Login

**NINZA** · 05-14-2020, 06:46 AM

0			0

Suricata is developed by the Open Information Security Foundation. Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by the OISF and its supporting vendors.
Features
IDS / IPS
Suricata implements a complete signature language to match on known threats, policy violations and malicious behaviour. Suricata will also detect many anomalies in the traffic it inspects. Suricata is capable of using the specialized

[To see content please register here]

and the

[To see content please register here]

.
High Performance
A single Suricata instance is capable of inspecting multi-gigabit traffic. The engine is built around a multi threaded, modern, clean and highly scalable code base. There is native support for hardware acceleration from several vendors and through PF_RING and AF_PACKET.
Automatic protocol detection
Suricata will automatically detect protocols such as HTTP on any port and apply the proper detection and logging logic. This greatly helps with finding malware and CnC channels.
NSM: More than an IDS
Suricata can log HTTP requests, log and store TLS certificates, extract files from flows and store them to disk. The full pcap capture support allows easy analysis. All this makes Suricata a powerful engine for your Network Security Monitoring (NSM) ecosystem.
From:

[To see content please register here]

Lets Begin!!
We had chosen Ubuntu operating system for installation and configuration of suricata. Earlier than installing suricata in your machine, you should need to install necessary dependencies of Ubuntu. Therefore open the terminal and type given below command to install per-requisites by a making update.
apt-get update
1
apt-get update
[Image: 1.png?w=687&ssl=1]

It is an easiest way to install and configure the suricata in your system because it’s entire requirement whether it is suricata rules directory or logging directory every packages is are stored by apt repository. Enter given below command to begin the suricata installations.
apt-get install suricata -y
1
apt-get install suricata -y
[Image: 2.png?w=687&ssl=1]

Now we need to create an empty text document file for our local rules inside rule folder of suricata
touch /etc/suricata/rules/local.rules
1
touch /etc/suricata/rules/local.rules

After then open the configuration file using gedit for making some changes inside.
gedit /etc/suricata/suricata-debian.yaml
1
gedit /etc/suricata/suricata-debian.yaml

The two most important steps we need to perform here:

Comment all others available file of rules so that only yours local rule file will be in priority.
Mention the local.rules under the rule files list.

Now add the network CIDR for which IDS will filter the incoming and outgoing traffic as shown in given below image.
Here we had set HOME_NET 192.168.1.0/24
[Image: 6.png?w=687&ssl=1]

Now open the local rule file to add your own network filtering rules in side it
gedit /etc/suricata/rules/local.rules
1
gedit /etc/suricata/rules/local.rules

Now if you are not much aware about its rule configuration then you need not to be worry about it because implementing rule in suricata is as similar as in snort. For help open this

[To see content please register here]

to get details of IDS rule implementation.
alert icmp any any -> 192.168.1.111 any (msg: “ICMP detected”; sid:10000001 Wink

1
alert icmp any any -> 192.168.1.111 any (msg: “ICMP detected”; sid:10000001 Wink

The above rule will generate an alert when found any network IP sending ICMP packets in our network by pinging IP 192.168.1.111.
[Image: 8.png?w=687&ssl=1]

Now execute following command to make GRO (Generic receive offload) disable on specific interfaces with help of Ethtool.
ethtool -K ens33 gro off
1
ethtool -K ens33 gro off

Then again turn On NIDS mode of surictata using given below command.
suricata -c /etc/suricata/suricata-debian.yaml -i ens33
1
suricata -c /etc/suricata/suricata-debian.yaml -i ens33
[Image: 10.png?w=687&ssl=1]

Now let’s ping the IP: 192.168.1.111 from another system to test whether our NIDS will generate alert for ICMP packet or not. From given image you can read the command: ping 192.168.1.111 where you can observe it has sent 3 ICMP request packets.
[Image: 11.png?w=687&ssl=1]

Basically suricata alert logs are generated under var/log and you can use given below command to read the captured logs.
tail -f /var/log/suricata/
1
tail -f /var/log/suricata/
As result suricata with NIDS mode had capture only 3 ICMP packets from IP 192.168.1.102 which you can observe from given below image that generated alert for “ICMP Detected”, this happens because in above rule we had applied “->”one-directional operators which mean it will only capture traffic coming from source IP to destination IP.
Here you can perceive that both two packets of ICMP is coming from 192.168.1.102 to 192.168.1.111 which means it has only captured ICMP Echo-request packets form source IP.
[Image: 12.png?w=687&ssl=1]

Hello friends!! Today we are going to discuss how to “Detect SQL injection attack” using Snort but before moving ahead kindly read our previous both articles related to Snort Installation (

[To see content please register here]

or using

[To see content please register here]

)and its

[To see content please register here]

to enable it as IDS for your network.
Basically In this tutorial we are using snort to capture the network traffic which would analysis the SQL Injection quotes when injected in any web page to obtain information of database system of any web server. Snort will generate the alert for malicious traffic when caught those traffic in its network and network administers will immediately get attentive against suspicious traffic and could take effective action against the attacking IP.
Requirement
IDS: Snort (Ubuntu)
Web application: Dhakkan
You can configure your own web server by taking help of our article “

[To see content please register here]

”
Let’s Begin!!
Identify Error Based SQL Injection
As we know in Error based SQL injections the attacker use single quotes (‘) or double quotes (“) to break down SQL query for identify its vulnerability. Therefore be smart and add a rule in snort which will analyst Error based SQL injection on the server when someone try to execute SQL query in your network for unprivileged access of database.
Execute given below command in ubuntu’s terminal to open snort local rule file in text editor.
sudo gedit /etc/snort/rules/local.rules
1
sudo gedit /etc/snort/rules/local.rules
Now add given below line which will capture the incoming traffic coming on any network IP via port 80.
alert tcp any any -> any 80 (msg: "Error Based SQL Injection Detected"; content: "%27" ; sid:100000011; )
alert tcp any any -> any 80 (msg: "Error Based SQL Injection Detected"; content: "22" ; sid:100000012; )
1
2
alert tcp any any -> any 80 (msg: "Error Based SQL Injection Detected"; content: "%27" ; sid:100000011; )
alert tcp any any -> any 80 (msg: "Error Based SQL Injection Detected"; content: "22" ; sid:100000012; )
If you read above rule you can notice that I had applied filter for content “%27” and %22 are URL encoded format use in browser for single quotes(‘) and double quotes (“) respectively at the time of execution of URL.
Turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 1.png?w=687&ssl=1]

Now test your above rule by making Error based sql injection attack on web application “Dhakkan”, therefore open the server IP in web browser and use single quotes (‘) for identify SQL injection vulnerability as shown below.
192.168.1.20/sqli/Less-1/?id=1'
1
192.168.1.20/sqli/Less-1/?id=1'
For more detail on Error Based SQL injection read our

[To see content please register here]

article.
Now when attacker will execute malicious quotes in browser for testing Error Base SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 2.png?w=687&ssl=1]

As per our prediction from given image you can observe the snort has gerenated alert for Error Based sql injection when capture malicious quotes.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicous traffic is coming form 192.168.1.21 on port 80.
[Image: 3.png?w=687&ssl=1]

Testing Double Quotes Injection
Now again open the server IP in web browser and use double quotes (“) for identify SQL injection vulnerability as shown below.
192.168.1.20/sqli/Less-4/?id=1"
1
192.168.1.20/sqli/Less-4/?id=1"
Now when attacker will execute malicious quotes in browser for testing Double quotes SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 4.png?w=687&ssl=1]

From given image you can observe the snort has generated alert for Error Based sql injection when capture malicious quotes.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming from 192.168.1.21 on port 80.
[Image: 5.png?w=687&ssl=1]

Boolean Based SQL Injection
As we know in Boolean based SQL injections the attacker use AND /OR operators where attacker will try to confirm if the database is vulnerable to Boolean SQL Injection by evaluating the results of various queries which return either TRUE or FALSE.
Now add a rule in snort which will analyse Boolean based SQL injection on the server when someone try to execute SQL query in your network for unprivileged access of database. Here I had applied filter for content “and” & “or” to be captured. Here nocase denotes not case sensitive it can be as AND/and, OR/or.
alert tcp any any -> any 80 (msg: "AND SQL Injection Detected"; content: "and" ; nocase; sid:100000060; )
alert tcp any any -> any 80 (msg: "OR SQL Injection Detected"; content: "or" ; nocase; sid:100000061; )
1
2
alert tcp any any -> any 80 (msg: "AND SQL Injection Detected"; content: "and" ; nocase; sid:100000060; )
alert tcp any any -> any 80 (msg: "OR SQL Injection Detected"; content: "or" ; nocase; sid:100000061; )
Turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 6.png?w=687&ssl=1]

Again open the server IP in web browser and use AND operator for identify Boolean SQL injection vulnerability as shown below.
192.168.1.20/sqli/Less-8/?id=1' AND 1=1 --+
1
192.168.1.20/sqli/Less-8/?id=1' AND 1=1 --+
For more detail on Boolean Based SQL injection read our

[To see content please register here]

article.
Now when attacker will execute malicious quotes in browser for testing Boolean Base SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 7.png?w=687&ssl=1]

Testing OR Operator
As per our calculation from given image you can observe the snort has generated alert for Boolean Based sql injection when captured content AND.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming form 192.168.1.21 on port 80.
[Image: 8.png?w=687&ssl=1]

Again open the server IP in web browser and use OR operator to identify Boolean SQL injection vulnerability as shown below.
192.168.1.20/sqli/Less-8/?id=1' OR 1=1 --+
1
192.168.1.20/sqli/Less-8/?id=1' OR 1=1 --+
Now when attacker will execute malicious quotes in browser for testing Boolean Base SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 9.png?w=687&ssl=1]

As per our calculation from given image you can observe the snort has generated alert for Boolean Based sql injection when captured content OR.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming form 192.168.1.21 on port 80.
[Image: 10.png?w=687&ssl=1]

Encoded AND/OR
Similarly in given below rule I had applied filter for content “%26%26” and “%7c%7c” are URL encoded format use in browser for && and || respectively at the time of execution of URL.
alert tcp any any -> any 80 (msg: "AND SQL Injection Detected"; content: "and" ; nocase; sid:100000008; )
alert tcp any any -> any 80 (msg: "OR SQL Injection Detected"; content: "or" ; nocase; sid:100000009; )
1
2
alert tcp any any -> any 80 (msg: "AND SQL Injection Detected"; content: "and" ; nocase; sid:100000008; )
alert tcp any any -> any 80 (msg: "OR SQL Injection Detected"; content: "or" ; nocase; sid:100000009; )
Turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 11.1.png?w=687&ssl=1]

Again open the server IP in web browser and use && operator for identify Boolean SQL injection vulnerability as shown below.
192.168.1.20/sqli/Less-25/?id=1’ %26%26 1==1 --+
1
192.168.1.20/sqli/Less-25/?id=1’ %26%26 1==1 --+
For more details read our

[To see content please register here]

article
Now when attacker will execute malicious quotes in browser for testing Boolean Base SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 11.2.png?w=687&ssl=1]

As per our calculation from given image you can observe the snort has generated alert for Boolean Based sql injection when captured content %26%26.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming form 192.168.1.21 on port 80.
[Image: 11.3.png?w=687&ssl=1]

Testing Encoded OR Operator
Again open the server IP in web browser and use || operator for identify Boolean SQL injection vulnerability as shown below.
192.168.1.20/sqli/Less-25/?id=1' %7C%7C 1==1 --+
1
192.168.1.20/sqli/Less-25/?id=1' %7C%7C 1==1 --+
Now when attacker will execute malicious quotes in browser for testing Boolean Base SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 11.4.png?w=687&ssl=1]

As per our calculation from given image you can observe the snort has generated alert for Boolean Based sql injection when captured content %7C %7C.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming form 192.168.1.21 on port 80.
[Image: 11.5.png?w=687&ssl=1]

Identify Form Based SQL Injection
The Form Based SQL injection also known as “Post Error based SQL injection” because the attacker executes malicious quotes inside Login form of a web page that contains text field for username and password to login inside web server.
Therefore now add a rule in snort which will analyst Form based SQL injection on the server when someone try to execute SQL query in your network for unprivileged access of database.
alert tcp any any -> any 80 (msg: "Form Based SQL Injection Detected"; content: "%27" ; sid:1000003; )
1
alert tcp any any -> any 80 (msg: "Form Based SQL Injection Detected"; content: "%27" ; sid:1000003; )
If you read above rule you can notice that I had applied filter for content “%27” to be captured; turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 11.png?w=687&ssl=1]

I had used single quotes (‘) to break the query inside the text field of username then click on submit.
Username: ’
From the given screenshot you can see we have got error message (in blue color) which means the database is vulnerable to SQL injection.
For more detail on Form Based SQL injection read our

[To see content please register here]

article.
Now when attacker will execute malicious quotes in browser for testing Form Base SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 12.png?w=687&ssl=1]

As per our prediction from given image you can observe the snort has generated alert for Form Based sql injection when capture malicious quotes.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming form 192.168.1.21 on port 80.
[Image: 13.png?w=687&ssl=1]

Identify Order by SQL Injection
In order to identify number of column in database the un-trusted user may use order by clause which will arrange the result set in ascending or descending order of the columns used in the query.
Now add a rule in snort which will analyst order by SQL injection on the server when someone try to execute SQL query in your network for unprivileged access of database. Here again that I had applied filter for content “order” to be captured.
alert tcp any any -> any 80 (msg: "Order by SQL Injection"; content: "order" ; sid:1000005; )
1
alert tcp any any -> any 80 (msg: "Order by SQL Injection"; content: "order" ; sid:1000005; )
Turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 14.png?w=687&ssl=1]

Now again open the server IP in web browser and use string order by for identify column of database as shown below.
192.168.1.20/sqli/Less-1/?id=1' order by 1,2,3 --+
1
192.168.1.20/sqli/Less-1/?id=1' order by 1,2,3 --+
Now when attacker will execute malicious string in browser for testing order by SQL injection then the IDS of the network should also capture this content and will generate the alert
[Image: 15.png?w=687&ssl=1]

As per our prediction from given image you can observe the snort has generated alert for order by sql injection when capture malicious string.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming form 192.168.1.21 on port 80.
[Image: 16.png?w=687&ssl=1]

Identify Union Based SQL Injection
We all know in Error base SQL injection attacker may use the UNION operator to combine the result-set of two or more SELECT statements. Therefore add a rule in snort which will analyst Union select SQL injection on the server when someone try to execute SQL query in your network for unprivileged access of database. Here again that I had applied filter for content “union” to be captured.
alert tcp any any -> any 80 (msg: "UNION SELECT SQL Injection"; content: "union" ; sid:1000006; )
1
alert tcp any any -> any 80 (msg: "UNION SELECT SQL Injection"; content: "union" ; sid:1000006; )
Turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 17.png?w=687&ssl=1]

Now again open the server IP in web browser and use string order by for identify column of database as shown below.
192.168.1.20/sqli/Less-1/?id=-1' union select 1,2,3 --+
1
192.168.1.20/sqli/Less-1/?id=-1' union select 1,2,3 --+
Now when attacker will execute malicious string in browser for testing Union select SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 18.png?w=687&ssl=1]

As per our prediction from given image you can observe the snort has generated alert for union select sql injection when capture malicious string.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming form 192.168.1.21 on port 80.
[Image: 19.png?w=687&ssl=1]

Hello Friends!! You must be heard of the latest vulnerbility “Meltdown” which has been discovered almost in every CPU having intel processessor, from this

[To see content please register here]

you can check list of vulnerable CPU discription. Today we are going to disccuss how to “Check Metltadown vulnerability in any CPU” by using a script.
From Wikipedia
Meltdown is a hardware vulnerability affecting Intel x86 microprocessors and some ARM-based microprocessors. It allows a rogue process to read any physical, kernel or other process’s mapped memory, regardless of whether or not it should be able to do so. It allows an unauthorized process to read data from any address that is mapped to the current process’s memory space, because instruction pipelining in the affected processors means that the data from the unauthorized address will almost always be temporarily loaded into the CPU’s cache during speculative execution, from which it can be recovered using other techniques, even if the original read instruction eventually fails due to privilege checking and never produces a readable result. Since many operating systems map physical memory, kernel processes, and other running user space processes into the address space of every process and rely on privilege checking to prevent unauthorized access, Meltdown effectively allows a rogue process to read any physical, kernel or other process’s mapped memory, regardless of whether or not it should be able to do so. Accordingly, many servers and cloud services were impacted, as well as a potential majority of smart devices and embedded devices using ARM based processors (mobile devices, smart TVs and others), including a wide range of networking equipment.
Let’s start!!
Open the terminal and type given below command to download the script form git hub. It can only dump linux_proc_banner which is work as an interface for internal data structures in the kernel and it is used to get information regarding the system and to change certain kernel Process.
git clone

[To see content please register here]

From given below image you can observe I had successfully download this script in my Linux machine.
[Image: 1.png?w=687&ssl=1]

Now explore the downloaded folder in terminal now run the command “make” for compiling the program file before running the script.
[Image: 2.png?w=687&ssl=1]

Now run the script by executing given below command which will identify the state of vulnerability by read its memory space.
./run.sh
From given below image you can observe where it is vulnerable ON has dumped the complete detail of CPU Processor. So here it has shown some details such as:
Vendor Id: Vendor ID or VID is unique number assign to a Hardware to identify it on which system it has been installed.
CPU family: Same functionality Processors are categories into same family, here CPU family 6 means indicate a model from Pentium Pro family.
Model: Indicates model number of CPU family.
Model name: Holds Model name of Processor
Stepping: It is used identify the version of microprocessor
Microcode: it is a lowest instruction set permanently to control the microprocessor
CPU MHz: Describe Usage of CPU.
Cache size: Define the size of cache memory.
[Image: 3.png?w=687&ssl=1]

You can also verify above result by executing given below command which is used for obtaining details of system information.
[Image: 4.png?w=687&ssl=1]

Source:

[To see content please register here]

Today we are going to discuss “Network Packet Forensic” by covering some important track such as how Data is transferring between two nodes, what is “OSI 7 layer model” and how Wireshark stores which layers information when capturing the traffic between two networks.
As we know for transferring the data from one system to other we need a network connection which can be wired or wireless connection. But in the actual transmission of data does not only depend upon network connection apart from that it involves several phases for transmitting data from one system to another which was explained by the OSI model.
OSI stands for Open Systems Interconnection model which is a conceptual model that defines and standardizes the process of communication between the sender’s and receiver’s system. The data is transfer through 7 layers of architecture where each layer has a specific function in transmitting data over the next layer.
Now have a look over given below image where we had explained the functionality of each layer in the OSI model. So when data is transmitted by sender’s network then it will go in downward direction and data move from application layer to physical layer whereas when the receiver will receive the transmitted data it will come in an upward direction from physical layer to application layer.
Flow of Data from Sender’s network: Application > Presentation > Session > Transport > Network > Data Link > Physical
Flow of Data from Receiver’s network: Physical > Data Link > Network > Transport > Session > Presentation > Application
[Image: 0.png?w=687&ssl=1]

Examine Layers captured by Wireshark
Basically when a user opens an application for sending or receiving Data then he directly interacts with the application layer for both operations either sending or receiving of data. For example, we act as a client when use Http protocol for uploading or Downloading a Game; FTP for downloading a File; SSH for accessing the shell of the remote system.
While connecting with any application for sharing data between server and client we make use of Wireshark for capturing the flow of network traffic stream to examine the OSI model theory through captured traffic.
From given below image you can observe that Wireshark has captured the traffic of four layers in direction of the source (sender) to destination (receiver) network.
Here it has successfully captured Layer 2 > Layer 3 > Layer 4 and then Layer 7 information.
[Image: 1.png?w=687&ssl=1]

Ethernet Header (Data Link)
Data link layer holds 6 bytes of Mac address of sender’s system and receiver’s system with 2 bytes of Ether type is used to indicate which protocol is encapsulated i.e. IPv4/IPv6 or ARP.
In Wireshark Ethernet II layer represent the information transmitted over the data link layer. From given below image you can observe that highlighted lower part of Wireshark is showing information in Hexadecimal format where the first row holds information of Ethernet headers details.
So here you can get the source and destination Mac address which also available in Ethernet Header.
The row is divided into three columns as described below:
[Image: 2.1.png?w=687&ssl=1]

As we know the MAC address of the system is always represented in Hexadecimal format but both types are generally categorized in the ways given below :
[Image: 2.2.png?w=687&ssl=1]

Once again if you notice the given below image then you can observe the highlighted text in Pink colour is showing hex value 08 00 which indicates that here IPv4 is used.
[Image: 2.png?w=687&ssl=1]

IP Header (Network Layer)
IP header in Wireshark has described the network layer information which is also known as the backbone of the OSI model as it holds Internet Protocol version 4’s complete details. Network layer divides data frame into packets and defines its routing path through some hardware devices such as routers, bridges, and switches. These packets are identified through their logical address i.e. source or destination network IP address.
In the image of Wireshark, I have highlighted six most important values which contain vital information of a data packet and this information always flows in the same way as they are encapsulated in the same pattern for each IP header.
Now here, 45 represent IP header length where “4” indicates IP version 4 and “5” is header length of 5 bits. while 40 is time to live (TTL) of packet and 06 is hex value for TCP protocol which means these values changes if anything changes i.e. TTL, Ipv4 and Protocol.
Therefore, you can take help of given below table for examining TTL value for the different operating system.
[Image: 1.png?w=687&ssl=1]

Similarly, you can take help of given below table for examining other Protocol value.
[Image: 3.2.png?w=687&ssl=1]

From given below image you can observe Hexadecimal information of the IP header field and using a given table you can study these value to obtain their original value.
[Image: 3.3.png?w=687&ssl=1]

The IP header length is always given in form of the bit and here it is 5 bytes which are also minimum IP header length and to make it 20 bytes, multiply 4 with 5 i.e. 20 bytes.

[Image: 3.png?w=687&ssl=1]

TCP Header (Transport Layer)
Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) and Internet Control Message Protocol (ICMP) are the major protocols as it gives host-to-host connectivity at the Transport Layer of the OSI model. It is also known as Heart of OSI model as it plays a major role in transmitting errors free data.
By examining Network Layer information through Wireshark we found that here TCP is used for establishing a connection with destination network.
We knew that a computer communicates with another device like a modem, printer, or network server; it needs to handshake with it to establish a connection.
TCP follows Three-Way-Handshakes as describe below:

A client sends a TCP packet to the server with the SYN flag
A server responds to the client request with the SYN and ACK flags set.
Client completes the connection by sending a packet with the ACK flag set

Structure of TCP segment
Transmission Control Protocol accepts data from a data stream, splits it into chunks, and adds a TCP header creating a TCP segment. A TCP segment only carries the sequence number of the first byte in the segment.
A TCP segment consists of a segment header and a data section. The TCP header contains mandatory fields and an optional extension field.
Source Port
The 16-bit source port number, Identifies the sending port.
Destination Port
The 16-bit destination port number. Identifies the receiving port
Sequence Number
The sequence number of the first data byte in this segment. If the SYN control bit is set, the sequence number is the initial sequence number (n) and the first data byte is n+1.
Acknowledgment Number
If the ACK control bit is set, this field contains the value of the next sequence number that the receiver is expecting to receive.
Data Offset
The number of 32-bit words in the TCP header. It indicates where the data begins.
Reserved
Six bits reserved for future use; must be zero.
Flags
CWR, ECE, URG, ACK, PSH, RST, SYN, FIN
Window
Used in ACK segments. It specifies the number of data bytes, beginning with the one indicated in the acknowledgment number field that the receiver (the sender of this segment) is willing to accept.
Checksum
The 16-bit one’s complement of the one’s complement sum of all 16-bit words in a pseudo-header, the TCP header, and the TCP data. While computing the checksum, the checksum field itself is considered zero.
Urgent Pointer
Points to the first data octet following the urgent data.

Only significant when the URG control bit is set.
Options
Just as in the case of IP datagram options, options can be

either:
– A single byte containing the option number
– A variable length option in the following format
Padding
The TCP header padding is used to ensure that the TCP header ends and data begins on a 32-bit boundary. The padding is composed of zeros.

Different Types of TCP flags
TCP flags are used within TCP header as these are control bits that specify particular connection states or information about how a packet should be set. TCP flag field in a TCP segment will help us to understand the function and purpose of any packet in the connection.
[Image: Screenshot_1.png?w=687&ssl=1]

From given below image you can observe Hexadecimal information of TCP header field and using the given table you can study these value to obtain their original value.
Sequence and acknowledgment numbers are is a major part of TCP, and they act as a way to guarantee that all data is transmitted consistently since all data transferred through a TCP connection must be acknowledged by the receiver in a suitable way. When an acknowledgment is not received, then the sender will again send all data that is unacknowledged.
[Image: 6.png?w=687&ssl=1]

Using given below table you can read Hex value of other Port Number and their Protocol services. Although these services operate after getting acknowledgment from the destination network and explore at application layer OSI model.
In this way, you can examine every layer of Wireshark for Network Packet Forensic.
[Image: 3.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis