DFIR Chapter 14

Question 1

What is called a when the network is monitored and network data is stored for a certain amount of time? This allows Network Forensics to be performed.

Answer 1

Retention time

Question 2

What are the three main ways that traffic data can be captured?

Answer 2

1. Through packet Captures 2. Logs and 3. NetFlow

Question 3

What is the most efficient method and the most difficult to maintain to capture traffic data?

Answer 3

Packet capture is the most efficient method and most difficult to maintain.

Question 4

What form of traffic data can be collected from host and network devices deployed on the network such as firewall and IPS devices?

Answer 4

Network Logs.

Question 5

What is network protocol developed by Cisco, that monitors network traffic and collects IP traffic information?

Answer 5

NetFlow

Question 6

What is a common tool used for network capture and investigation that is installed by default on most servers and network equipment and can be run via CLI(command Line Interace)?

Answer 6

Tcpdump
(it displays TCP/IP and additional packets that are received or transmitted over the network. It can be used for live , on-demand captures or to save network captures as .pcap files.

Question 7

What can be used for live, on-demand captures or to save network captures as .pcap files?

Answer 7

Tcpdump

Question 8

What supports several flags for a more focused collection of network data as well as filters for the collected data?

Answer 8

Tcp dump

Question 9

What Tcpdump Flag is for (Interface to listen on)?

Answer 9

-i (interface)

[sudo tcpdump -i eth0 -v port 80
-i eth0 - Select eth0 as the interface that the capture is to take place on.

Question 10

What Tcpdump flag is for (Packets to capture)?

Answer 10

-c (packets)

Question 11

What Tcpdump flag is for (Verbose output)?

Answer 11

-v (Verbose)

[sudo tcpdump -i eth0 -v port 80
-v - verbose output that increases the amount of detail shown in the
output, often showing more protocol-specific information.

Question 12

What Tcpdump flag is for (Host to filter by source and destination)?

Answer 12

host (host)

Question 13

What Tcpdump flag is for (port to filter by source and destination)?

Answer 13

tcp port (port)

sudo tcpdump -i eth0 -v port 80

port 80 - port filter to capture only traffic on port 80 (http).

Question 14

What Tcpdump flag is for (boolean operators for complex rules)?

Answer 14

and/or

Question 15

Is it possible to create a packet capture when a rule is triggered?

Answer 15

Yes, on advanced routers and firewalls.

Packet captures can also be configured to start automatically when an event or chain of events are triggered.

Question 16

What acts as a gateway between you and the internet. It’s an intermediary server separating end users from the websites they browse. It provides varying levels of functionality, security, and privacy depending on your case, needs, or company policy?

Answer 16

Proxy Server