Case Study : Ann Tunnels Underground

First, let’s talk about Wireshark, it is the most common network packet analyzer used worldwide, perhaps one of the best open source (free) packet analyzers today. It lets you capture and interactively browse the traffic running on a computer network, helping you analyze and manage the traffic in your network. Like a measuring device used to examine what is going on in your network cable, like a voltmeter used by an electrician to examine what is going on inside an electric cable. Therefore, gives you the tools to do in depth network analysis, it will try to capture network packets and display them as detailed as possible for analysis. Furthermore, used for troubleshooting network problems, examine security problems, debug protocol

DNS (Domain Name System) : used to translate the internet protocol services. Stand-alone daemon run by script named.

To measure the performance I used Opsview monitoring solution to monitor both DNS and DHCP on Linux and Windows server. Some sample tools like ping, nslookup and traceroute can be used in Windows and Linux to measure the basic metrics for DNS and DHCP. TO have a real data we need to test inside a real network or with some means generate the amount of traffic near the real traffic to find our network and services' bottlenecks.

The Dynamic Host Control Protocol automatically assigns IP addresses to hosts on a network as they request them. DHCP packets also include information like DNS server addresses, domain names, and default gateways.

Wireshark is an open-source program which enables users to actively capture and interact with the network traffic which is being funnelled through the computer. Commonly, pieces of software which do this are referred to as ‘packet sniffers’ - As the program is recording the packets which pass through the network.

Where can we find evidence in the network? In chapter 12 of our textbook it tells us how to find evidence on the netbook. There are different types of network, where you can find evidence. “The type of evidence that can be retrieved from networks includes full contact data (i.e., the entire contents of packets) and session data (i.e., traffic data.)” Some of these items can be…

This week’s lab builds upon the previous EnCase examination concepts to introduce students to Windows Registry values that can help identify key information within an investigation. To elucidate this, the lab calls for an examination of registry entries within Jane’s (Blacksuit Computing) collected evidence image. Within this image, students are asked to locate key evidence including, the system’s local time zone at acquisition, the location and nature of browser help objects (add-ins), system start-up processes, and a list of first and last devices connected to Jane’s system. Among these, the student is also tasked with analyzing the nature of these items to identify any suspicious activities or entries contained in the evidence.

Answer the following questions based on the packet capture that precedes them. You may research any of these on the Internet if you need to do so.

The first item of the investigation of this file is to determine janes IP address at the time of

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

Hacking has evolved from juvenile’s curious action into serious criminal act. The low cost of computers and ease of accessing internet has allowed proliferation of criminals to use these tools to research and attack their targets. The main goal is criminal exploit and to exploit learn hacking techniques to accomplish goal. The use of electronic devices and internet leave behind digital marks and fortunately criminal first hackers have a difficult time erasing their trail allowing for the savvy digital forensics investigator to collect evidence and locate the criminal.

In 1997 the National Security Agency (NSA) tested the Pentagon’s cyber security in an exercise named “Eligible Receiver”. Within two days of the exercise, the NSA team had penetrated the classified command network and was in complete control of network. Two years later, the United States Air Force experienced a computer breach in which huge amounts of data were being exfiltrated from research files located on airbases. “Gigantic amounts of data were being shipped out from a lot of computers in the Defense Network and from many data systems in the national nuclear laboratories of the Energy Department.” (Clarke, p. 111) File case named “Moonlight Maze”, by the FBI day-lighted two important aspects of information security. Computer specialist

Industrial Hygiene is reviewing working conditions within the St. Paul Tunnel System beneath downtown St. Paul. Work is being scheduled for various parts of the tunnel and workers are expressing concerns over asbestos materials used extensively throughout the system. The material is old and in various states of degradation and due to the tight quarters within the tunnels, options are being explored to try to minimize disturbance of the asbestos material.

Network forensics is the process of collecting and analyzing network traffic to reconstruct an invent. The product of this process is evidence to appoint fault on something or someone. Many computer systems connect via wireless technology. This types of connections are more susceptible to collection due to the nature of the interface in use. Wireless forensics search to collect and analyze different types of protocols traveling over the air. Some of the tools to gather this type of traffic fall under the category of sniffers. The assumption in this paper is that a target computer with a specific user needs to be identify in a wireless network. Wireshark and Kismet are two network sniffers that can identify protocols and

For both the internal and external measurement, depend on the types of parameters, different networks statistic acquisition are exploited. For instance, t Traffic monitoring is a measurement technique where the traffic between the client and the surrogate is monitored to know the actual performance metrics[13]. Network probing is a measurement technique where the possible requesting entities are probed in order to determine one or more metrics from each surrogate or a set of surrogates[13]. Surrogate servers can also send feedback to help acquire the data for CDN. In order to obtain the CDN status information, networks statistic acquisition are employed rely on a number of metrics.