IDENTIFY – Netwerk

Wireshark 101 | Traffic Analysis and Investigation (PART 03)

This entry is part 17 of 18 in the series Incident Response and Forensics

Views: 2Investigate Tunnelling Traffic: ICMP and DNS Traffic tunnelling is (also known as “port forwarding”) transferring the data/resources in a secure method to network segments and zones. It can be used for “internet to private networks” and “private networks to internet” flow/direction. There is an encapsulation process to hide the data, so the transferred data appear natural … Read more

Wireshark 101 | Traffic Analysis and Investigation (PART 02)

by Bharath Narayanasamy

This entry is part 15 of 18 in the series Incident Response and Forensics

Views: 2Identifying Hosts When investigating a compromise or malware infection activity, a security analyst should know how to identify the hosts on the network apart from IP to MAC address match. One of the best methods is identifying the hosts and users on the network to decide the investigation’s starting point and list the hosts … Read more

TCPDump

by Bharath Narayanasamy

Views: 16Locate tcpdump Install TCPdump Tcpdump Version Validation TCPDump will resolve IPs to hostnames by default. Traffic Captures with Tcpdump Basic Capture Options Switch Command Result D Will display any interfaces available to capture from. i Selects an interface to capture from. ex. -i eth0 n Do not resolve hostnames. nn Do not resolve hostnames … Read more

NIST – IDENTIFY: Categories and Subcategories

by Bharath Narayanasamy

Views: 12Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to business objectives and the organization’s risk strategy.