tracking the TCP stream reveals all communication in ASCII format. The Wireshark interface allows right-click selection to follow TCP streams, displaying the complete conversation between client and server.

Forensic Analysis of Network Scanner Activity

Analyze the provided capture file listen.cap to extract information about scanning activities.

Attacking Host Identification

Filter TCP packets to identify scanning activity. The attacker's IP address is 172.31.4.178, while the target host is 172.31.4.188. The scanning pattern indicates SYN-based reconnaissance activity.

Target IP Address

The scanned host has IP address 172.31.4.188, which represents the intended victim system.

Scanner Tool Identification

Analysis combining port_scan and wizard module signatures reveals characteristics consistent with Nmap's -sS (stealth scan) functionality. The evidence includes 67,657 SYN packets sent, 83 SYN-ACK responses received, and 67,549 RST responses, indicating extensive port scanning activity typical of Nmap's half-open scanning method.

Scanning Methodology

The attack vector employs TCP SYN stealth scanning, characterized by sending SYN packets without completing the three-way handshake. Key metrics show:

• syns: 67657 (SYN packets sent)
• syn_acks: 83 (SYN-ACK responses received)
• rsts: 67549 (RST packets received)
• fins: 72 (FIN packets, minimal completed connections)

This approach provides rapid enumeration while avoiding full connection establishment, making detection more difficult.

Target ports were systematically enumerated across the spectrum of commonly used services.

Open Ports on Honeypot System

Apply filter ip.src == 172.31.4.188 && ip.dst == 172.31.4.178 && tcp.flags.syn == 1 && tcp.flags.ack == 1 to identify responsive services. Extract source ports from filtered results to determine open services:

21, 22, 23, 25, 53, 80, 139, 445, 3306, 5432, 7021, 7421, 8009, 8180

These represent active services responding to the scanning activity.

Attacker Operating System

Utilize p0f fingerprinting tool for OS identification:

Installation command:

sudo apt install p0f

Analysis command:

p0f -r listen.pcap

Results indicate the initiating host 172.31.4.178 runs Linux kernel version 2.6.x, determined through TCP stack fingerprinting techniques.

Installation and Configuration of Snort

Update package repositories and install Snort security monitoring platform:

sudo apt update && sudo apt install snort -y

Address potential GPG key issues:

wget -qO - https://archive.kali.org/archive-key.asc | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/kali-archive-keyring.gpg

Snort operates in multiple modes including packet logging, real-time analysis, and intrusion detection. The tool analyzes network traffic patterns to identify suspicious activities, scanning attempts, and potential security breaches through rule-based detection mechanisms.