Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Hands-On Network Forensics

You're reading from   Hands-On Network Forensics Investigate network attacks and find evidence using common network forensic tools

Arrow left icon
Product type Paperback
Published in Mar 2019
Publisher
ISBN-13 9781789344523
Length 358 pages
Edition 1st Edition
Languages
Concepts
Arrow right icon
Author (1):
Arrow left icon
Nipun Jaswal Nipun Jaswal
Author Profile Icon Nipun Jaswal
Nipun Jaswal
Arrow right icon
View More author details
Toc

Table of Contents (16) Chapters Close

Preface 1. Section 1: Obtaining the Evidence FREE CHAPTER
2. Introducing Network Forensics 3. Technical Concepts and Acquiring Evidence 4. Section 2: The Key Concepts
5. Deep Packet Inspection 6. Statistical Flow Analysis 7. Combatting Tunneling and Encryption 8. Section 3: Conducting Network Forensics
9. Investigating Good, Known, and Ugly Malware 10. Investigating C2 Servers 11. Investigating and Analyzing Logs 12. WLAN Forensics 13. Automated Evidence Aggregation and Analysis 14. Other Books You May Enjoy 15. Assessments

Analyzing packets on ICMP

Let's take a look at the Internet Control Message Protocol (ICMP). It is one of the most popular protocols, and is better known for being used in ping commands, which is where an ICMP echo request is sent to an IP address with some random data, and it then denotes whether the system is alive. A typical ICMP packet would look like this:

The ICMP has many messages, which are identified by the Type of Message field. The Code field indicates the type of message. The Identifier and Sequence Number can be used by the client to match the reply with the request that caused the reply.

The Data field may contain a random string or a timestamp to compute the round-trip time in a stateless manner. Let's ping https://www.google.com/ and analyze it in Wireshark:

We can see that we have four Echo request and four Echo reply packets. Let...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime
Banner background image