Lab Objective:
The objective of this lab exercise is to learn what the process of Baselining is and why it is important.
Lab Purpose:
Understand the importance of the process of Baselining during communication analysis.
Lab Tool:
Wireshark Network Analyzer on PC, Ethernet Switch/Router (cable/Wi-Fi)
Lab Topology:
Please use the following topology to complete this lab exercise (PC equipped with Wireshark connected via wireless to a Network Router that has access to the internet).
Lab Walkthrough:
Task 1
Baselining is the process of creating a set of trace files that depict “normal” network communications. In general, it is important to establish a baseline before network problems or security breaches occur. That’s because in this way, the analysis process can speed up. In fact, baselining is important because it helps resolve problems more effectively and efficiently.
When creating a baseline, it is important to remember that it can consist of more than a single trace file. It can also include screenshots taken from a client/server, and can be created by gathering summary data, IO Graph information, and network maps.
Usually, one of the reasons for using a baseline during the analysis of a problem in a network is to identify normal traffic patterns. For example, if a user complains about the performance experienced on a particular day, you can take the trace file of the current traffic. Referring back to the baseline trace file, you can filter out “normal” traffic and focus on the unusual traffic. This can reduce the troubleshooting time significantly and can make the effort cost-effective.
Another example is when a security breach occurs. In case we already know the normal protocols, applications, and traffic patterns, we are able to spot unusual communications. For example, if the hosts we are observing never use Internet Relay Chat, but suddenly, this type of traffic appears in the trace log, maybe a bot infection is in place.
Task 2
Start Wireshark and capture traffic from one of the active network interfaces for some minutes; stop the capture and save the file.
If we need to baseline Broadcast traffic, we set the display filter to “eth.dst==ff:ff:ff:ff:ff:ff”, as shown in the figure below, even though we can’t see any broadcast traffic.
In case we need to baseline the Multicast traffic, we will fill in the display filter with the filter “eth.dst[0]&1 && !eth.dst==ff:ff:ff:ff:ff:ff ”, as displayed in the figure below:
In this case, we can see a lot of Multicast traffic, and in particular, ICMP traffic. When we are able to observe some traffic, we can determine which rate of the traffic selected is present, generating the IO graph for the selected display filter, as displayed in the figure below:
The topic we have to take care of when baselining this type of traffic is identifying who is transmitting Broadcast/Multicast traffic and from which applications. The IO graph provides us with the typical rate in packets per second, which is fundamental to identifying an increase or decrease in the traffic in further acquisition.
Task 3
If we need to baseline the Protocols and Applications, for example, to spot breached hosts, the usual process is to compare current traffic against a previously saved baseline.
In order to create a Protocols and Applications baseline, we can acquire some minutes of traffic on the active connection and then open from the Wireshark Main menu the “Statistics” à “Protocol Hierarchy” item, as displayed in the figure below:
As a result, a new window will open showing the statistics in percentage and Bytes for each protocol, as displayed in the figure below:
The topic we have to address when baselining this type of traffic is identifying which applications are running on the network and which protocols are in use. If they use TCP, it is important to identify on which TCP ports, and if they use UDP, it is important to identify on which UDP ports.
Another topic is to identify which routing protocol is used and determine the characteristics of the routing update protocol to enable comparison in case of later traffic acquisition.
Notes:
Repeat the previous steps on a different network traffic capture to create baselines for Broadcast and Multicast traffic types and for Protocols and Applications. Gain the necessary confidence using the utilities provided by Wireshark to establish a well-defined baseline.
