Premium Essay

Info Security Lab 4

In:

Submitted By tara0308
Words 625
Pages 3
1. Both Wireshark and NetWitness Investigator can be used for packet capture and analysis. Which tool is preferred for each task, and why?
While both Wireshark and NetWitness Investigator can be used to capture network traffic, the freeware version of NetWitness Investigator has a limitation of 1G of protocol capture per session. Wireshark does not have a limitation on the size of the capture file, which makes it better suited to protocol capture. Wireshark can be used to analyze capture files, but NetWitness Investigator is a seven-layer protocol analyzer that provides detailed protocol analysis and protocol behavior analysis and is much more user-friendly in terms of understanding protocol behavior and protocol analysis.
2. What is the significance of the TCP three-way handshake for applications that utilize TCP as transport protocol?
A three-way handshake (SYN > SYN-ACK > ACK) is performed between the IP source and IP destination to establish a connection-oriented connection.
3. How many different source IP host address did you capture in your protocol capture?
8 including 0.0.0.0, otherwise 7
4. How many different protocols did your protocol capture session have? What function in Wireshark provides you with a breakdown of the different protocol types on the LAN segment?
There were 10 protocols that the protocol capture session have. Click on:
Statistics → Protocol Hierarchy
In order to see the breakdown of the different protocol types on the LAN segment.

5. How and where can you find Wireshark network traffic packet size counts? Can you distinguish how many of each packet size was transmitted on your LAN segment? Why is this important?
In Wireshark, network traffic packet size counts can be found at:
Statistics → Packet Length → Packet Length w/ filter window

Yes, the columns ‘Packet Length’ and the ‘count’, show the packet size

Similar Documents

Premium Essay

Random

...every society faces ... For a given set of laboratory services, there is a defined cost. Nt2580 Lab 4 - Term Papers - Jrains www.termpaperwarehouse.com › Computers and Technology Jan 18, 2013 – Nt2580 Lab 4. 1. Define why change control management is relevant to security operations in an organization. Change control is a systematic ... NT2580 Introduction to Network Security stankong.bol.ucla.edu/NT2580/index.htm Welcome to NT2580 Introduction to Network Security ... Home Work , Labs, PowerPoint , Project and Exam Reviews. Fall Quarter 2012 ... Itt tech nt2580 lab 6 - 6 ebooks - free download www.getbookee.org/itt-tech-nt2580-lab-6/ Itt tech nt2580 lab 6 download on GetBookee.org free books and manuals search - 094 ALB 01-09-13 01-09-13 Vol 37-a. Nt2580 unit 9 lab - 4 ebooks - free download www.getbookee.org/nt2580-unit-9-lab/ Nt2580 unit 9 lab download on GetBookee.org free books and manuals search - NT2580 Introduction to If ti S itInformation Security. Nt2580 unit 6 lab - 4 ebooks - free download www.getbookee.org/nt2580-unit-6-lab/ Nt2580 unit 6 lab download on GetBookee.org free books and manuals search - NT2580 Introduction to If ti S itInformation Security. Lab itt edition nt2580 answers - 1 ebooks - free download www.getbookee.org/lab-itt-edition-nt2580-answers/ Jan 30, 2013 – Lab itt edition nt2580 answers download on GetBookee.org free...

Words: 435 - Pages: 2

Premium Essay

Jay Will

...Jones & Bartlett Learning ISSA Labs: Before You Begin Jones & Bartlett ISSA Labs: Before You Begin Table of Contents Click on a topic to jump to the appropriate page Purchasing Info .......................................................................................................................... 2 Virtual Security Cloud Lab (VSCL) ............................................................................................... 2 Step-by-Step Instructions........................................................................................................... 3 Deliverables ............................................................................................................................... 3 File Transfer ............................................................................................................................... 3 How Do I Redeem An Access Code? ........................................................................................... 4 How Do I Create A New User Account?...................................................................................... 9 How Do I Login to An Existing Account? ....................................................................................16 How Do I Get a Password Reminder?........................................................................................19 How Do I Disable The Pop-Up Blocker from Internet Explorer? ................................................23 How Do...

Words: 2021 - Pages: 9

Free Essay

Helllloo

...Communication & Info Literacy (GEC 102) ENG 110* Writing I (#) Oral Communication (GEC 103) COM 115 Fundamentals in Public Speaking (#) GEC 104 3 3 NATURAL WORLD at least 1 course from each box, 7-9 total credit hours 2 different course codes, at least 1 with a lab Life Sciences (3-4 credit hours) BIO 100* Biological Sciences for Educators (lab) BIO 101 Biology in Your World BIO 111* Understanding Bio Sys Through Inq. (lab only) BIO 121* General Biology I (lab) BMS 100 Concepts & Issues in the Life Sciences BMS 105 Concepts & Lab in the Life Sciences (lab) BMS 110* Intro to Biomedical Sciences (lab) BMS 111* Intro to Lab in Biomedical Sci (lab only) GLG 115 Life of the Past Physical Sciences (3-5 credit hours) AST 113 Modern Astronomy AST 114 Survey of Astronomy AST 115 Basic Astronomy (lab) CHM 107 Chemistry for the Citizen CHM 108* Chemistry for the Citizen Lab CHM 116* Fundamentals of Chemistry CHM 117* Fundamentals of Chemistry Lab GLG 110 Principles of Geology (lab) GLG 171 Environmental Geology GRY 135 Principles of Weather & Climate (lab) GRY 142 Introductory Physical Geography (lab) PHY 100 Survey of Physics (lab) PHY 101* Physics by Inquiry for Educators (lab) PHY 123* Introduction to Physics I (lab) PHY 203* Foundations of Physics I (lab) 4(3-3) 3(3-0) 1(0-2) 4(3-3) 4(4-0) 4(3-2) 4(3-2) 1(0-2) 3(3-0) 3(3-0) 4(4-0) 4(3-2) 3(3-0) 1(0-2) 4(4-0) 1(0-2) 4(3-2) 3(3-0) 4(3-2) 4(3-2) 4(3-2) 4(2-6) 4(3-2) 5(4-2) GEC 107 (no lab) GEC 106 (lab) HUMAN CULTURES 4 different...

Words: 999 - Pages: 4

Premium Essay

Design and Implement Security Operations Management Best Practices

...Design and Implement Security Operations Management Best Practices Lab Assessment Questions 1. During the lab, how did you connect to the Splunk management tool? I connected to the Splunk management tool by using a web browser and typing in the IP address 127.0.0.1:8000. 2. What are the main functions of Splunk that were demonstrated in the lab and why do they help build more secure operations? The main function demonstrated by Splunk where the ability to quickly analyze data and show correlations in the data. This builds more secure operations, because data can be compiled and analyzed in minutes instead of hours and days. Thus any necessary action by operations personnel and security personnel can take place in a reasonable amount of time. Splunk also can monitor server events and report alerts as needed to alert personnel to ongoing or current issues. 3. What types of “Data Inputs” are available in Splunk and most other log management tools? Splunk can receive data inputs from event log collection, remote event log collections, files and directories, local performance monitoring, remote performance monitoring, TCP, UDP, Registry monitoring active directory monitoring, and scripts. 4. What types of “Alert Conditions” are available in Splunk and most other log management tools? The alert conditions found in Splunk are Info, low, medium, high, and critical. 5. What is the search string for the “Top five sourcetypes” preconfigured...

Words: 488 - Pages: 2

Premium Essay

Papers

...disadvantages of database systems; • Apply appropriate techniques and methodologies in building and maintaining database systems; and • Create database application for business processes. Value Aims • Values – Teamwork – Self-Esteem – Accuracy – Confidence – Patience • Skills – Analytical and Logical 1 11/11/2014 Course Requirements • • • • • • Lecture sessions Hands-on Activities Quizzes Assignments Periodic Examinations Individual projects COURSE ADMINISTRATION Grading Scheme (Prelim, Midterm and Endterm) • CLASS STANDING 40% – Assignments – Quizzes – Lab Activities Grading Scheme Percentile Distribution • Prelim 30% • Midterm 30% • Finals 40% • EXAMINATIONS • PROJECT 40% 20% PRELIM LECTURE • Basic Concepts and Definitions • Traditional File Processing System vs Database System • Components of the Database Environment • DB Development Process • Entity-Relationship Model • Relational Model 2 11/11/2014 PRELIM LAB • Differentiate the functions of spreadsheet and database • Perform importing data from a spreadsheet file to database management system application • Explain the different types of relationship • Show how to translate business...

Words: 2854 - Pages: 12

Free Essay

Ceh Course

...EC-Council CEH v7 Course Outline Course Description This class will immerse the students into an interactive environment where they will be shown how to scan, test, hack and secure their own systems. The lab intensive environment gives each student in-depth knowledge and practical experience with the current essential security systems. Students will begin by understanding how perimeter defenses work and then be lead into scanning and attacking their own networks, no real network is harmed. Students then learn how intruders escalate privileges and what steps can be taken to secure a system. Students will also learn about Intrusion Detection, Policy Creation, Social Engineering, DDoS Attacks, Buffer Overflows and Virus Creation. When a student leaves this intensive 5 day class they will have hands on understanding and experience in Ethical Hacking. This course prepares you for EC-Council Certified Ethical Hacker exam 312-50 Who Should Attend This course will significantly benefit security officers, auditors, security professionals, site administrators, and anyone who is concerned about the integrity of the network infrastructure. Duration 5 days (9:00 – 5:00) Certification The Certified Ethical Hacker exam 312-50 may be taken on the last day of the training (optional). Students need to pass the online Prometric exam to receive CEH certification. Page 2 EC-Council Legal Agreement Ethical Hacking and Countermeasures course mission is to educate...

Words: 458 - Pages: 2

Premium Essay

Marijuana

...Drug Testing – An Introduction Despite recent and strong empirical evidence proving employment-based drug screenings do not increase productivity – and in many cases may even adversely affect productivity – more and more employers continue to require a clean drug screening for consideration of employment. If you are applying for a job, the chances are good that you will need to take a drug test. While a few industries are still considered “safe” from drug testing (namely, restaurant and hospitality), this is by no means an industry standard. Larger offices are particularly diligent in their drug testing efforts. If your prospective employer has around 100 employees or has government or private financial backing, you can bet your bottom dollar that you will be tested; if not for pre-employment, then at some point during your tenure with that company. To simplify things, your prospective employer is only testing for illegal drugs during a drug screening. They cannot, by law, test for pregnancy or medical conditions during a drug test. Thankfully, prospective employers cannot run your urine, hair, saliva or blood and see what substances or activities in which you have engaged over the last ten years. Such actions are not only illegal – they are currently impossible. In this Guide, you will learn how long the chemical traces, or metabolites, stay in your system (for example, marijuana can stay in your blood stream for as long as two months!). The Department of Defense requires...

Words: 24091 - Pages: 97

Free Essay

Lab7

...38 LAB #3 | Perform Data Gathering and Footprinting on a Targeted Website LAB #3 – ASSESSMENT WORKSHEET Perform Data Gathering and Footprinting on a Targeted Website Course Name and Number: Student Name: Instructor Name: Lab Due Date: Overview In this lab, you targeted an organization with an e-commerce website and performed data gathering and footprinting for that site. You collected public domain information about an organization’s website by making use of Google hacking techniques, downloading the Sam Spade reconnaissance-gathering tool, and using nslookup and tracert, similar DOS command tools packaged with Microsoft® Windows. You also researched public domain sites such as IANA’s WHOIS tool to obtain public domain information about the targeted website. Finally, you performed Google hacking research on the targeted organization’s e-commerce website to identify other shared information. Lab Assessment Questions & Answers 1. Which reconnaissance tool comes with Microsoft® Windows that can provide reconnaissance-gathering data and can be initiated from the DOS command prompt? What useful information does this query provide? name and the IP address associated with the source you are targeting. 2. What is the difference between ARIN, RIPE, and IANA? What regions of the world do these domain name registry organizations cover? The internet assigned numbers authority (IANA) delegates internet resources to the regional internet registries which are...

Words: 918 - Pages: 4

Free Essay

Cisco Ipt

...Implementing Cisco Unified Communications Manager Part 2 Duration: 5 Overview: This course follows on from Implementing Cisco Unified Communications Manager, Part1 (CIPT1) v8.0 and prepares delegates for implementing a Cisco Unified Communications solution in a multisite environment. It covers globalized call routing, Cisco Service Advertisement Framework (SAF) and Call Control Discovery (CCD), tail-end hop-off (TEHO), Cisco Unified Survivable Remote Site Telephony (SRST), and mobility features such as Cisco Device Mobility and Cisco Extension Mobility. Delegates will apply a dial plan for a multisite environment including TEHO, configure survivability for remote sites during WAN failure and implement solutions to reduce bandwidth requirements in the IP WAN.Delegates will also enable Call Admission Control (CAC) including Session Initiation Protocol (SIP) Preconditions and automated alternate routing (AAR). Course Code: CIPT2V8 Price: € 1,700 Target Audience: The primary audience for this course is Network Administrators,Network Engineers and CCNP Voice candidates. Objectives: After you complete this course you will be able to: Describe multisite deployment issues and solutions, and describe and configure required dial plan elements Implement call-processing resiliency in remote sites by using Cisco Unified SRST, MGCP fallback, and Cisco Unified Communications Manager Express in Cisco Unified SRST mode Implement bandwidth management and CAC to prevent oversubscription...

Words: 652 - Pages: 3

Free Essay

Intro to Server

...type notation 4. Ipv6 option unavailable IPV4IP SECURITY 5. Each host TCP/IP network should be config# mandatory except :ROUTING METHOD 6. If a system will be a DHCP server which add should you set?: STATIC IP 7. ;rlcess of obtaining an IP address for a comp name is : Name resolution 8. What is made up of free space from multiple Physical disk: SPANNED VOLUME 9. _____ groups are non security related distribution of info: DISTRIBUTION 10. Which partition 2TB Disks/NTFS (No fucking clue what this said :D) 11. Boot enabled tcp/ip WS retrieves settings needed to run excluding WORKSTATION SETTINGS 12. Which of the following is not key benefit provided by DHCP for management tcp/ip decentralized admin 13. Sent by clients via broad to locate DHCP RFC2131 which msg may include option DHOPDISCOVER 14. What type of zone might DNS Server host? PRIMARY 15. Which of the following is NOT a FWD or PVSZONE INTEGRATED 16. WS2008 ds role is reffed to as a DOMAIN CONTROLLER 17. Process or KP E DC in synch w changes network called REPLICATION 18. AD create REPLICATION TOPOLOGY w the idea or write doman communicate AD 19. A DISTINGUISHED NAME references objects in AD directory by using hierarchical path 20. What command can be used to run AD Directory wizard DCPROMO 21. What is minimum amount of storage for AD 200MB 22. The READ ONLY DC contains copy of NTDS.dit file cannot be modified 23. APPLICATION DIRECTORY partitions are used to separate forests wide DNS info 24. How often...

Words: 767 - Pages: 4

Premium Essay

What Is Erp?

...(what arrived), and costing (what the vendor invoiced) ERP systems centralize data. Benefits of this include: ▪ No synchronizing changes between multiple systems - consolidation of finance, marketing and sales, human resource, and manufacturing applications ▪ Enables standard product naming/coding. ▪ Provides comprehensive view of the enterprise (no "islands of information"). Makes real–time information available to management anywhere, anytime to make proper decisions. ▪ Protects sensitive data by consolidating multiple security systems into a single structure. WHICH ARE THE COMPANIES WHICH ARE USING ERP?? ➢ PrimeTech Software ➢ CD Tech Innovation pvt ltd ➢ Swastik softwares ➢ Gatewat Techno lab pvt ltd ➢ CompuBee Technologies pvt Ltd ➢ Technix ➢ Thinktech software co pvt ltd ➢ RS techno solutions ➢ Ginni system limited ➢ Usha Singhai Neo Informatique Pvt. Ltd. ➢ SunCom Info Tech pvt ltd IN WHAT ALL SECTORS ERP CAN BE USED?? Public sector Business sector Financial sector Health...

Words: 363 - Pages: 2

Free Essay

Is440

...Assessment Worksheet vLab-1 1. During the Minimal install, NTP (Network Time Protocol) server was not installed. From a security perspective, why is it important for a system to keep accurate time? The Time protocol provided a server's notion of time in a machine readable format, and there is also an ICMP Timestamp message UNIX systems base their notion of time on interrupts generated by the hardware clock. Delays in processing these interrupts because UNIX systems clocks to lose time slowly but erratically. These small changes in timekeeping are what the time scientist call jitter. 2. During the install, you set a password for the root user. What is the root user, and when is it appropriate to use this account? The root user is the administrator of the account. You will use this account only when you are making important changes in the system. 3. The Minimal installation process that was used in the lab did not include an X-Window interface. Why is it best practice not to run X-Window in a production environment? During Linux installation, deselecting X Window packages, especially the base packages, will return errors concerning failed dependencies. You can safely deselect all of these applications, in addition to X itself. 4. What partitioning options are available when installing CentOS? EXT2 & EXT4 5. Why is it important to put the swap file on a separate partition from the root (/) partition? It effects the File system and server if poorly configured ...

Words: 379 - Pages: 2

Free Essay

Lab 7 Security Basics

...Lab 7: Security Basics Task 1: Procedure 1. An example of hardware firewall is Belkin, and an example of software is Norton 360. Task 2: Procedure 1. Almost all anti-virus programs offer some sort of trial period for first-time users. McAfee is the only one that I know for sure offers free protection. 2. A Trojan Horse is an email virus usually released by an email attachment. If opened, it will scour your hard drive for any personal and financial information such as your social security, account, and PIN numbers. Once it has collected your info, it is sent to a thief’s database. A malicious email message is one which had been deliberately crafted to cause problems on the server or on the client. Drive- by downloads are downloads which a person authorized but without understanding the consequences (e.g. downloads which install an unknown or counterfeit executable program, ActiveX component, or Java applet). .Any download that happens without a person's knowledge, often a computer virus, spyware, malware, or crime ware. Task 3: Procedure 1. Full backup is a complete backup of everything you want to backup. Differential backup software looks at which files have changed since you last did a full backup. Then creates copies of all the files that are different from the ones in the full backup. Incremental backup software creates copies of all the files, or parts of files that have changed since previous backups of any type (full, differential or incremental)...

Words: 432 - Pages: 2

Free Essay

Buying a Pc

...Description: Tracing Ethernet Hands-On Lab Instructions: Refer to Hands-On Activity “Tracing Ethernet” on pages 227 and 228 in the textbook. For your convenience the setup application is attached to this lab in Blackboard, so you don’t need to find it online as instructed in the activity. Read the textbook authors comments and discussions for the activity to gain an understanding of the tool and the types of measurements it can take. For this Lab you will need to install TracePlus/Ethernet on your (Windows) computer. (If you have a Mac, the application works fine in VMWare, Parallels, etc. Alternatively, you may use WireShark, Capsa Free, or Packet Peeper, as identified below). In addition to your textbook, refer to your notes taken during the demo of the tool in class. Open the app and select the proper capture interface (Ie – e01, e02, etc. These are your wired connections and wireless connection interfaces, if you have wireless. You may need to try various Ethernet Ports to find some data and get connected to the right interface. You will know you are collecting data when you see packets of information are being displayed. You will see an entry for each packet that arrives). Once the application running and collecting packets of data, as demonstrated in class, do the following: (1) Launch a YouTube video in your browser. Notice the increase in Packets. If you are using TracePlus, you can also see the increase in Bandwidth and %Bandwidth on the virtual Dashboard...

Words: 988 - Pages: 4

Free Essay

Auditing It Infrastructures for Compliance

...reports for which I have completed over the last 5 weeks and combine them into one final report. These reports will consist of: - The two auditing frameworks or hardening guidelines / security checklists used by the DoD. - How a security assessment addressing modern day risks, threats, and vulnerabilities throughout the 7-domains of a typical IT infrastructure can help an organization achieve compliance. - How to gather and obtain needed information to perform a GLBA Financial Privacy & Safeguards Rules compliance audit and what must be covered. - The top workstation domain risks, threats, and vulnerabilities which will not only include possible causes, but mitigations as to prevent these issues from happening. - The top LAN – to – WAN risks, threats, and vulnerabilities which will not only include possible causes, but mitigations as to how we can prevent these issues from happening. - The top Remote Access Domain risks, threats, and vulnerabilities as well as ways to mitigate these types of issues. - The top Systems / Application Domain risks, threats, and vulnerabilities as well as ways to mitigate these types of issues. Part 1: Purpose: The purpose of part 1 for this lab is to develop an executive summary in regards to either the two auditing frameworks or hardening guidelines/security checklists used by the DoD. For this, I have chosen to discuss the two auditing frameworks. Background: A little background about the AF (Auditing Framework) for the DoD is that...

Words: 2140 - Pages: 9