The most detailed type of analysis data packet captures with packet captures you can see all of the
network layer information plus actual data payloads.
You can analyze information like web page images passwords and even voice call conversations
Cisco's firepower Management Center as a sweet feature that actually allows you to download packet capture
files for intrusion events so find the event I want to analyze last click the drill down arrow and then
if I scroll to the bottom I have the option to download all packets.
So I'll download this and then we'll use our wireshark software to open up the picquet file to analyze
the security artifacts while that's downloading.
If we look here in this packet information section right from the firepower Management Center we can
actually look at some of the data that we would see right in our pre-cap file.
So I guess in this case you really could probably get by just by using the data that's provided in the
fire power management center but you're not always going to have that luxury plus wireshark has some
additional features that can be used to help you analyze the data.
OK so it looks like the download is done.
I open up the zip file.
Double click it and it should open up the file with my wireshark software.
So we can see that the first packet that was collected in the security event was the acknowledgement
to open up the TCAP session on port 80 to the web server.
And then once the connection was established we can see that there was an age to get and we can see
our protocol header information and all of our addressing for each network model layer and then the
most interesting part is the HTP section.
It can provide information such as images that were pulled down in the HTP get as well as the final
destination you are I and the DNS hostname information.
So as you can see having a peek at file of a security event can give you all the information that you
would need to properly analyze it at a network level.