3A. Analyse network Monitoring Output obj 3.1, 4.4

Question 1

What is a SPAN?

Answer 1

Switch Port Analyser
- SPAN allows for traffic from one or more networks to be mirrored to a single monitoring port that can be analysed using network analysis tools e.g., Wireshark

Question 2

What is a TAP?

Answer 2

Test Access Port
- A TAP allows an admin to insert a device the monitor traffic at the physical layer, without interfering with the network. There are 2 types of TAP:
1) Passive - allows admin to monitor without making changes to the network
2) Active - allows admin to make operations on network traffic e.g., filtering, port forwarding

Question 3

Where are sniffers typically placed?

Answer 3

Inside a firewall or close to a high priority server. The goal is to identify malicous traffic that has bypassed the firewall.

Question 4

Ways to identify an ARP Spoofing attack?

Answer 4

1. Different IP addresses are advertised to the same MAC address
   2.

Question 5

What is a flow collector?

Answer 5

A means of recording metadata and statistics about network traffic rather than recording each frame. It is a solution to organisations that do not have the resources to Full Packet Capture all the time.

Question 6

What is netflow?

Answer 6

A means of reporting network flow information to a database. It provides the following:
- networking protocol interface used
- version and type of IP used
- src/dst of IP address
- src/dst of UDP/TCP
- IP’s Type of Service (ToS)

Question 7

What is Zeek?

Answer 7

Zeek acts as a resource saving tool by operating as a passive network monitor, working in the same manner as a sniffer, but instead of recording/storing large quantities of data, instead logs only data of potential interest, reducing storage/processing requirements.

Question 8

What are DGAs?

Answer 8

Domain Generation Algorithm
- used by malware packages to dynamically generate domain names, used for C2, from a known seed

Question 9

Ways to identify DGAs

Answer 9

1) DGAs can produce long DNS labels that can be identified through expression matching filters
2) High rate of NXDOMAIN errors returned to client or logged by local DNS resolver
3) May have higher levels of entropy, or lower numbers of vowels

Question 10

URL Analysis tools can:

Answer 10

1) Resolve percent encoding
2) assess URL redirects
3) show source code for scripts a URL might call

Question 11

what does HTTP 200 response code indicate?

Answer 11

A successful GET or POST request (OK)

Question 12

what does HTTP 201 response code indicate?

Answer 12

Successful PUT request in creating a resource

Question 13

what does HTTP 3xx response code indicate?

Answer 13

Indicates a Redirect

Question 14

what does HTTP 4xx response code indicate?

Answer 14

Indicates an error in the client request e.g., lack of authentication credentials (401), lack of permissions (403)

Question 15

what does HTTP 5xx response code indicate?

Answer 15

Indicates server-side issue