Beginner Labs
Lab 1 - The Overview

Beginner Lab: 1

  • Beginner Lab
  • Capturing and Analyzing Traffic with Wireshark
  • Intermediate Lab
  • Analyzing Network Traffic with Arkime and Driftnet.io
  • Expert Lab
  • Advanced Traffic Analysis with Custom Terminal.js Emulation
  • Combining Wireshark, Arkime, Driftnet.io, and JA4DB

Beginner Lab

Objective

Learn how to capture network traffic using Wireshark, identify TCP SYN packets, and generate JA4T fingerprints to understand TCP client behaviors.

Tools Required

  • Wireshark: A network protocol analyzer used for network troubleshooting, analysis, and education.

Prerequisites

  • Basic understanding of TCP/IP networking.
  • Administrative access to install and run Wireshark on your machine.

Lab Steps

Step 1: Install Wireshark

  1. Download Wireshark:
  • Navigate to the Wireshark Download Page.
  • Choose the appropriate installer for your operating system (Windows, macOS, Linux).
  1. Install Wireshark:
  • Run the installer and follow the on-screen instructions.
  • For Windows users, ensure you install the "NPcap" packet capture library when prompted.

Step 2: Launch Wireshark and Select Network Interface

  1. Open Wireshark:
  • Double-click the Wireshark icon to launch the application.
  1. Select Network Interface:
  • On the main screen, you will see a list of available network interfaces.
  • Choose the interface that is connected to the internet (e.g., Ethernet, Wi-Fi).

Step 3: Start Packet Capture

  1. Begin Capturing:
  • Double-click on the selected network interface to start capturing packets.
  1. Generate Network Traffic:
  • Open a web browser or any network-enabled application to initiate new TCP connections.
  • Visit various websites to generate traffic.

Step 4: Stop Packet Capture

  1. Stop Capturing:
  • Click the Red Square icon or press Ctrl + E to stop capturing packets after sufficient data has been collected.

Step 5: Filter and Analyze Captured Packets

  1. Apply Display Filter for TCP SYN Packets:
  • In the display filter bar (located just below the toolbar), enter:
tcp.flags.syn == 1 && tcp.flags.ack == 0
  • Press Enter to apply the filter. This will display only TCP SYN packets initiating connections.
  1. Examine Packet Details:
  • Click on a packet in the list to view its details.
  • Expand the Internet Protocol Version 4 section to find the Time to live (TTL) value.
  • Expand the Transmission Control Protocol section to view:
  • Source Port and Destination Port
  • Sequence Number
  • Window Size Value
  • TCP Options (if any)

Step 6: Extract TCP Options and Header Information

  1. Locate TCP Options:
  • Within the Transmission Control Protocol section, find the Options field.
  • Expand Options to see the list of TCP options included in the packet.
  1. Record TCP Options and Order:
  • Note down the options and the order they appear. Common options include:
  • Maximum Segment Size (MSS)
  • Window Scale (WS)
  • SACK Permitted
  • Timestamps
  1. Record Window Size and TTL:
  • Window Size Value: Found under the TCP header details.
  • TTL (Time To Live): Found under the IP header details.

Step 7: Construct the JA4T Fingerprint

  1. Format the Fingerprint:
  • Use the structure:
f<tcp_flags>_o<tcp_options_hash>_ws<window_size>_ttl<ttl>_ip<ip_options_hash>
  1. Determine TCP Flags:
  • For a SYN packet, the flag is S.
  1. Hash TCP Options:
  • Create a list of TCP option kinds in the order they appear.
  • For example, options might be represented as [MSS, SACK Permitted, Timestamps, Window Scale] corresponding to option kinds [2, 4, 8, 3].
  • Concatenate the option kinds and compute a hash.
  • Example using Python:
import hashlib
 
options = [2, 4, 8, 3]
options_bytes = bytes(options)
options_hash = hashlib.sha1(options_bytes).hexdigest()[:5]
print(options_hash)

Let's assume the hash computed is 7a5b6.

  1. Hash IP Options:
  • If there are no IP options, use 000.
  1. Assemble the Fingerprint:
  • Suppose:
  • TCP Flags: S
  • TCP Options Hash: 7a5b6
  • Window Size: 65535
  • TTL: 128
  • IP Options Hash: 000
  • The JA4T fingerprint would be:
fS_o7a5b6_ws65535_ttl128_ip000

Step 8: Interpret the Fingerprint

  1. Identify the Operating System:
  • Certain TCP option patterns and window sizes are indicative of specific operating systems.
  • For example:
  • Window Size of 65535 and TTL of 128 often correspond to Windows machines.
  • Window Size of 29200 and TTL of 64 might indicate a Linux system.
  1. Compare with Known Fingerprints:
  • Visit JA4DB to compare your fingerprint with known profiles.
  • Enter your JA4T fingerprint into the search bar to see matching client profiles.

Step 9: Document Your Findings

  1. Create a Report:
  • Summarize the steps taken.
  • Include screenshots of Wireshark with relevant packet details.
  • Present the constructed JA4T fingerprint and its interpretation.
  1. Reflect on the Exercise:
  • Consider how JA4T fingerprints can help in identifying client devices.
  • Think about potential applications in network security and monitoring.
Lab 0 - ReflectLab 2: JA4T