2013-12-05_tcpflow-and-BE-update

More documents

Recommendations

Info

With cross-drive analysis, we could find drives that hadbeen on the same network.ResultsCross-Drive MAC AnalysisCross-Drive MAC AnalysisMany RDC images bought in batchesWe find 16 Ethernet common between images!Graph shows 8 distinct clusters:IN10-0561.E01cn20-01.aff00:04:ED:66:C7:1900:26:18:BD:D9:E9IN10-0050.E0100:05:5F:EF:14:0100:15:F2:4B:E5:1EIN10-0562.E01IN10-0118.E01IN10-0095.E0100:1E:A6:01:9E:3Ath01-01.affIN10-0010.E01IN10-0048.E01IN10-0014.E0101:00:5E:7F:FF:FAIN10-0052.E0100:1B:B9:9B:D5:BBPS01-021.affil38.affIN10-0413.E01 00:16:76:A2:60:6E IN10-0414.E01il04.aff00:1B:B9:9B:D3:61IN10-0047.E0100:1B:B9:9C:47:67IN10-0049.E01PS01-036.aff00:50:04:EE:6C:F9IN10-0051.E0100:1E:90:D5:EE:5Ecn4-06.aff 00:D0:B7:69:0A:41 1039.affil02.aff00:1E:90:DE:F1:07IN10-0009.E01il42.aff 00:E0:D0:13:14:94 mx5-30.aff00:0E:90:D5:E6:5ER. Beverly, S. Garfinkel, G. Cardwell (NPS) Network Carving DFRWS 2011 25 / 2857
BE 1.3 put MAC addresses in ether.txt andether_histogram.txt files.342699417 00:80:77:31:01:07 n008077310107 1 00:80:77:31:01:07 192.168.1.2 an342700437 00:80:77:31:01:07 the following: 00:80:77:31:01:07 brn008077310107342703371 00:80:77:31:01:07 -s 192.168.1.2 00:80:77:31:01:07 ping 192.168.559251251 00:80:77:31:01:07 N008077310107 1 00:80:77:31:01:07 192.168.1.200:80:77:31:01:07 BRN0080773101684600847 00:80:77:31:01:07 -s 192.168.1.2 00:80:77:31:01:07
Page 1 and 2:
TCPBEflowTCP analysis with tcpflow;
Page 3 and 4:
tcpflow is a command-line tool for
Page 6 and 7:
tcpflow turns each side of the TCP
Page 8 and 9:
tcpflow turns each side of the TCP
Page 10 and 11: tcpflow turns each side of the TCP
Page 12 and 13: tcpflow turns each side of the TCP
Page 14 and 15: tcpflow automatically bins connecti
Page 16 and 17: eport.xml is a DFXML file that reco
Page 18 and 19: tags generated by tcpflow match fiw
Page 20 and 21: Harassment atNITROBAState Universit
Page 22 and 23: To find out what's going on,Nitroba
Page 24 and 25: How to solve this problem:NITROBASt
Page 26 and 27: Slides omitted
Page 28 and 29: tcpflow addresses important “real
Page 30 and 31: 26tcpflow makes transcripts from ea
Page 32 and 33: 28tcpflow makes transcripts with mi
Page 34 and 35: 30tcpflow will detect and split gig
Page 36 and 37: tcpflow 1.4 uses the bulk_extractor
Page 38 and 39: SSL decryption issuesOptions for de
Page 40 and 41: The actual cipher suites used when
Page 42 and 43: 808023One-page visualization of pac
Page 44 and 45: Radiotap information available at T
Page 46 and 47: 802.11 link-layer information avail
Page 48 and 49: plot_wifi_aps.py will transform thi
Page 50 and 51: BEbulk_extractorimprovements
Page 53 and 54: zip.txt — potential zipfile heade
Page 55 and 56: Beverly, Robert, Simson Garfinkel a
Page 57 and 58: Are low-level binary network data s
Page 59: Hibernation decompression found eve
Page 63 and 64: ip_histogram.txt removes random noi
Page 65 and 66: pcap files are a common file format
Page 67 and 68: We find a lot of packets on disks!A
Page 69 and 70: The big picture:using low-probabili
show all

2013-12-05_tcpflow-and-BE-update

Create successful ePaper yourself

Delete template?

Save as template?