Chapter 8 - Real World Packet Captures

Abstract

Analyzing real-world packet captures is both a science and an art. A high traffic network segment can present the analyzer with thousands of packets containing hundreds of connections, sessions, and protocols. Ethereal's built-in features such as Transmission Control Protocol (TCP) session reconstruction, display filters, and packet colorization help simplify the process of analyzing data. Constantly analyzing network data helps one quickly assess what is normal and what is unusual behavior. If one does not have the ability to analyze one's own network traffic data, that individual should participate in the Honeynet Project Scan of the Month challenges. These challenges cover network traffic analysis, as well as malicious code, exploits, and methodology. This chapter presents several different types of packet captures and the processes used to analyze the data. It helps develop an understanding of the types of activity to look for in a packet capture and how to identify various types of network traffic. Combining this skill with the network troubleshooting methodology helps one to detect, analyze, and respond quickly to the next major worm outbreak.