Network

Network Connection Analysis in Incident Response (Linux Systems)

In Linux systems, attackers often use network connections to establish control, exfiltrate data, or enable persistent access. Effective incident response requires a systematic approach to identify, analyze, and mitigate suspicious network activities.

---

Key Threats in Network Analysis

1. Reverse Shells:

   • Allow attackers to control a system by initiating a connection from the victim to their remote system.

   • Often bypass firewalls since the victim initiates the outbound connection.

2. Backdoors:

   • Persistent mechanisms enabling attackers to re-access the compromised system via specific ports or protocols.

3. Data Exfiltration:

   • Unauthorized transfer of sensitive data to external locations.

---

Tools and Commands for Network Analysis

1. Netstat

netstat is a foundational tool for examining active network connections and listening ports.

List All Active Connections:

netstat -a

List Active TCP Connections Only:

netstat -at

Faster Results Without DNS Lookup:

netstat -ant

List Listening Ports:

netstat -l

List Listening Ports with Associated Processes:

netstat -nlpt

Key Parameters:

• -a: Displays all connections.

• -t: Shows only TCP connections.

• -n: Skips DNS resolution for faster output.

• -l: Lists listening ports.

• -p: Shows processes tied to connections.

2. SS (Socket Statistics)

ss is a faster alternative to netstat with more detailed output.

List All TCP Connections:

ss -t

Show Listening Ports:

ss -lt

Include Process Information:

ss -ltnp

3. IPTables

Attackers might modify firewall rules to allow their connections. Examining these rules can reveal unauthorized changes.

List All IPTables Rules:

iptables -L -v -n

What to Look For:

• Rules allowing traffic on non-standard ports.

• Redirected traffic to suspicious external IPs.

4. Tcpdump

For real-time packet capture and analysis.

Capture All Network Traffic:

tcpdump -i eth0

Filter Specific Ports or Protocols:

tcpdump -i eth0 port 4444
tcpdump -i eth0 tcp

Analyze DNS Traffic:

tcpdump -i eth0 port 53

---

Incident Response Steps

1. Identify Active Connections

Use netstat or ss to list all active connections.

Focus on:

• External IPs: Identify connections to unknown or suspicious IP addresses.

• Non-Standard Ports: Common services use standard ports (e.g., 22 for SSH, 80 for HTTP). Unusual ports could indicate malicious activity.

• Processes: Investigate which processes are initiating the connections.

---

2. Investigate Listening Ports

Use netstat -nlpt or ss -ltnp to identify services listening on unusual ports.

Key Considerations:

• Confirm the legitimacy of listening ports.

• Investigate processes using ports outside typical ranges.

---

3. Analyze Reverse Shell Indicators

Reverse shells typically involve an outbound connection to the attacker's machine.

Detect Outbound Connections:

netstat -ant | grep ESTABLISHED

Next Steps:

• Cross-reference the external IPs with threat intelligence sources.

• Look for connections to uncommon ports like 4444, 1337, or high random ports.

---

4. Review and Remove Unauthorized IPTables Rules

Examine IPTables for any rules that attackers may have added.

Identify Suspicious Rules:

iptables -L -v -n

Remove Unauthorized Rules:

iptables -D <CHAIN> <RULE_NUMBER>

---

Post-Incident Actions

1. Terminate Suspicious Connections

Identify and terminate malicious processes associated with suspicious connections.

Find Process ID (PID):

netstat -nlpt | grep <PORT>

Terminate the Process:

kill -9 <PID>

---

2. Block Malicious IPs

Update IPTables to block further communication with identified malicious IPs.

Add a Rule to Block an IP:

iptables -A INPUT -s <malicious_IP> -j DROP

---

3. Monitor Network Traffic

Deploy tools like Wireshark or Suricata to monitor and analyze ongoing network activities for signs of further compromise.

---

4. Harden Network Configurations

• Use a firewall to block unnecessary ports.

• Enable IDS/IPS systems for real-time threat detection.

• Configure logging and alerting to monitor future unauthorized connections.

---

Key Commands

Command	Purpose
netstat -nlpt	List listening ports with associated processes.
ss -ltnp	Display detailed information about listening ports and processes.
iptables -L -v -n	List all current IPTables rules.
tcpdump -i eth0 port 53	Capture DNS traffic for analysis.
kill -9 <PID>	Terminate a malicious process.
iptables -A INPUT -s <IP>	Block a malicious IP.

---

Key Points

Network connection analysis is a crucial aspect of incident response. By leveraging tools like netstat, ss, and tcpdump, responders can quickly identify and investigate suspicious network activities. Proactive measures such as monitoring network traffic and hardening firewall configurations significantly enhance the system's security posture.