Info Security Lab 4

An alternative free network analyzer (Packet Sniffer) application available is Capsa it allows you to monitor network traffic, troubleshoot network issues and analyze packets. Teachers and students of network classes use it to demonstrate network

The penetration tools provided in this document allow us to review our network from a security standpoint. This paper focused predominantly on phase two of a penetration test, the exploitation phase; however, a successful penetration test typically starts with the reconnaissance phase. In this phase, the tester attempts to gain as much information about the target company and its network as possible. He or she will test the physical infrastructure (how do people gain access to the building?) and other organizational aspects of the company to find a weakness and a way to get in. Also during this portion of the test, the penetration tester will use tools such as NMAP, whois.com, and other resources to obtain information regarding the network

1. Which tool is better at performing protocol captures and which tool is better at performing protocol analysis? The best tool for protocol captures is Wireshark. The best tool for protocol analysis is Netwitness.

SECTION IV: ( 2 points) Using the 100 Tips for Wireshark document from Laura Chappell, outline your favorite 2 tips and outline when and how you would use them to troubleshoot a network problem. Write at least 3 sentences on each tip you select to profile. Each outline is worth1 points each.

IP sniffing can be used for detecting intrusions on the network. Like the administrator can analyze the traffic and can detect if an unauthorized user has attempted gain access into the network. Also IP sniffing can be used to check if any of the authorized users are violating the terms of the system.

Proactive System Security and Networking Monitoring ensures your office network infrastructure provides your firm and employees the most reliable continuity of your business activities, reducing the amount of downtime and lost revenue each year.

Whether the interior IT division plays out the system security review or a system security advisor does, this is a key system errand. An organization will settle on numerous outline choices after this point, in view of nitty gritty investigation of the data assembled.

A good penetration tester must be technically competent and methodical. In many situations, a test team is more appropriate than an individual tester. 2 Care must be taken in selecting, installing and configuring the platforms used to perform the testing. Although there are several commercial tools that can be used to perform penetration tests such as Internet Scanner® from Internet Security Systems3, free tools will be used throughout this testing. Kurtz and Prosise make an excellent point when they claim; “Running a commercial vulnerability scanner is penetration testing” is a myth. 4 There are several problems with simply running a vulnerability scanner and assuming that a complete penetration test has been performed. The first is that the vulnerability scanners are only as good as the person running them. As will be discussed latter in this paper, there is more to performing a penetration test than just finding

Wireshark: Allows testers to analyze network traffic in a GUI that can be used for reporting as well (Wirelessdefence.org, 2010).

Wireshark is one of the tools cyber security experts should always keep in the toolbox because it is one of the most complete networking tools that exist. Wireshark can be used for either troubleshooting a network or optimizing the network's security. The tool allows us to examine packets that are being sent and received which is an excellent method to mitigate vulnerabilities. Also, by analyzing

The main objective of this project is to enhance the security of a network using various modern day technologies.

Intrusion Prevention Systems (IPS) are used to monitor traffic on a network. IPS appliances can detect unique patterns (signatures) identified in a dictionary, monitor traffic as it flows through appliances such as firewalls and gateways (Web

Wireshark is a free and open-source bundle analyzer. It is utilized for system troubleshooting, dissection, programming and interchanges convention improvement, and training. Initially named Ethereal, in May 2006 the venture was renamed Wireshark because of trademark issues. Wireshark is cross-stage, utilizing the Gtk+ gadget toolbox as a part of current discharges, and Qt in the advancement rendition, to execute its client interface, and utilizing pcap to catch parcels; it runs on GNU/Linux, OS X, BSD, Solaris, some other Unix-like working frameworks, and Microsoft Windows. There is likewise a terminal-based (non-GUI) variant called Tshark. Wireshark, and alternate projects conveyed with it, for example, Tshark, are free programming, discharged under the terms of the GNU General Public License.

Observe the network interface used by the application - Mobile communication(GSM, GPRS, EDGE, LTE), Wireless (Wi-Fi (802.11 standards), Bluetooth, NFC), Virtual interfaces (VPN)

The very first step in auditing networks is to define where to analyze the traffic. Taking a common scenario for analysis, the following assumptions were made. There is a switched network made up of a number of switches, several terminals and a file server. Network performance has dropped, however the cause is unknown. There is no IDS (Intrusion Detection System) that can alarm or inform about attacks or network malfunction. Also, it is known that there are no problems with the transfer rate of the file server to LAN (Local Area Network) terminals [3]. Furthermore, network equipment does not have Netflow protocols to analyze traffic remotely. Wireshark was chosen to analyze the above scenario. The first doubt which arises is where to install Wireshark. It would seem logical to install Wireshark on the file server itself to analyze the traffic that flows through this network segment. However, there could be situations in which there is no access to the server physically or quite simply for security reasons. Thus, Wireshark cannot be installed there. Some alternatives are provided in the following paragraphs that enable to capture traffic without having to install Wireshark on the server.