Scribd Logo
Upload

Welcome to Scribd!

  • 25 views

    Abcde-Presentation 6708 1572241150

    Uploaded by

    Charles Oliveira
    This document provides an overview of packet analysis for network incident response using MikroTik RouterOS. It discusses why packet analysis is useful, how to capture packets both in-band and out-of-band using tools like port mirroring and TZSP streaming. It also covers analyzing captured packets using Wireshark, including filtering, fetching messages, and exporting objects. Examples of analyzing floods using different protocols are also presented. The document concludes by offering help from the author to analyze packets.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Abcde-Presentation 6708 1572241150

    Uploaded by

    Charles Oliveira
    25 views36 pages
    This document provides an overview of packet analysis for network incident response using MikroTik RouterOS. It discusses why packet analysis is useful, how to capture packets both in-band and out-of-band using tools like port mirroring and TZSP streaming. It also covers analyzing captured packets using Wireshark, including filtering, fetching messages, and exporting objects. Examples of analyzing floods using different protocols are also presented. The document concludes by offering help from the author to analyze packets.

    Original Title

    abcde-presentation_6708_1572241150

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document provides an overview of packet analysis for network incident response using MikroTik RouterOS. It discusses why packet analysis is useful, how to capture packets both in-band and out-of-band using tools like port mirroring and TZSP streaming. It also covers analyzing captured packets using Wireshark, including filtering, fetching messages, and exporting objects. Examples of analyzing floods using different protocols are also presented. The document concludes by offering help from the author to analyze packets.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    25 views36 pages

    Abcde-Presentation 6708 1572241150

    Uploaded by

    Charles Oliveira
    This document provides an overview of packet analysis for network incident response using MikroTik RouterOS. It discusses why packet analysis is useful, how to capture packets both in-band and out-of-band using tools like port mirroring and TZSP streaming. It also covers analyzing captured packets using Wireshark, including filtering, fetching messages, and exporting objects. Examples of analyzing floods using different protocols are also presented. The document concludes by offering help from the author to analyze packets.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 36

    Michael Takeuchi

    Practical Packet Analysis for


    Network Incident Response
    with MikroTik RouterOS
    25 October 2019, Kuta Bali
    MikroTik User Meeting Indonesia
    Hello, I am Michael Takeuchi
    MikroTik Certified Engineer & Consultant from Jakarta, Indonesia
    https://www.linkedin.com/in/michael-takeuchi
    https://www.facebook.com/mict404
    michael@takeuchi.id
    Why Packet Analysis?

    Contoso Ltd.
    3
    Why Packet Analysis?

    ○ Information of 5W + 1H ○ Action/Decision
    • What • Fix
    ▪ DDoS? Spam? Flood? • Stop
    • Who • Deny
    ▪ Router? PC? Server?
    • When
    ▪ Now? Yesterday?
    • Where
    ▪ AS? Network?
    • Why
    ▪ Virus?
    • How
    ▪ TCP? UDP?

    Contoso Ltd.
    4
    Who do Packet Analysis?

    ○ Researchers: Access to RAW Data


    ○ Administrator: Debugging Network Problems
    ○ Analyst: Analyze the Traffic
    ○ Incident Responders: Tracing the Incident

    Contoso Ltd.
    5
    How We Do Packet Analysis?

    CAPTURE & ANALYZE

    Contoso Ltd.
    6
    Capturing Packets

    ○ Also known as SNIFFING


    ○ PCAP is the common format of Packet Capture
    ○ Perspective is Important
    • In-band
    • Out-band

    Contoso Ltd.
    7
    In-Band Capturing Packets/Sniffing

    Network
    Devices

    Hacker User

    Contoso Ltd.
    8
    Out-Band Capturing Packets/Sniffing
    Port Mirroring/TZSP Streaming

    Network
    Devices

    Hacker User

    Contoso Ltd.
    9
    Out-Band Capturing Packets/Sniffing
    X Port Mirroring/TZSP Streaming

    HUB

    Hacker User

    Contoso Ltd.
    10
    Capturing Packets in MikroTik – HTTP

    /tool sniffer
    set file-name="example.pcap"
    set file-limit="1000"
    set filter-ip-protocol="tcp"
    set filter-port="80"
    start
    /file print where name="example.pcap"

    Contoso Ltd.
    11
    Capturing Packets in MikroTik – HTTP

    Contoso Ltd.
    12
    Capturing Packets in MikroTik – HTTP

    Contoso Ltd.
    13
    Capturing Packets in MikroTik – Storage Expense

    Expense storage quickly!!!


    ○ 10Mbps * 3600 (second) * 24 (hours) = 864000Mb
    ○ 864000Mb / 8 = 108000 Megabyte for 1 Day
    10Mbps Bandwidth need 100+ Gigabyte storage for 1 Day
    Double for full-duplex (200+ Gigabyte)
    How big is your storage?

    Solution? Use Out-Band Capturing Packets/Sniffing method


    with Port Mirroring, TZSP Streaming or use HUB

    Contoso Ltd.
    14
    Capturing Packets in MikroTik – Port Mirroring

    ○ Port Mirroring is Switch Chip Feature


    ○ MikroTik devices without switch chip can’t do Port Mirroring
    /interface ethernet switch
    set switch1 mirror-source=ether2
    set switch1 mirror-target=ether3

    Contoso Ltd.
    15
    Capturing Packets in MikroTik – TZSP Configuration

    /tool sniffer
    streaming-server=ip.of.wireshark.box
    set streaming-enabled=yes
    start

    TZSP is run on UDP/37008, you can listen on UDP/37008 with your


    sniffing tools like wireshark (will introduced more in analyze step)
    Contoso Ltd.
    16
    Capturing Packets in MikroTik – TZSP Configuration (Alt.)

    /ip firewall mangle


    add action=sniff-tzsp chain=prerouting
    sniff-target=ip.of.wireshark.box
    sniff-target-port=port.of.wireshark.box

    By default TZSP is run on UDP/37008, so you can listen on


    UDP/37008 with your sniffing tools like wireshark
    (will introduce wireshark more in analyze step)
    Contoso Ltd.
    17
    Capturing Packets in MikroTik – Done

    Are you done?


    Let’s continue to analyze the PCAP!

    Contoso Ltd.
    18
    Analyzing Packets – Fire On The Tools

    Fire on your tools:


    • Wireshark
    ▪ Open Source (GNU Public License)
    ▪ Multi-Platform (Windows, Linux, *BSD & MacOS)
    ▪ Advanced Filtering & Analyzing
    ▪ Used for Live Sniffing & Packet Analysis
    • Some people use Wireshark for:
    ▪ Network Administrators: troubleshoot network problems
    ▪ Network Security Engineers: examine security problems
    ▪ Developers: debug protocol implementations
    ▪ Peoples: learn network protocol internals
    Contoso Ltd.
    19
    Analyzing Packets – Getting Started with Wireshark

    ○To getting started with wireshark you can open the pcap file
    that you have from capturing packets

    Contoso Ltd.
    20
    Analyzing Packets – Getting Started with Wireshark

    ○Or you can capture the new packets ☺

    Contoso Ltd.
    21
    Analyzing Packets – Wireshark Interfaces

    Contoso Ltd.
    22
    Analyzing Packets – Packet Filtering

    ○We can filter specific packet type in wireshark

    ○You can check the cheat sheet on


    http://packetlife.net/media/library/13/Wireshark_Display_Filters.pdf

    Contoso Ltd.
    23
    Analyzing Packets – Fetching a Messages

    Contoso Ltd.
    24
    Analyzing Packets – Fetching a Messages

    ○Now we got a messages


    from email ☺ and now we
    can analyze the email

    Contoso Ltd.
    25
    Analyzing Packets – Exporting Object (PDF, JPG, PNG, etc.)

    Contoso Ltd.
    26
    Analyzing Packets – Flood Example (DNS)

    Contoso Ltd.
    27
    Analyzing Packets – Flood Example (TELNET)

    Contoso Ltd.
    28
    Analyzing Packets – Flood Example (WINBOX)

    Contoso Ltd.
    29
    Analyzing Packets – Flood Example (SMB)

    Contoso Ltd.
    30
    Analyzing Packets – Wireshark Reference

    ○Wireshark Website
    http://www.wireshark.org
    ○Wireshark Documentation
    http://www.wireshark.org/docs/
    ○Wireshark Wiki
    http://wiki.wireshark.org
    ○Network analysis Using Wireshark Cookbook
    http://www.amazon.com/Network-Analysis-Using-
    WiresharkCookbook/dp/1849517649

    Contoso Ltd.
    31
    Study Case – Parabot OpenIXP

    ○ OpenIXP is one of the biggest Internet


    Exchange in Indonesia
    ○ and Parabot, a Bot in Telegram that
    brewed by @ericksetiawan and the
    Infrastructure was provided by
    @mtakeuchi using MikroTik RouterOS
    as a Probe & BGP router in OpenIXP,
    also Powered by Maxindo Networks
    ○ Parabot help to notify us when the
    router receiving broadcast or flood on
    OpenIXP interface
    ○ Parabot will do Torch and start Packet
    Sniffer on your Router

    Contoso Ltd.
    32
    Conclusion

    Secure ≠ Easy
    Contoso Ltd.
    33
    Feel so hard to analyze?
    Let me help you!

    michael@takeuchi.id
    https://www.facebook.com/mict404
    https://www.linkedin.com/in/michael-takeuchi/

    Contoso Ltd.
    34
    Question & Answer

    Contoso Ltd.
    35
    Slide is available in my GitHub repository
    https://github.com/mict404/slide/

    Contoso Ltd.
    36
    Add a footer

    You might also like