Wincap: An Open Source Software for Network Analysis and Packet Capture

MALWARE ANALYSIS 1
MALWARE ANALYSIS
Name
Instructor
Institution
Course
City
Date

MALWARE ANALYSIS 2
Introduction
Wincap is an open source software, the program is used for network analysis and packet
capture. Most of the networked applications in organizations access network via the widely used
OS like sockets. Wincap software has been used widely to capture and at the same time transmit
network packets. The software consists of a driver which extends the OS so as to provide low-
level network access. This paper will use Wincap to capture packets and provide screenshots on
the same. In addition, the paper will explain what is SNORT, how it works, and its disadvantages
and advantages. Also, the screenshot on SNORT network analyzer will be provided.
Wincap
On September 15th, 2018 Riverbed released a new version of Wincap i.e. version 4.1.3.
The software has not been upgraded for many years since the 1990s. The version has the ability
to sniff loopback packets using windows filtering platform. One of the major purposes of the
current version of Wincap is to provide facilities to capture raw packets, both the one exchanged
by other host and the one destined to the machine where it is running. Second, Wincap is used to
filter packets according to the user-specified rules before even dispatching them to the
application [1]. In addition, Wincap is used to gather statistical information on the organization
network and transmit raw packets to the organization network. Wincap application is used by
lots of network tools for monitoring, security, and troubleshooting. Some of the classical tools
which rely on Wincap are network monitors, network and protocols analyzers, security tools,
traffic monitors, network scanners, security tools, and traffic loggers. In addition, Wincap only
sends and receives packets independently from host protocol.
The current Wincap i.e. is able to send back loopback packets using Winsock Kernel
technique. The look of the of the version is as shown by figure one below

MALWARE ANALYSIS 3
Figure 1: Wincap interface
Some disadvantages of Wincap is that it cannot be used to prevent an incident by itself
i.e. it does not prevent or even block attacks. Also, wincap does help in resolving any malware
issue it only assists in identifying malware. Lastly, the tool does not process encrypted packets.
How to use Winmap
First, one need to examine the interface of the software. By opening the software there
several profiles which is as shown by the screenshot shown below
Figure 2: Winmap profile

MALWARE ANALYSIS 4
From the interface, there are four menus which are; scan, tools, profile, and help.
The second step is to ping scan or ping sweep so as to discover all the hosts which can
respond to ICMP and ARP on a certain subnet example is nmap-Sp 192.168.1.1/24. By pinging
the nmap Sp 192.168.1.1/24 the output of the scan is shown by screen shot below (figure 3)
Figure 3: Winpcap 192.168.1.1/24 scan

MALWARE ANALYSIS 5
The third step is to ping sweep over port 80 so as to discover the hosts which are on the
network where the firewall is blocking the ICMP protocol packet but allowing the web traffic.
An example would be Winpcap-sP –PT80 192.168.1.0/24. The fourth step is port scan to
discover those ports which are open on hosts which will respond to multiple TCP protocols this
is done using the nmap Ss command. The fourth step is to port scan the entire organization
network. Other ways to port scan is to use the –sS option and then decoy it with the “-D” option
which means one need to spoof the said IP address.

MALWARE ANALYSIS 6
SNORT network analysis tool
Snort is said to be a multi-mode packet analysis tool which is used to sniffer and packet
logger. The tool is also used as a forensic data analysis tool and a network intrusion detection
system. The tool is portable i.e. can be installed in Linux, Solaris, HP-UX, Mac OS, and
Windows. One of the advantages of the tool is that it is fast and has a high probability of
detection for a given network so long as it is on 100 Mbps network. In addition, one can be able
to configure the tool. Third, the tool is an open source software meaning that it is free hence one
can easily download it from the internet with a small file of up to 800k. The fourth advantage is
that it is a packet sniffing lightweight network analysis tool with a rule-based detection engine.
Fifth, with a plug-in, the tool is flexible. Sixth the tool offers a wide range of detection
capabilities as compared to other tools such as OS fingerprinting, CGO exploits, backdoors,
stealth scans, and buffer overflows. Seventh, the creation of new rules is simple when using
SNORT. The tool, also reports results from other tools.
Snort tool has three modes i.e. sniffer mode, intrusion detection, and as a packet logger.
As a packet sniffer one can use the tool as sniffer without having to turn on the tools detection
capabilities. In here one gets a live readout of the network packets without having to pass along
the organization network. As an intrusion detection mode one can invoke the analysis mode
which applies to a set of traffic rules. As a snort mode, the tool is able to perform a deeper
analysis of the network data which is collected by Snort [2].

MALWARE ANALYSIS 7
How SNORT tool works
To start with SNORT tool can be configured to perform deep packet inspection and
complex packet processing. After and installing Snort and running the help command the
interface looks like snapshot shown below. The SNORT tool used here is the latest version.
Few programs are needed if one wants to run SNORT tool. Some of the programs which
were used in this project are MYSQL-Server, PHP5-MySQL, and PHP Extension and
Application Repository (PEAR).
Before installation of SNORT it is important to note that the snort.conf file is the one
control SNORT watches. In addition, the file defends SNORT tool from attack and the rules
which it uses to find malicious traffic. In addition, the file watches for dangerous traffic which is
not defined by signature. It is also important to understand how to use SNORT tool using the
three modes. Using the Sniffer mode, the tool is able to print TCP/IP packet headers to the
screen. This done using the command snort –v. To display the packet data and their headers one
just need to run the Snort-vd commands. In addition, -e command is used as a descriptive
display. The second mode is the packet logger; in here the major idea is to record packets on the
disk. In here one usually specifies the logging directory using a very simple command –dev -1
./log.
For this project, SNORT.exe was downloaded from the snort website. Wincap was also
installed from riverbed modeler site. The following steps were carried out to install and to
configure the SNORT network analysis tool
1. Click on the SNORT installer .exe file
2. After installation a folder of Snort was created in C as shown by snapshot shown
below (The highlighted folder)

MALWARE ANALYSIS 8
Figure 4: Snort installation folder in C
3. One then continued to configure SNORT tool located on the etc folder. This done
using notepad++ where one is required to edit the IP address as shown by the figure
below (The highlighted one)

MALWARE ANALYSIS 9
Figure 5: Configuring the snort.config file
4. Other files which are edited are inserting the path where the rules are located
5. After installation one can then continue to run the SNORT tool to do this one runs the
command prompt as a run administrator then runs the cd C:\Snort\bin command and
then the snort –V command. By running the commands the output is as shown by the
screenshot below which shows that this project is running version 2.9.12 of the Snort
tool

MALWARE ANALYSIS 10
Figure 6: Successful installation output
SNORT commands
First, one checks the interfaces that one will be testing by running the command snort –W
where the output is as shown by snapshot below

MALWARE ANALYSIS 11
Figure 7: SNORT interfaces
How to detect packets using SNORT
To test if SNORT is able to detect packets that come through the network then it means
that one has to create rules. This project created rules as shown by the snapshot shown below
using notepad++.

MALWARE ANALYSIS 12
Figure 8: Local.rules (rules created in the rules folder)
To verify is SNORT is generating alerts the command snort -iX -A console -c C:\snort\etc\
snort.conf -l C:\Snort\log -K ascii was used which generated the output shown below

MALWARE ANALYSIS 13
The last step if everything is working properly and building a SNORT based –IDS by
executing the listed commands:
 ping yahoo.com
 Shell>/usr/local/bin/snort1/Snort/snort.conf –D (star Snort in the background)
 Shell>/usr/local/mysql/bin/mysld_safe & (start MYSQL database in the background)
After this then it is important to run the SNORT tool on the browser. To do this project
run the http://192.168.0.1 /acid/ in the browser where one was able to see the main page of the
ACID that displayed the alerts from the MYSQL database which were generated by SNORT the
configurations which were carried out.

MALWARE ANALYSIS 14
Installing malware into a network and detecting the malware using SNORT
Malware is a malicious program which is harmful to the computer and to the organization
network. Malware programs include worms, spyware, Trojan horse, and worms. To launch an
attack this project used nmap to launch brute ftp type attack using the command
Nmap –script ftp-rute –p 21 192.168.1.105
This is shown by the snapshot shown below

MALWARE ANALYSIS 15
Figure 9: Launching FTP type attack
Logging SNORT data in a text format
One can log SNORT data in a text mode by adding the directory name in the command
line. The command added in this case is the Snort data in /var/log/snort directory in addition to
displaying the command in the console. The command is snort –dev –l/var/log/snort
When goes to the /var/log/snort directory one is able to find multiple directories under it.
In here each of the directories corresponds to one host; it also contains multiple files. Also, the
names of the directory are the same as the IP address of the host. Some of these files contain logs

MALWARE ANALYSIS 16
of the various connections and the various types of network data. Example is the files which
contain the TCP data which is the TCP: 2489-23. The file which contains the ICMP data which
is the ICMP-ECHO [3].
Malware detection using SNORT tool
To detect malware on an organization network various tests are carried out, one of the
tests carried out is the port scanning. With this type of scan, it allows one to probe any open
ports. It also enables one to detect the operating system and the services which are on use. The
second method which is highly utilized is the apache server [4].To detect some malware using
SNORT tool, this project started by displaying individual packets on the network and then
employing the use of Alert mode; in here one sends alert so as to capture packets which matches
a rule. In here one sends alerts in many modes; these modes ought to be configurable via a
command line as well as via snort.conf file. To send alert this project created an alert when
SNORT detects an ICMP packet using the TTL 100 [4]
To detect malware this project first analyzed the packets on the network as shown by
snapshot shown below

MALWARE ANALYSIS 17
Figure 11: Packets scan on using snort
From the figure above the received packets are 1566 but the analyzed packets are 1562
and only one packet which was dropped. This project then continued to identify all the
ports as shown by the two screenshot shown below

MALWARE ANALYSIS 18
Figure 12: Intiating Port scan using nmap

MALWARE ANALYSIS 19
Figure 13: Results of port scan

MALWARE ANALYSIS 20
The third procedure is to scan ports on the machine hosting the nmap program as shown
by the snapshot below
Figure 13: Port Scan

MALWARE ANALYSIS 21
This project then continued to detect the attack using the command nmap -sV --script=http-
malware-host 192.168.1.105
The output is as shown by the figure shown below
Figure 10: Detection of FTP type of attack using SNORT

MALWARE ANALYSIS 22
Wireshark
Intrusion can also be detected using Wireshark. It is a very powerful tool used in Linux,
Mac, and Windows to capture and analyze packets. It is also used to inspect data that passes
through a network. Wireshark allows one to capture packets and also examine their contents as
shown by snapshot shown below
Figure 10: Wireshark interface
One can also run Wireshark on command line as shown by screenshot shown below

MALWARE ANALYSIS 23
Figure 11: Wireshark running on command line
Malware capture using Wireshark
One can capture malware using wireshark and highlight the malware using a different
color code. Example is as shown by the screenshot below. In here I opened a website with
malware and downloaded the malware. By using Wireshark one can analyze the packets. These
are highlighted in black from the screenshot. From the description table, the malware is a src
type of malware from port 3088

MALWARE ANALYSIS 24
Figure 12: Malware analysis with Wireshark
Comparison of SNORT and Wireshark
Wireshark and SNORT can perform similar functions as highlighted from this project. In
addition from this project, wireshark is an excellent packet sniffer which is able to list all the
packets up to 1000 packets. In addition wireshark allows one to interprate and capture network
traffic very easily. With SNORT one has to use command prompt to analyze packets which
requires a more advanced expertise.

MALWARE ANALYSIS 25
Conclusion
From this project it is evident that IDS look for signatures that are specific patterns which
include suspicious or malicious intent. As compared to SNORT, Wireshark tool offers a more
advanced technique when carrying out a network analysis. The only limitation with Wireshark is
that it offers a limit of up to 1,000 packets

MALWARE ANALYSIS 26
References
[1] S. P. and P. T.J, " Using JPCAP and WinCap," DDoS Attack Analyzer, pp. 781-784, 2017.
[2] A. Orebaugh, J. Babbin and S. Biles, Snort cookbook by Angela Orebaugh, Chicago:
O'Reilly Media, 2005.
[3] Riverbed, "SNORT," Network analysis tools, vol. 2, no. II, pp. 57-90, 2015.
[4] J. Koziol, Intrusion detection with Snort by Jack Koziol, New York: Sams Publisher, 2013.
[5] A. McDonald and T. O. Gallery, SNORT, New York: Tim Olsen Gallery, 2008.