1. Dumps: Read’em and Weep Presented at Black Lodge Research www.blacklodgeresearch.orgwww.blacklodgeresearch.org

2. Legal This presentation is for information and educational use only. None of the techniques described in the following should be used for illegal communications interception. Please be aware of: US Code 18, part 1, section 119: http://uscode.house.gov/download/pls/18C119.txt

3. Covering Today: 1.What 2.Why 3.When 4.How 5.Where 6.Use more Fiber.. 7.Tcp Poké Ball go!

4. What Network dumps tell the truth, the whole truth (if done right) and nothing but the truth, so help them Bruce. Contains the raw data going across the pipes. Troubleshooters best friend and worst nightmare Variety of tools: Tcpdump, wireshark, tshark, CACE pipe,

5. Why Shows what application level analysis can’t, the real data on the wire Makes segmentation of troubleshooting easier For client/support relationship, great way to prove the network is not the problem.

6. When When ever there is trouble, dumps will be there.. Slow network Unexplained behavior Connectivity issues Security Breach Pen Testing Wifi access.. To retrieve your forgotten wifi password. For the fun of it.

7. How Not OS dependant, there is a capture engine for anything Are you Promiscuous? How big can you get? Splitsville? Remote Execution

8. Where Know your network type: Hub - Easy to cap on, tough to find Switch - Easy to find, require different approach to capture on (SPAN, TAP, Mac Flood, MiTM) Wireless - Everywhere, each security type requires a slightly different approach.

9. Where Hub -On same Hub, start capture promiscuous mode - Half duplex ( since all packets go to all ports) Switch -Standard uni-cast, meaning packets go where they should (based on Mac table/arps) - Bummer, can’t listen to all traffic - Solution 1: MaC Flood - Solution 2: Span port - Solution 2: TAP (http://www.lovemytool.com/blog/2007/08/span-ports-or- t.html)

10. Where Wireless - Like dust in the wind, open wifi is free to snag on a promiscuous capable adapter.

11. Use more fiber Filters -Capture Filters http://wiki.wireshark.org/CaptureFilters -Display Filters http://www.wireshark.org/docs/dfref/ - Difference?

12. Tcp Poké Ball go! Capture HTTP Filter Handshake Filter Http Find the photo Capture SSL Version Cipher used? Resume or New? Capture FTP Active or Passive? Determine Ports, filter by port Find the photo Capture Wireless Find HTTP Filter out beacons General: Layer 2 arps, macs, tcp handshakes, windows,