Network Security Ethereal NETWORKING LAB Outline Network Network

Network Security - Ethereal 실습 NETWORKING LAB.

Outline • Network – Network 구조 – Source-to-Destination간 packet 전달 과정 • Packet Capturing – Packet Capture의 원리 – Data Link Layer의 동작 • Ethereal 소개 • Ethereal 설치 • Ethereal 사용법

End-to-End delivery(1/2) • End-to-End delivery시 모든 multi-hop을 거치면서 packet이 전달된다

End-to-End delivery (2/2) Source Destination Applications TCP TCP IP IP IP LAN Technologies: Ethernet, FDDI, etc

Packet Capture Source Destination Applications TCP TCP IP IP IP LAN Technologies: Ethernet, FDDI, etc

Data Link Layer Procedure • Promiscuous mode와 Non-promiscuous mode Upper Layer MAC address 일치 Data Link Layer MAC address 불일치 Physical Layer Data Link Layer에서의 동작

Dummy HUB environment Internet Gateway Router Dummy HUB PC A PC D PC B PC C

Packet Capture Tool Characteristic Socket Applications Sockets TCP IP LAN Technologies: Ethernet, FDDI, etc • OS independent Packet capture library – lib. PCAP OS • interface OS dependent Packet capture Tools – – – – BPF(Berkeley Packet Filter) DLPI NIT SNOOP SNIT SOCK_PACKET LSF(Linux Socket Filter) drain

Tools Introduction(1/3) • Win. PCAP(Windows Packet CAPture library) – Win 32 platform용 packet capture tool – Network analyzing library – 오픈 소스 – lib. PCAP(UNIX library)의 windows 버전 – http: //www. winpcap. org

Tools Introduction(3/3) • tcpdump(Win. Dump) – Command line traffic analyzer – 802. 11 b/g wireless capture 지원 – lib. PCAP(Win. PCAP) library와 driver 사용 – http: //www. tcpdump. org/ – http: //www. winpcap. org/windump/

Tools Introduction(2/3) • Ethereal – 가장 대표적인 Network Analyzer – 오픈 소스 – 강력한 필터 기능이 특징 – Win. PCAP library와 driver 이용 – http: //www. ethereal. com • Smart. Sniff – 간단한 스니퍼 – 같은 종류의 패킷을 축적하여 보여준다 – Win. PCAP library와 driver 이용 – http: //www. nirsoft. net