Scapy/Conversations - Revision history

Admin: /* Conversation Analysis */

2016-08-31T04:06:34Z

Conversation Analysis

← Older revision		Revision as of 04:06, 31 August 2016
Line 65:		Line 65:
	* http://trisul.org/features/#security_monitoring		* http://trisul.org/features/#security_monitoring

			=Flags=

	{{ScapyFlag}}		{{ScapyFlag}}

			{{WirelessFlag}}

Admin: /* Conversation Analysis */

2016-02-01T03:17:52Z

Conversation Analysis

← Older revision		Revision as of 03:17, 1 February 2016
Line 43:		Line 43:

	=Conversation Analysis=		=Conversation Analysis=

			Also see [[Statistical Analysis of Networks]]

	In any conversation, there are two endpoints, A and B. Sometimes A is the source and B is the destination - A is sending data to B. And sometimes B is the source and A is the destination - B is sending data to A.		In any conversation, there are two endpoints, A and B. Sometimes A is the source and B is the destination - A is sending data to B. And sometimes B is the source and A is the destination - B is sending data to A.

Admin: /* Conversation Analysis */

2016-01-27T05:25:06Z

Conversation Analysis

← Older revision		Revision as of 05:25, 27 January 2016
Line 61:		Line 61:
	Also, neat:		Also, neat:
	* http://trisul.org/docs/ug/alerts/tband.html		* http://trisul.org/docs/ug/alerts/tband.html
			* http://trisul.org/features/#security_monitoring


	{{ScapyFlag}}		{{ScapyFlag}}

Admin: /* Conversation Analysis */

2016-01-27T05:24:54Z

Conversation Analysis

← Older revision		Revision as of 05:24, 27 January 2016
Line 59:		Line 59:
	* https://en.wikipedia.org/wiki/Gas_networks_simulation		* https://en.wikipedia.org/wiki/Gas_networks_simulation

			Also, neat:
			* http://trisul.org/docs/ug/alerts/tband.html

	{{ScapyFlag}}		{{ScapyFlag}}

Admin: /* Conversation Analysis */

2016-01-27T05:19:41Z

Conversation Analysis

← Older revision		Revision as of 05:19, 27 January 2016
Line 54:		Line 54:
	If we wanted to get temporal resolution, however, we could loop through each packet and create a time vector of conversations, with some averaging window like 30 seconds or 5 minutes.		If we wanted to get temporal resolution, however, we could loop through each packet and create a time vector of conversations, with some averaging window like 30 seconds or 5 minutes.

			Other applications:
			* https://en.wikipedia.org/wiki/Electrical_distribution
			* https://en.wikipedia.org/wiki/Pipe_network_analysis
			* https://en.wikipedia.org/wiki/Gas_networks_simulation

	{{ScapyFlag}}		{{ScapyFlag}}

Admin: /* Conversation Analysis */

2016-01-27T05:03:48Z

Conversation Analysis

← Older revision		Revision as of 05:03, 27 January 2016
Line 44:		Line 44:
	=Conversation Analysis=		=Conversation Analysis=

	In any conversation, ~~you have~~ two endpoints, A and B. Sometimes A is the source and B is the destination - A is sending data to B. And sometimes B is the source and A is the destination - B is sending data to A.		In any conversation, there are two endpoints, A and B. Sometimes A is the source and B is the destination - A is sending data to B. And sometimes B is the source and A is the destination - B is sending data to A.

	The relationship can be described with a network. A network is composed of dots, nor nodes, and lines, or edges. In our case, we are representing a conversation with nodes (entities like A and B) and edges (representing a relationship between entities). A conversation can be thought of as two nodes and two edges - one edge representing A to B, the other edge representing B to A.		The relationship can be described with a network. A network is composed of dots, nor nodes, and lines, or edges. In our case, we are representing a conversation with nodes (entities like A and B) and edges (representing a relationship between entities). A conversation can be thought of as two nodes and two edges - one edge representing A to B, the other edge representing B to A.

Admin: /* Getting Source/Destination Address */

2016-01-27T05:03:22Z

Getting Source/Destination Address

← Older revision		Revision as of 05:03, 27 January 2016
Line 41:		Line 41:

	Further parsing could be done to identify packets that are beacons from access points, to determine which MAC addresses are access points.		Further parsing could be done to identify packets that are beacons from access points, to determine which MAC addresses are access points.

			=Conversation Analysis=

			In any conversation, you have two endpoints, A and B. Sometimes A is the source and B is the destination - A is sending data to B. And sometimes B is the source and A is the destination - B is sending data to A.

			The relationship can be described with a network. A network is composed of dots, nor nodes, and lines, or edges. In our case, we are representing a conversation with nodes (entities like A and B) and edges (representing a relationship between entities). A conversation can be thought of as two nodes and two edges - one edge representing A to B, the other edge representing B to A.

			Using the network representation, we can also think about it as two separate flow networks (see https://en.wikipedia.org/wiki/Flow_network): the first flow network is a series of nodes connected by edges representing data from the outside world (via routers or access points) to nodes, and the second flow network is nodes connected by edges representing data flowing outward.

			To simplify starting out, we can ignore a particular dimension by simply integrating over it entirely. For example, to remove the temporal aspect of conversations - how the conversations evolve over time - we can loop over every packet and collect information about conversations and flows.

			If we wanted to get temporal resolution, however, we could loop through each packet and create a time vector of conversations, with some averaging window like 30 seconds or 5 minutes.



	{{ScapyFlag}}		{{ScapyFlag}}

Admin: /* Scapy Built-In Conversation Analysis */

2016-01-27T04:39:00Z

Scapy Built-In Conversation Analysis

@@ Line 42: / Line 42: @@
 Further parsing could be done to identify packets that are beacons from access points, to determine which MAC addresses are access points.
-==Scapy Built-In Conversation Analysis==
 {{ScapyFlag}}

Admin: /* Components */

2016-01-27T04:31:54Z

Components

← Older revision		Revision as of 04:31, 27 January 2016
Line 6:		Line 6:

	First is the source address. This will be a MAC address - you will not get an IP address unless you're on the same network and there is some kind of name resolution service available to turn a MAC address (Layer 2) into an IP address (Layer 3).		First is the source address. This will be a MAC address - you will not get an IP address unless you're on the same network and there is some kind of name resolution service available to turn a MAC address (Layer 2) into an IP address (Layer 3).

			===Show the Packet===

			Here is a dead-simple three-line script to show the full contents of the 120th packet:

			<pre>
			from scapy.all import *

			plist = rdpcap("airportSniffNERR6R.cap")

			plist[120].show()
			</pre>

			===Getting Source/Destination Address===

	A simple script to pull out the source and destination of each packet using scapy is given below:		A simple script to pull out the source and destination of each packet using scapy is given below:

	<pre>		<pre>
	~~$ cat analyze.py~~

	from scapy.all import *		from scapy.all import *

Admin: /* Components */

2016-01-26T17:00:45Z

Components

← Older revision		Revision as of 17:00, 26 January 2016
Line 7:		Line 7:
	First is the source address. This will be a MAC address - you will not get an IP address unless you're on the same network and there is some kind of name resolution service available to turn a MAC address (Layer 2) into an IP address (Layer 3).		First is the source address. This will be a MAC address - you will not get an IP address unless you're on the same network and there is some kind of name resolution service available to turn a MAC address (Layer 2) into an IP address (Layer 3).

			A simple script to pull out the source and destination of each packet using scapy is given below:

			<pre>
			$ cat analyze.py

			from scapy.all import *

			plist = rdpcap("airportSniffNERR6R.cap")

			getsrcdst = lambda x:(x.addr1, x.addr2, x.addr3)

			for p in plist:
			try:
			c = getsrcdst(p)
			print c
			except AttributeError:
			pass
			</pre>

			This script reads a relatively small pcap file and prints out the addr1, addr2, and addr3 fields for each packet. This can be used to build a list of MAC addresses.

			Further parsing could be done to identify packets that are beacons from access points, to determine which MAC addresses are access points.

	==Scapy Built-In Conversation Analysis==		==Scapy Built-In Conversation Analysis==