Python Passive Network Mapping

P2NMAP

Chet Hosmer

• Publisher: Syngress
• Year: 2015
• Print ISBN: 9780128027219
• eBook ISBN: 9780128027424
• Topic: Computer Science
• Subtopic: Computer Networking
• Index: Computer Science

Python Passive Network Mapping: P2NMAP is the first book to reveal a revolutionary and open source method for exposing nefarious network activity. The "Heartbleed" vulnerability has revealed significant weaknesses within enterprise environments related to the lack of a definitive mapping of network assets. In Python Passive Network Mapping, Chet Hosmer shows you how to effectively and definitively passively map networks. Active or probing methods to network mapping have traditionally been used, but they have many drawbacks - they can disrupt operations, crash systems, and - most importantly - miss critical nefarious activity. You require an accurate picture of the environments you protect and operate in order to rapidly investigate, mitigate, and then recover from these new attack vectors. This book gives you a deep understanding of new innovations to passive network mapping, while delivering open source Python-based tools that can be put into practice immediately. Python Passive Network Mapping is for practitioners, forensic investigators, IT teams, and individuals who work together when performing incident response and investigating potential damage, or are examining the impacts of new malware threats. Those defending critical infrastructures will have a special interest in this book, as active or probing methods of network mapping are rarely used within these environments as any resulting impacts can be disastrous. Python Passive Network Mapping is ideally suited for use as a text in a variety of academic programs to expose and engage students in the art of passively mapping enterprise networks, with the added benefit of providing exposure to open source Python solutions. - First book to show you how to use open source Python to conduct passive network mapping - Provides a new method for conducting incident response and investigating the extent of potential damage to your systems - Python code forensics toolkit for network mapping included on the companion website

Chapter 1

Introduction

Abstract

This chapter provides an overview of traditional and passive network mapping. The chapter introduces the concept of Python Passive Network Mapping (P2NMAP) and examines the pros and cons of such an approach. The chapter also examines some of the dangers and pitfalls of active network scanning, especially in critical infrastructure based environments.

Keywords

Python

Passive

Network

Mapping

Nmap

Zenmap

ping

icmp

tcpdump

echo

reply

“Measure what is measurable, and make measurable what is not so.”

Galileo Galilei

Contents

Conventions Used in This Text 1

So What is a Ping Anyway? 5

What is Python Passive Network Mapping or P2NMAP? 10

Why Does This Method Cast a Larger Net? 12

How Can Active Network Mapping Actually Hurt You? 13

Organization of the Book 14

Review 14

Summary Questions 15

Conventions Used in This Text

I use standard typographical conventions (bold, italics, etc.), to highlight text that stands out from the overall body of the paragraph. The font styles I will be using throughout the text are:

Italic

Used for file and directory names and to emphasize terms

Constant width

Used for code listings and script generated output

Constant Width and Bold

Used for user input

Enterprise Networks today are complex, difficult to investigate, require specialized tools and demand exceptional and expert skills in order to properly respond to incidents. When dealing with incidents that involve critical infrastructure or other regulated industry environments the specialization of the toolkits can indeed be daunting.

One of the first challenges that face incident response teams and forensic investigation units is “What does your network consist of and how is it configured?” This may seem like a simple question that is easily answered by the Information Technology group. However, when responding to incidents like Heartbleed, Operation Shady Rat, and breaches at major retailers, the technical information and details regarding the network map can be vital.

More specific questions may also include:

▪ What internet protocol (IP) addresses and subnets do you operate?

▪ What servers and end points are running?

▪ Are the Servers local, hosted at an external site or in the cloud?

▪ What Operating Systems are in use? What versions and are they up-to-date?

▪ What Services (open ports) are available on each server and host?

▪ What applications and databases are in use?

▪ How is your network configured, protected and isolated?

▪ What connections are allowed between servers, hosts and Internet users?

▪ Wh...

Table of contents

• Cover
• Title page
• Table of Contents
• Copyright
• Dedication
• Biography
• Preface
• Acknowledgments
• Chapter 1: Introduction
• Chapter 2: What You DON’T Know About Your Network
• Chapter 3: Capturing Network Packets Using Python
• Chapter 4: Packet Capture Analysis
• Chapter 5: PCAP Extractor and OS Fingerprinting
• Chapter 6: Future Considerations and Challenge Problems
• Subject Index