Identifying Network Signatures from Packet Captures

Summary

• Signature analysis, brief introduction to the Snort IDS, analysis of ICMP packet capture, common TCP/UDP ports, network baselining, the TCP 3-way handshake, and review of TCP flags.

Video 

Right click and 'Save As...'

• https://dl.dropbox.com/u/1546231/4663_network_signatures.mp4 
• 3:26 - Example of Snort IDS rules
• 9:45 - md5sum usage
• 14:45 - ifconfig command in Linux
• 15:22 - Using tcpdump for packet capturing
• 17:05 - Viewing packet captures with tcpdump
• 20:09 - Examining ICMP packet captures
• 20:54 - Using ipconfig in Windows
• 23:20 - Well known port numbers
• 27:19 - Examining the TCP 3-way handshake in packet captures
• Wireshark How-to 
• Wireshark filters 

Resources

• Windump and Winpcap (if you *really must* use Windows)

Reference Materials

• Guide to Network Defense and Countermeasures - Chapter 4
• Wireshark 1.9 manual 
• The Great Debate: Network vs Protocol Analysis

Additional Information

All Course Lectures