Network Security & Forensics Techniques

This assignment delves into various network security concepts and practices. It covers topics such as ICMP protocol usage, IPv4 fragmentation for evasion, ARP cache poisoning for sniffing in switched environments, TCP RST attacks on telnet and SSH connections, rate limiting techniques, and iptables manipulation for defense. Students are expected to understand these concepts, demonstrate their knowledge through practical examples using tools like hping3, nc, tcpdump, and iptables, and analyze captured network traffic for malicious activity.

Network Security and
Forensics

Sample Outputs and the outputs we got in our practical tasks are
shown below.
a) Use the command tcpdump –V
Command: Tcpdump –V
1

b) Use tcpdump -D to list all of your available interfaces.
c) Ping 2130706433 and watch the traffic flow with tcpdump.
user@Ubuntu1:~$ ping 2130706433
PING 2130706433 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.018 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.027 ms
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.033 ms
64 bytes from 127.0.0.1: icmp_seq=4 ttl=64 time=0.034 ms
64 bytes from 127.0.0.1: icmp_seq=5 ttl=64 time=0.034 ms
64 bytes from 127.0.0.1: icmp_seq=6 ttl=64 time=0.031 ms
64 bytes from 127.0.0.1: icmp_seq=7 ttl=64 time=0.029 ms
64 bytes from 127.0.0.1: icmp_seq=8 ttl=64 time=0.031 ms
64 bytes from 127.0.0.1: icmp_seq=9 ttl=64 time=0.032 ms
64 bytes from 127.0.0.1: icmp_seq=10 ttl=64 time=0.031 ms
64 bytes from 127.0.0.1: icmp_seq=11 ttl=64 time=0.032 ms
64 bytes from 127.0.0.1: icmp_seq=12 ttl=64 time=0.032 ms
64 bytes from 127.0.0.1: icmp_seq=13 ttl=64 time=0.031 ms
64 bytes from 127.0.0.1: icmp_seq=14 ttl=64 time=0.032 ms
2130706433 is nothing but the self IP / Loop back IP.
user@Ubuntu1:~$ ping -c1 2130706433
PING 2130706433 (127.0.0.1) 56(84) bytes of data.
2

64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.025 ms
--- 2130706433 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.025/0.025/0.025/0.000 ms
Task 2:
Already installed proftpd
Started the proftpd service
3

4

Created one user account ftpuser using useradd command
Changed the password of the ftpuser to password
Tried to FTP the new installed FTPServer from another client
Captured the pocket using tcpdump
Stored the pcap file as Activity2.pcap
Got the following screen which clearly shows the password of the
ftpuser
5

Task 3 :
hping3 is already installed in the system
6

7

8

9

In the above examples ABCDE data travels using UDP first. Then
uses ICMP protocol which is a TCP protocol. In UDP , The destination
port unavailable message comes. In the ICMP mode the same ping
response comes in return.
Task 5: IPv4 Fragmentation
NETCAT LISTENER installed
10

The same is installed in another linux too.\
nc 192.168.1.107 5555
netid netcal -u 192.168.1.1
11

Task 6 : frag route tool for IDS/firewall evasion
12

13

Task 9 : IP fragment reassembly timeout – tcpdump only
Task 10: sniffing in a switched environment: Arp Cache Poisoning –
tcpdump only
14

Task 11: TCP RST Attacks on telnet and Ssh Connections – tcpdump
only
Task 13: Rate Limiting
15

TASK 14: iptables trickery
16

Actual Outputs we received
Ping –c1 192.168.1.102
17

hping3 –i u1000000 –S 192.168.1.106
iptables –I INPUT –p tcp –dport 80 –i eth0 –m state –state NEW –m recent --set
18

Iptables –A BLOCK –p tcp –tcp-flags SYN, ACK, FIN,RST SYN –j DROP
19

20

Sudo apt-get install libdumbnet-dev
21

Ping –c 2 –S 8000 192.168.1.106
Service proftpd start
22

Tcpdump ping –c 1 192.168.1.102
adduser ftpuser
23

24