Klementinus Kennyvito Salim

• Differences of FM and AM. FM is frequency modulation while AM is amplitude modulation. AM is low powered, different than FM which is high powered
• The evil twin – used to ‘capture’ wireless communications on purpose. It is known as a legitimate Wi-Fi access point to cover up its identity

You can also locate wireless devices, such as knowing its MAC address which is listed, to know the device to look for.

Forum based learning – Statistical flow analysis is one of many steps to find anomalies in the network. By finding statistics of traffic flow, we can see if there are incidents occurring and then prevent it or investigate it further more.

Tools for statistical flow analysis :

• Wireshark
• Tshark
• Pcapcat
• TCcpxtract

Traffic Analysis.

Tools used for for protocol analysis :

• Wireshark – Automatically keeps and displays protocol details within a packet and filters are available. It has number of packets , packet details, packet bytes, and all protocols available
• Tshark – same as Wireshark, but it is a CLI instead of GUI
• Packet Summary Markup Language (PSML) – XML format generator for details of a certain protocol

Protocol Identification Techniques :

• Protocol identification – identify protocols
• Protocol decoding – reading the data
• Exporting fields

Evidence Acquisition – The goals of Evidence Acquisition. The best possible result is proof of absolute fidelity, protection of evidence and zero effects on network environments, . In fact, however, these standards are almost impossible to accomplish, as a zero footprint investigation can not be accomplished and best practices need to be used to minimize the footprint. In addition, verify the validity of proof with cryptographic checksums.

There are many traffic acquisition software that can be used depending on each use case. You can use libcap and there are a lot of libraries included such as Berkeley Packet Filter (BPF) usually use to compare values at layer 2, 3, and 4. You can also use TCPDump and Wireshark.

Acquisition tools : console, SSH, Telnet, TFTP, SNMP, SCP, and web proprietary interfaces.

Forum Based Learning : Capturing digital evidence to create flow analysis, with tools such as Wireshark and tshark.