Hello everyone in this lesson. We will
investigate the capturing techniques after inspecting
the techniques of the network terrific analysis.
We will make an analysis in practice.
Now, let's look at the technical Network. Terrific
analysis. Here is a more detailed
breakdown of each of these types of analysis.
And the first one is descriptive analysis.
This type of analysis involves summarizing and describing
the characteristics of the network and its
components.
This can include measures such as the size of
the network for example, the number of nodes
or vertise and edges
and the density of
the network. For example, the proportion of
the nodes that are connected by
age.
And the centrality of
13 nodes for example their importance
or influence within the network.
And descriptive analysis can also involved
identifying patterns and
Trends within the network such as
clusters or communities of notes that
are more closely connected to the connected to
one another.
And the second one is diagnostic analysis.
This type of analysis involves identifying issues
or problems within the network and this
can include identifying notes or
edges that are causing bottlenecks
or congestion within the
network or identifying notes that
are vulnerable to failure or
attack.
And the diagnostic analysis can
also evolve identifying patterns of
behavior?
That are indicative of problems within
the network.
And such as suspicious activity or
unusual communication patterns.
At the third one is predictive analysis this
type of analysis involves using data
and statistical techniques to make
predictions about feature Behavior or outcomes
within the network. This can
include predicting the likelihood
of certain events appearing
within the
network such as the failure of a particular note
or the spread of
a certain type of information and the
predictive analysis can also involve identifying
Trends and or
patterns within the
network that may indicate feature outcomes
such as chains in network structure
or behavior over time.
And the last one is the prescriptive
analysis.
And prescriptive analysis is a type of
analysis that involves using data and
statistical techniques to recommend actions
or decisions based on the results of
the other one the another analysis.
And the in the context of network
traffic analysis prescriptive analysis,
May might involve using data
on the past terrific patterns and
the trends to recommend strategies for
improving Network performance
or minimizing congestion.
So for example prescriptive analysis might
involve analyzing data on
traffic volume.
And patterns at different times of day and
using this information to recommend change
to network rating
or resource allocation.
to improve performance
during Peak usage times and it
might also involve analyzing data on
the types of traffic being transmitted over
the network and using this
information to recommend strategies for optimizing the
use of network resources or
improving security.
So now we will investigate an example of
traffic. We will investigate
an SMB terrific.
as you can see I have downloaded before
from the Wireshark website,
which has some sample capture
files, you know, we can access these example files
on the YG YT
dot
Wireshark dot Arc
and you can access on the
internet this file or another example
another sample capturing files, but
I have downloaded the SMB
on Windows 10. This
is the this is
the one of the most known
sample sample capturing
file and we will investigate this capturing
file associated with
the SMB protocol. There is
a communication there's a network traffic between
some devices. You can see in here and
you can also download this
file this pickup NG file
if you want to investigate detailed.
So let's begin with the
SMB protocol. And what
is SMB protocol? We can
talk about a little bit SMB means
server message block.
And assembly protocol is a server
message block protocol. So it
is a network file sharing protocol
and it is used for sharing
files printers and other
resources on a network.
And maybe you know, it is a client server protocol
and the which means that it
relies on a central server to
provide access to resources SMB is
a widely used protocol and it is supported by
many operating systems. It
is often used in Enterprise environments
to share resources on a
local area and Network.
and versions
anti versions of the SMB protocol
have changed over years.
Maybe you can see in here as well.
the name of the protocol SMB
and if there is no
version number this means
the version of the SMB is
1 so this is the SMB version
1
and the other ones you will
see as the smb2.
so
and the versions of the
SMB protocol have changed over the
years and after smb1 1.0.
Maybe you can
say and the second versions and the
finally the third versions
were the Great.
And the third versions were declared
together with their
subversions and are still
being used.
So now it is
it is being it is being used still the
version of one the
version 2 and the
version 3 and their subversions are
still being used.
So that is the important you should
keep in you should keep in mind and the
developed at Modified by Microsoft.
So
there therefore we can read the
documentation of the SMB protocol in detail on
the Microsoft website.
and now we will talk about firstly
on SMB and Shake
Maybe you we can say to this
SMB handshake as such
as the TCP and Shake.
The assembly handshake is called
as the assembly dialect.
According to the SMB protocol based on
the SMB protocol. So
send me is also an
application layer protocol. We should
know this and the we are looking for an
application layer protocol here.
Yeah, you should you should notice that in
order to establish a connection between
a client and the
server using SMB protocol.
You must first determine the dialect
with the highest level of the
functionality. If you want to have a communication between different
window systems, let's say between
Windows 10 and XP or
server server,
20 16
and the other
version of the windows. There must be a
negotiation on the protocol dialect
version.
So after the TCP handshake
We will see the SMB dialect
communication assembly dialect.
messages so to do
this to to make
a
to make it negotiation.
On the devices between the devices client firstly
client offers client
offers an option of
available SMB dialects.
I mean what dialects declined are supporting will
be presented by the client to the server?
So then after the after the
offer offer message in here,
you can see the you can
see on the packet.
854 on this packet
you can see the offer message over
packet or you or we can
we can call as the negotiate protocol
request.
So it is known as negotiate protocol
request negotiate protocol request
packet means declined making
an offer
to the servers.
on the on the SMB version
about the assembly version and then
then the server will select
the highest common version.
Client will offer some versions that
it has and after
this offer.
The server will select the
highest common version.
Let's take a look at the examples.
Now on these packets firstly we
will look at the this example.
Say example.
Okay.
and there is
there is some conversation between the
devices on this MB protocol.
and this is a negotiate
request from the client and
let's look at the packet details now.
negotiate protocol request packet
in here in the packet details pane
you can see the
the knowledge the information about a
each layer.
We have told before in the
on the pack details Pane
and every stage corresponds
to the a level
on the OSI model.
So we will interest
it. We will be interested in the SMB protocol
in here. And before this
you can see the TCP protocol.
And we should know this the SMB
protocol is running on
the is running
under the TCP transmission control
protocol so we can see the TCP
protocol in here after the transport
layer. You can see the higher level.
Under the transmission control protocol and
the net bios session service
protocol is in
here on the session layer.
So the net bios protocol
on the session layer.
After the session layer.
We can see the SMB protocol
on the application layer. So
we have expanded to expanded the
SMB protocol.
field and the in this
field
you'll see the dialect versions values.
I'm going to the down on the details
and you can see.
That's it.
dialect version
So you see the dialect version values line by
line.
line by line
the Soviet with this values declined
is offering the versions that
they can negotiate each other.
This packet is the negotiate protocol request
pack packet and the client is
offering some versions
of the SMB. You can see in here.
There are some versions
as smb2 dot
zero to and
the other version is SMB 2.1
and the SMB 3.0.
each of these
SMB versions are being offered
by the client.
So
they will they will negotiate on one
of the versions one
of these versions. And as I
told before the server will select
the highest common version. So in this
situation the server will
select the
this version
SMB 3 dot 1.1. So
let's look at what what the server
have selected as the
version of the SMB and we will
look at the next packet. The next
packet is the negotiate protocol
response.
So in this packet when we look at
the packet details, we will see that
this server.
Would would select the version
of the SMB?
Now I'm I'm clicking on the negotiate protocol
response packet.
and when we are looking when we
look at the
packet details
we will see.
the version information
so in this field
so
that's it.
the dialect version
has been selected by the server as the smb3.1.1.
So we can understand that the server has
selected the highest common
version of the assembly.
And after the negotiation you will
see the packet about on
the session setup request.
And then you can see some errors.
Let's talk about these years.
but first of all
Before talking about the
errors we will investigate another conversation and
other negotiation conversation between
the devices.
Let's go to the another example.
So we can see yes. Okay. This
is the another example it starts
from here.
It starts with this packet.
And in this packet if he expand
the expand the
SMB field.
You will see the sun.
You will see the sum.
offers
so
In here, we will we are looking at
the dialect information as
the SMB version 2.002
and
the other offer is smb2 Dot.
Some question marks. So these
three question marks are meaning
the wild card and when we
look at the next packet.
the response packet
We can see.
You can see the dialect the dialect
and the SMB version
that has been selected by the server is
smb2 wildcard.
Because on the
request.
because the highest version of the SMB has been accepted as
the wildcard version
and when we look
at the again, when we look at the game the
response packet we can see
the
the dialect version is smb2 wire
card. So this time in this situation
to make a clear version
of the assembly the client
will offer new and higher values
again to the server.
So because because of this situation we
are observing.
The new request packed the next
packet is another request packet.
and when we look at the another request packet
We can see the other versions the higher
versions of the SMB.
after the
after the wild card version offering
declined make and
make an make a new offer the
client make a new offer to the
server.
And with the higher that with
the higher versions of the assembly so
we can see the for example
at the
beginning smb202 and tsmb2.1
the higher
version and
the other one smb3.0 and
the last one is the smb3.1 dot
on.
This means that the server will
select this version.
3.1.1
So let's look at the response packet.
We can see the dialect information is
the highest version of
the SMB.
in the previous packet
In the last offer the assembly version
was the three dot one
dot one and the
server as a
server and server has selected this
version.
the highest version
So this is the dialect communication
dialect conversation between the
client and the server.
and
so the version 3 has been selected and using on
the conversation on the
following conversation, but we are
still observing these packets as smb2 packets.
I mean after selecting version 2
we still observe that the version information
is too.
Some B2. That's why smb2 and
smb3 use the same signature additionally
when we
are searching for smb3.
On the filter on the filtering field
if you make a if we make a
filter.
For the smb3 some B2
can be used as display filter.
So if if I write a filter
as SMB
3 we should
use we should write smb2 and
remind that the client and
the server will redo the negotiation
for the dialect.
So after every TCP
handshake between the client
and the server you will see the negotiation
about the protocol
SMB.
You might have an Enterprise Network and it
might be some multiple different versions
that servers have.
In a cluster of Windows servers in that
situation the server might choose the highest
common dialect version among all other ones.
Not that not the highest version
but the highest common version. So this
is the important point they will
they will choose the highest common
version the highest common version
not the highest version.
And why do multiple TCP handshakes
and sessions arise when
we are running on SMB protocol?
In fact, it might be that
one of the TCP session is used to open a
file and the second TCP session
is used to close the file.
So that is why.
Now, let's look at traffic in order to make an investigation.
We see in here after the negotiation process the
client with the IP address and linked
with the
ending with the 100 132 first
makes a login attempt here
as you can see.
And login attempt in here and the
session request we
can see in here. So and this
attempt failed.
After the login attempt, the
login attempt has
failed. So that is
why the status log on failure error
is received in here. And let's
also look at the user information of
this client.
That has been made the request
for the login and when
we look at the user information.
That you can see also an information summarizing
information in here
and we can look at the detail.
Of the user information in here
as you can see on the session
ID field. The account field
is giving the username
as user then the
domain name is the important another
thing for us because this
is showing us
the domain name in this
situation multiple unsuccessful working
at hands with the same hostname.
And the same username.
are acceptable
however, if we notice that the same client
the same client with the same IP address
and the same username and
the same hostname.
If you notice that the same client is trying to
login with different usernames.
The other information will be
the same and the username
can be
might be a different username. So
in this situation, we have a suspicion that
this is suspicious activity.
So let's take a look at the rest of
the traffic.
This was the first on successful
login attempt and
it is acceptable.
But let's move on the more. Let's
move on to the investigation on
the traffic.
So when we come to
the another login attempt,
look the same
user the same user.
Username is the same as you can
see in here.
And the domain and hostname is the same
and the IP address
is the same as well.
So the same user has
made another unsuccessful login attempt.
So there is another error the
status log on favor.
And okay move on the traffic.
And here is the third unsuccessful login
attempt.
so
move on.
and when we come to the
packet
740 here is
another unsuccessful login attempt
and the the user
is the same again.
So let's move on again.
And we are coming to the
another login attempt here. We
see that the same client.
The same client with the same IP address
and with the same domain name
and the host name.
but
the username is different. So that
is interesting.
And we see that the same client attempted
to login with an different username.
Username is here team tester.
And this login attempt also failed you
can see the error about
the login status log
on favor again. So that's interesting. That's
highly interesting and no
one the traffic.
monitorific
so
when we come to the another packet.
which might be
interested with the same client
and
we see that we see that in here.
again
The same domain
name and the host name.
Are the same?
With the previous ones and
the account name is
different again.
so
the same client then attends
a login again in here and
it has the same hostname and
the same IP address. However, he
attempt to login with a different username.
and this time
successfully locked in so this
is so this in itself is abnormal
and high resuspicious and this
in itself is abnormal and
highly suspicious.
So moreover it creates.
That's the let's look at it's it's great.
It creates a file name.
SRV SVC on the
server
after the traffic
So then we see the right operations
to write operate operations. You
can see here the right.
process
and
then we see and finally
we can see the burning we can
see the warning the warning.
We can see the warning.
And finally, we can see the burning that it
is a malicious file.
So in the package with the phrase in the
package with the phrase malformed packet warning.
so
It says to us. This is a malformed
packet and its
name is SRV SVC.
Which is the malformed packet?
So as here to detect whether the
generated file contains malicious content,
and we need to directly we
need to directly to
detect whether the generated file contains malicious
content. We need to directly examine the
contents of the file created
on the server after such a
login attempting.
As a result we have seen.
That there may be a harmful activity and
malicious activity at the end
of the login attempts made in
this way.
So keep in mind that and you should
make an analysis in this
way. You should follow the traffic better.
It is
a suspicious suspicious contents
or the
attempting or the another change
on the traffic. You should
notice that
so that's all for now and we have
a quick and the sample analysis on the
SMB protocol.
So we will talk about the filtering techniques on
the next lesson. See you on the next video.