GCS 6-2: Response-Network

Google Cybersecurity Course 6 (Sound the Alarm: Detection and Response) Module 2 (Network monitoring and analysis)

Clearly summarize what you are trying to say

1st important soft skills in cybersecurity

Work with an open mindset

2nd important soft skill in cybersecurity

Leave no stone unturned

3rd important soft skill in cybersecurity

Network traffic

The amount of data that moves across a network.

Network data

The data that’s transmitted between devices on a network.

Indicators of compromise

Aka IOC.

IOC

Observable evidence that suggests signs of a potential security incident.

Data exfiltration

Unauthorized transmission of data from a system.

Baseline

A reference point that’s used for comparison.

command and control

Aka C2.

C2

Techniques used by malicious actors to maintain communications with compromised systems.

Security operations center

Aka SOC

Network operations center

Aka NOC.

NOC

An organizational unit that monitors the performance of a network and responds to any network disruption, such as a network outage.

Intrusion detection system

Aka IDS.

Network protocol analyzer

Aka packet sniffer.

Packet sniffer

Tools designed to capture and analyze data traffic within a network. They can be use to analyze network communications manually in detail.

Data exfiltration defensive measures

1. Prevent attacker access

2. Monitor network activity

3. Protect assets

4. Detect and stop the exfiltration

Lateral movement

When an attack spends time exploring the network with the goal of expanding and maintaining their access to other systems on the network.

Header, Payload, Footer

Components of a packet

Packet capture

Aka P-cap.

P-cap

A file containing data packets intercepted from an interface or network.

data packet

A basic unit of information that travels from one device to another within a network.

tcpdump, Wireshark, TShark

packet sniffer examples

Network interface card

Aka NIC

NIC

Hardware that connects computers to a network, like a router. They receive and transmit network traffic, but by default they only listen to network traffic that’s addressed to them. To capture all network traffic that is sent over the network, it must be switched to a mode that has access to all visible network data packets.

Monitoring mode

In wireless interfaces, this is a mode where all traffic that sent over a network is captured.

Monitoring mode

Aka promiscuous mode.

Libpcap, WinPcap, Npcap, PCAPng

P-cap libraries and format examples

Libpcap

A packet capture library designed to be used by Unix-like systems, like Linux and MacOS. Tools like tcpdump use this library as the default packet capture file format.

WinPcap

An open-source packet capture library designed for devices running Windows operating systems. It’s considered an older file format and isn’t predominantly used.

Npcap

A library designed by the port scanning tool Nmap that is commonly used in Windows operating systems.

PCAPng

A modern file format that can simultaneously capture packets and store data. Its ability to do both explains the “ng,” which stands for “next generation.”

Version

A header that indicates the version of the protocol contained in the packet.

Internet header length.

Aka IHL

IHL

A header field that specifies the length of the header plus any Options.

Type of Service

Aka ToS.

ToS

A header field that tells us if certain packets should be treated with different care. For example, think of this field like a “Fragile” sticker on a mail package.

Total Length

A header field which identifies the length of the entire packet, including the headers and the data. This can be compared to the dimensions and weight of an envelope.

Identification, Flags, Fragment Offset

3 header fields that deal with information related to fragmentation.

Fragmentation

When an IP packet gets broken up into chunks, which then get transmitted over the wire and reassembled when they arrive at their destination.

Identification

Packets that are too large to send are fragmented into smaller pieces. This header field specifies a unique identifier for fragments of an original IP packet so that they can be reassembled once they reach their destination.

Flags

A header field that provides information about packet fragmentation including whether the original packet has been fragmented and if there are more fragments in transit.

Fragment Offset

A header field used to identify the correct sequence of fragments.

Time To Live

Aka TTL.

TTL

A header field that determines how long a packet can live before it gets dropped. Without this field, packets could loop through routers endlessly. It is similar to how tracking information provides details about an evelope’s expected delivery date.

Protocol

A header field that specifies the protocol used by providing a value which corresponds to a protocol.

6

The number that represents the TCP protocol.

Header Checksum

A header field that stores a number which is used to determine if any errors have occurred in the header.

Source Address

A header field that specifies the source IP address.

Destination Address

A header field that specifies the destination IP address.

Options

A header field that is not required and is commonly used for network troubleshooting rather than common traffic. If it’s used, the header length increases.

Internet Protocol

Aka IP.

IP

A set of standards used for routing and addressing data packets as they travel between devices on a network. It operates as the foundation for all communications over the internet.

IPv4

The most commonly used version of IP.

13

IPv4 has ____ header fields.

IPv4 Headers

1. Version

2. IHL

3. ToS

4. Total Length

5. Identification

6. Flags

7. Fragment Offset

8. TTL

9. Protocol

10. Header Checksum

11. Source Address

12. Destination Address

13. Options

IPv6

A IP version that has been increasing because of its large address space.

8

IPv6 has ____ header fields.

IPv6 headers

1. Version

2. Traffic Class

3. Flow Label

4. Payload Length

5. Next Header

6. Hop Limit

7. Source Address

8. Destination Address

Traffic Class

A header field similar to IPv4 Type of Service field. It provides information about the packet’s priority or class to help with packet delivery.

Flow Label

A header field that identifies the packets of a flow. A flow is the sequence of packets sent from a specific source.

Next Header

A header field that indicates the type of header that follows the IPv6 header such as TCP.H

Hop Limit

A header field similar to IPv4 Time To Live field. It limits how long a packet can travel in a network before being discarded.

Wireshark

An open-source network protocol analyzer. It uses a GUI, which makes it easier to visualize network communications for packet analysis purposes.

graphical user interface

Aka GUI.

eq

Equal operator abbreviation

==

Equal operator symbol

!=

Not equal symbol

ne

Not equal abbreviation

>

Greater than symbol

gt

Greater than abbreviation

<

Less than symbol

lt

Less than abbreviation

>=

Greater than or equal to symbol

ge

Greater than or equal to abbreviation

<=

Less than or equal to symbol

le

Less than or equal to abbreviation.

contains

Operator used to filter packets that contain an exact match of a string of text.

matches

Operator used to filter packets based on regex that’s specified.

Regular expression

Aka regex.

Regex

A sequence of characters that form a pattern.

dns, http, ftp, ssh, arp, telnet, icmp

Filterable protocols in packet sniffer.

ip.addr == 172.21.224.2

filter for packets that contain the specific IP address 172.21.224.2

ip.src == 10.10.10.10

filter for packets originating from the specific source IP address 10.10.10.10

ip.dst == 4.4.4.4

filter packets delivered to the specific destination IP address 4.4.4.4

Media Access Control address

Aka MAC address

udp.port == 53

filter for UDP port 53

sudo tcpdump -i any -v -c 1

command for capturing 1 packet from any interface using tcpdump in verbose mode with a user that does not permission to run tcpdump.

-vvv

flag for getting the most verbose version of a packet in tcpdump

command-line interface

Aka CLI.

CLI

A text-based user interface that uses commands to interact with the computer.

IDS

An application that monitors system activity and alerts on possible intrusions.

MAC Address

A unique alphanumeric identifier that is assigned to each physical device on a network.

National Institute of Standards and Technology

Aka NIST

NIST Incident Response Lifecycle

A framework for incident response consisting of four phases: Preparation; Detection and Analysis; Containment, Eradication and Recovery; and Post-incident activity.

Packet sniffing

The practice of capturing and inspecting data packets across a network.

Playbok

A manual that provides details about any operational action.

Root user

Aka superuser.

Root user

A user with elevated privileges to modify the system.