Welcome to Section 7 Network forensics we're going introduce the topics of network forensics and networking
with an emphasis on the TCAP IP protocol suite then will cover the capturing a network packets and subsequent
forensic analysis of captured traffic with wireshark.
Now let's move on to Introduction to network forensics will introduce the topic of network forensics
and then basic theory about networking with a particular emphasis on the ISO psi model and the TCAP
IP protocol suite.
So far we've covered host based forensics which is the acquisition and analysis of data from a host
nonvolatile memory and volatile memory.
Now we're going to see how to acquire and analyze data network packets flowing on the network from one
host to another network forensics is a bridge of digital forensics that's often treated as a separate
topic and has much in common with network security monitoring.
It's typically conducted during live in the response and allows the examiner to reveal the activity
of an attacker or of a malware on the network.
Inspecting the connections and packets transmitted before diving into the hands on part.
It's therefore useful to recall the basics of networking as the network forensic examiner shall be proficient
in reading and understanding the structure of protocols and packets.
Networking is structured according to the ISO o Esai or open systems interconnection model.
It has seven main layers which go from highest to lowest application presentation session transport
network data link and physical.
Each of the layers has its protocols that describe how the data is transmitted in the form of packets
a packet is typically comprised of a header and a data payload.
Each protocol has its own typical header.
That's prepended to the packet when the letter goes down the layer stack before being sent and removed
when goes up the stack after it's received.
For the sake of brevity in this video I will briefly describe the TCAP IP protocol suite that operates
at the transport and network layer respectively the main network layer protocol is the Internet Protocol
or IP which the version 4 is still the most used IP protocol performs the functions of addressing and
routing packets the main fields of the IP header are the source and destination address fields.
There are 32 bits each as we could see in this diagram IP version 4 addresses are divided into four
octets separated by periods each octet has 256 possible values ranging from 0 to 255 in decimal notation
in the classes our domain routing.
Or C ID are addressing IP addresses are comprised of two groups most significant bits are the network
address which identify a whole network or subnet while the others identify the host address.
For example the address 192 point 168 point 0.1 slashed 24 identifies a network address of 24 bits and
a host address formed by the remaining eight bits.
The number 24 after the slash is called the network mask in IP V-6 the addresses are 128 bits long greatly
extending the range of possible IP addresses IP V-6 addresses are written in hexadecimal and are divided
into eight groups of 16 bits each.
The main TradeSports their protocols are to TCAP and UDP TCAP transmission control protocol and UDP
user datagram protocol.
TCAP is a connection oriented and reliable transmission protocol.
It prepares its own header to an IP packet to form a TCAP segment as we see in this diagram the TZP
Hetter has two main 16 bit long fields source port and destination port TZP control state and flow of
connections through ops sectoral flags and the sequence in acknowledgment numbers in the TCAP header.
The main control flaks our sin ack r s t and fin each flag is a single bit that can be sent or not a
TCAP connection is established through a sequence called threeway handshake the initiating host sends
a packet with the sin flag set to initiate a connection.
The responder replies with a packet that has the sin and acts like set and the initiator sends back
an X packet to confirm the connections request.
Similarly the at X flags are used to close a connection while R S T is used to reset a connection the
sequence number keeps track of the bytes of data sent while the acknowledgement number of the bytes
of data received by the other end.
So the packets that have not been acknowledged are sent again.
The other import and widely used transport layer protocol is UDP.
It's a connection list an unreliable protocol and it's used by the DNS or domain name system.
SMP simple network management protocol and for real time data streaming we could see it's Hetter structure
in this diagram like TCAP.
It uses the 16 bits field source and destination ports.
Great job in this video we introduced network forensic and the basic theory of networking TCAP IP protocols
particularly next video we're going to see how to capture network traffic flowing from one host to another
with wireshark.