Assignment

Your boss has had an intrusion (or so she says) on his home network. She has brought in a packet capture file for you to analyze.

She says:

"Something has happened on my home network. I use my network for internet access so I can access read email (remember my AT&T email account). I am not sure whether this event(s) should cause me concern or not, but I was lucky to be running Wireshark when the event occurred. I will email you the Wireshark capture file so you can analyze the capture file and tell me what occurred during the internet session."

1) Open the capture file (by clickingHere) using any tools you see fit

2) Perform an analysis on the captured traffic. Some things you should consider are the following (not all of these happened and may not be all inclusive either):

a. How long did the session capture last?
b. How many packets were captured?
c. How many bytes were captured?
d. What protocols were observed?
e. When did the bulk of the data get transmitted?
f. What caused this transmission spike?
g. Were any ISP sites accessed? If so which ones? What accounts?
h. What is the name of the host computer? It's IP address?
i. What Operating system is it using?
j. What does the local network look like?
k. What device names are on the local network?
l. Did I access any other computes on the local area network?
m. Are any other devices on the network?

3) What "story" does the capture file tell?

4) Run the capture file through SNORT. What alerts are triggered?

Provide a lab report, which will includes the answers to the questions above and an analysis of what actually happened during the network session. Identify the key events and either prove or disapprove that a malicious event occurred.

When referencing the answer to questions or providing proof of your analysis it might be helpful to reference the actual packet number that proves your point.