Home Lab: Network Forensics with Wireshark and Zeek on Linux

Introduction

Network forensics involves capturing, recording, and analyzing network traffic to detect and investigate security incidents. This advanced-level lab will guide you through using Wireshark and Zeek to perform network forensics on a Linux system. You will learn to capture network traffic, analyze it for suspicious activities, detect intrusions, and understand the network behaviors.

Pre-requisites

Advanced knowledge of Linux operating systems
Understanding of networking concepts and protocols
Familiarity with Wireshark and Zeek
Experience with command-line tools

Lab Set-up and Tools

A computer running a Linux distribution (e.g., Ubuntu)
Wireshark installed
Zeek installed
Network traffic generator or sample pcap files

Installing Wireshark

Update your package list:
```
sudo apt update
```
Install Wireshark:
```
sudo apt install wireshark
```

Installing Zeek

Update your package list:
```
sudo apt update
```

Install dependencies:

sudo apt install cmake make gcc g++ flex bison libpcap-dev libssl-dev python3 python3-dev zlib1g-dev

Download and install Zeek:

wget https://download.zeek.org/zeek-3.0.0.tar.gz
tar -xvzf zeek-3.0.0.tar.gz
cd zeek-3.0.0
./configure
make
sudo make install

Exercises

Exercise 1: Capturing Network Traffic with Wireshark

Objective: Capture live network traffic using Wireshark.

Open Wireshark.
Select the network interface to capture traffic from (e.g., eth0 or wlan0).
Click the "Start Capturing Packets" button (blue shark fin).
Perform some network activities (e.g., browsing the web).
Stop the capture after a few minutes.
Save the captured traffic to a pcap file.

Expected Output: A pcap file containing captured network traffic.

Exercise 2: Analyzing Network Traffic with Wireshark

Objective: Analyze the captured network traffic to identify suspicious activities.

Open the pcap file in Wireshark.
Apply filters to focus on specific types of traffic (e.g., http, tcp, dns).
Identify and document any anomalies or suspicious activities in the traffic.
Use Wireshark's protocol hierarchy and statistics tools for deeper analysis.

Expected Output: A detailed analysis report of the captured network traffic, highlighting any suspicious activities.

Exercise 3: Setting Up Zeek for Real-Time Network Monitoring

Objective: Configure Zeek for real-time network traffic monitoring.

Configure Zeek for your network interface:
```
sudo nano /usr/local/zeek/etc/node.cfg
```
Update the interface line to your network interface (e.g., eth0).
Deploy Zeek:
```
sudo /usr/local/zeek/bin/zeekctl deploy
```
Verify that Zeek is running and monitoring network traffic:
```
sudo /usr/local/zeek/bin/zeekctl status
```

Expected Output: Zeek configured and running, monitoring real-time network traffic.

Exercise 4: Detecting Intrusions with Zeek

Objective: Use Zeek to detect network intrusions and analyze logs.

Generate network traffic that simulates an attack (e.g., using a network traffic generator or replaying a malicious pcap file).
Check Zeek logs for any alerts or indicators of compromise:
```
sudo cat /usr/local/zeek/logs/current/notice.log
```
Analyze the logs to understand the nature and source of the intrusion.
Document your findings and any indicators of compromise.

Expected Output: Detailed log entries of detected intrusions, with an analysis report of the findings.

Exercise 5: Creating Custom Zeek Scripts for Detection

Objective: Develop and deploy custom Zeek scripts to detect specific network activities.

Create a custom Zeek script to detect a specific type of network activity (e.g., scanning):

sudo nano /usr/local/zeek/share/zeek/site/local.zeek

Add the script content:

event connection_established(c: connection) {
    if ( c$resp_h in Site::local_nets && c$resp_p == 80/tcp ) {
        print fmt("HTTP connection to local network: %s -> %s", c$id$orig_h, c$id$resp_h);
    }
}

Deploy the script:
```
sudo /usr/local/zeek/bin/zeekctl deploy
```
Generate network traffic that matches the script criteria and verify detection in the logs.

Expected Output: Custom detection logs in Zeek, verifying the functionality of the custom script.

Conclusion

By completing these exercises, you have gained advanced skills in network forensics using Wireshark and Zeek on a Linux system. You have learned to capture and analyze network traffic, configure Zeek for real-time monitoring, detect intrusions, and create custom scripts for specific detections. These skills are essential for performing comprehensive network forensic investigations and enhancing network security.

About Me

I am a cybersecurity trainer with a passion for teaching and helping others learn essential cybersecurity skills through practical, hands-on projects. Connect with me on social media for more updates and resources:

Feel free to reach out with any questions or feedback. Happy learning!