-: So continuing our discussion
of passive reconnaissance, let's talk about network devices,
log files and configurations,
and take it a step further.
So network devices, or network device logs,
they have many activities are collected,
their statuses and the events.
These are gonna include things like traffic patterns
and network utilization,
which will actually be really helpful for you
because if there's somebody who's been in your network
and they're ex-filling data out of your network,
that's gonna increase your bandwidth usage,
and you can see that in those network logs.
Log files, configuration files, and network flows
are great for passive reconnaissance
as we talked about in the last lesson.
Now, when we talk about log files,
these network devices, they either keep the log centrally,
or they're gonna display them to a console,
or they can send them to a SYSLOG server.
Now, I like to set mine up
where they all go to a centralized server
called a SYSLOG server,
but some people actually use SNMP
to send that information other ways.
There's lots of different ways to configure it.
It just depends on what you're gonna do.
So when you get to that network,
if you're getting an incident response,
figure out where they keep their log files
and what systems they use
so that information will be available to you.
Now, when you look in your logs,
this is an example from a Cisco device.
Other manufacturers do it a little bit differently,
but if you're gonna take the CSA+ exam
because Cisco is so prevalent,
you'll be asked questions on this particular chart.
And so there is seven levels, plus zero,
of faults that will be logged in your logs.
And, depending on what logging level you set
will tell you how much information you get.
So some people set their logs at 0
which means all they're gonna get is emergencies,
failures that cause shutdowns.
Other than that, nothing's gonna be logged, okay?
Now, if you go to 1, you're gonna get alerts.
You go to 2, you're gonna get critical.
And you go all the way down to 7,
you're gonna get everything being logged,
including debugging messages.
This means your logs are gonna get huge,
they're gonna get to be very large,
and you better have some way to parse them
and lots of data storage for them.
But, the best thing for your to do in logging
is log everything, so buy that extra storage,
set it at log 7.
You'll get your emergencies, your alerts,
your criticals, your errors, your warnings,
your notifications, your information,
and you're debugging.
And so you'll get everything in there.
For the exam, if you're taking the exam,
you don't necessarily have to memorize 0 through 7,
but you do need to remember 0 is emergencies;
it's the worst.
Seven is debugging; it's informational, right?
And the things in between are different, right?
But those are usually the ways they'll ask you.
They'll usually ask you one or two of the extremes:
0 or 7, so just keep that in mind
as you're studying for the exam
if you're going down that route.
Now, let's take a look at a log file.
And I know this might look like gobbledygook to some people
but it's okay.
In this, we have several different log file
or log snippets that I collected from a Cisco device.
Now, let's take an example of the second one there.
It starts with line 123:
It happened on May 3rd.
And if you see there its an IP access log,
which means its gonna tell us what was permitted or denied.
In this case, it was permitting TCP traffic
from 10.0.40.16(3059)
and that went out to 10.0.4.101(1060).
It sent two packets of data
and then you'll see the next one,
Line 124, what else was permitted?
And it'll keep going with permits and allows.
So if we go down to 127,
this is gonna show us a deny statement.
Notice here it was a log number 6, right?
It's informational.
It says it was listing 199.
Again, that was the access rule.
It denied this TCP packet going from 10.0.61.108
going to 10.0.127.20, okay?
Now, why did I go through this example for you?
Because on the test they may give you
an example of something like this.
They'll give you one of these lines
and they'll say, "What was happening?"
and you'll have four choices: A, B, C, and D,
and you'll have to say, "This denied this type of traffic
TCP UDP from this IP going to that IP", right?
And they'll have it in four different ways written
and you'll have to select the right one.
So remember when it goes, it's gonna say allow or deny,
or permit or deny,
and then it's gonna tell you TCP or UTP.
It'll tell you the source where it's coming from,
and then where it's going to.
And that'll tell you what was good or what was bad,
or what was happening inside that log file.
Now, we talked about configuration files.
These are invaluable with mapping a network.
If you can get the organization
to give you a copy of their configuration files,
it will have every route that they have set up,
whether they're static of dynamic.
It'll tell you all of the devices that it has in detail,
what versions they are, what allows and denies they have;
all of that kind of stuff.
It'll also provide you details
of where the SNMP and SYSLOG servers are on the network,
the user and admin accounts, and other things.
These configuration files are a God send
when you are doing incident response.
So get them if you can.
Now, what does a configuration file look like?
Well, here's an example on the right.
You can see it tells you.
This was version 12.0 of the iOS that its using.
It's gonna tell you that it has time stamps
debugged setting to date an time,
that it's logging those dates and times,
it has encryption on the password,
things like that.
You'll notice the host name.
It's a Cisco device.
It's called, Cisco.
That's what they called this device.
You can see that it's a C2600 router.
That tells me that as well.
Or, excuse me, that's a C2600 switch.
It's telling you it's not logged into the console,
it tells you that it has a password that's being enabled,
it has a secret password that's gonna be enabled.
All sorts of different things that are important here,
including the name server its using, the DNS,
which in this case is 123.456.321.3,
which is a made up number;
it doesn't really exist.
But this is just a configuration
to show you what a configuration looks like.
And these things will be 10, 12, 14 pages long sometimes.
But I just wanted to give you an idea
of what configurations look like.
And, again, this is a Cisco example.
Now here's the second page of it
and that's where we get into the ACLs.
We get into our Access Control List, right?
You can see again, the Access Control List,
denies or permits, what kind of traffic,
is it IP or TCP?
What's the IP, or what is the port,
and the host its going to go to.
So, for instance, the fourth line there
says, "Access list 102 permit
TCP any host 123.456.321.42 eq ftp".
What does that mean to you?
Well, this is saying that any host
can access server 123.456.blah blah blah
over port 21, which is ftp.
That's what this is telling us.
And so we need to be able to read these
allow and deny statements, again,
just like we did in the log files,
inside the configuration files.
Now, let's talk about NetFlow data.
NetFlow data is a Cisco-specific network protocol.
But, again, Cisco is a predominant player
in the networking space so that chances are
you're gonna come across NetFlow data at some point.
It's gonna capture IP traffic information
for traffic monitoring to provide flow and volume.
This is not the same as packet capturing.
With packet capture,
you're capturing not just the headers and when it happened,
but the data inside the packets too.
With NetFlow, you're gonna get the IP and the source port,
so where it's coming from,
the destination port where it's going to,
and the type of service it was, okay?
There's other vendors out there,
like Juniper that has Jflow and cflowd,
Citrix has AppFlow, HP has NetStream.
They're all kind of mimicking what Cisco did with NetFlow.
But, again, remember NetFlow is all about volume of data
and how much data is going at a certain amount of time.
That's really what it's going to tell you.
Why is this important?
Again, if somebody's taking data outside your network,
you might go from 3GBs of usage, normally, per day,
up to 20GBs today
because they're trying to copy
everything off your hard drive.
That tells you there's an increase in NetFlow.
There may be a problem.
Something to keep in mind as you're looking through
in an incident response.
(glitch sound)