# Network

## **Network Connection Analysis in Incident Response (Linux Systems)**

In Linux systems, attackers often use network connections to establish control, exfiltrate data, or enable persistent access. Effective incident response requires a systematic approach to identify, analyze, and mitigate suspicious network activities.

***

## **Key Threats in Network Analysis**

1. **Reverse Shells**:
   * Allow attackers to control a system by initiating a connection from the victim to their remote system.
   * Often bypass firewalls since the victim initiates the outbound connection.
2. **Backdoors**:
   * Persistent mechanisms enabling attackers to re-access the compromised system via specific ports or protocols.
3. **Data Exfiltration**:
   * Unauthorized transfer of sensitive data to external locations.

***

## **Tools and Commands for Network Analysis**

### **1. Netstat**

`netstat` is a foundational tool for examining active network connections and listening ports.

**List All Active Connections:**

```bash
netstat -a
```

**List Active TCP Connections Only:**

```bash
netstat -at
```

**Faster Results Without DNS Lookup:**

```bash
netstat -ant
```

**List Listening Ports:**

```bash
netstat -l
```

**List Listening Ports with Associated Processes:**

```bash
netstat -nlpt
```

**Key Parameters**:

* `-a`: Displays all connections.
* `-t`: Shows only TCP connections.
* `-n`: Skips DNS resolution for faster output.
* `-l`: Lists listening ports.
* `-p`: Shows processes tied to connections.

### **2. SS (Socket Statistics)**

`ss` is a faster alternative to `netstat` with more detailed output.

**List All TCP Connections:**

```bash
ss -t
```

**Show Listening Ports:**

```bash
ss -lt
```

**Include Process Information:**

```bash
ss -ltnp
```

### **3. IPTables**

Attackers might modify firewall rules to allow their connections. Examining these rules can reveal unauthorized changes.

**List All IPTables Rules:**

```bash
iptables -L -v -n
```

**What to Look For**:

* Rules allowing traffic on non-standard ports.
* Redirected traffic to suspicious external IPs.

### **4. Tcpdump**

For real-time packet capture and analysis.

**Capture All Network Traffic:**

```bash
tcpdump -i eth0
```

**Filter Specific Ports or Protocols:**

```bash
tcpdump -i eth0 port 4444
tcpdump -i eth0 tcp
```

**Analyze DNS Traffic:**

```bash
tcpdump -i eth0 port 53
```

***

## **Incident Response Steps**

### **1. Identify Active Connections**

Use `netstat` or `ss` to list all active connections.

**Focus on**:

* **External IPs**: Identify connections to unknown or suspicious IP addresses.
* **Non-Standard Ports**: Common services use standard ports (e.g., 22 for SSH, 80 for HTTP). Unusual ports could indicate malicious activity.
* **Processes**: Investigate which processes are initiating the connections.

***

### **2. Investigate Listening Ports**

Use `netstat -nlpt` or `ss -ltnp` to identify services listening on unusual ports.

**Key Considerations**:

* Confirm the legitimacy of listening ports.
* Investigate processes using ports outside typical ranges.

***

### **3. Analyze Reverse Shell Indicators**

Reverse shells typically involve an outbound connection to the attacker's machine.

**Detect Outbound Connections:**

```bash
netstat -ant | grep ESTABLISHED
```

**Next Steps**:

* Cross-reference the external IPs with threat intelligence sources.
* Look for connections to uncommon ports like 4444, 1337, or high random ports.

***

### **4. Review and Remove Unauthorized IPTables Rules**

Examine IPTables for any rules that attackers may have added.

**Identify Suspicious Rules:**

```bash
iptables -L -v -n
```

**Remove Unauthorized Rules:**

```bash
iptables -D <CHAIN> <RULE_NUMBER>
```

***

## **Post-Incident Actions**

### **1. Terminate Suspicious Connections**

Identify and terminate malicious processes associated with suspicious connections.

**Find Process ID (PID):**

```bash
netstat -nlpt | grep <PORT>
```

**Terminate the Process:**

```bash
kill -9 <PID>
```

***

### **2. Block Malicious IPs**

Update IPTables to block further communication with identified malicious IPs.

**Add a Rule to Block an IP:**

```bash
iptables -A INPUT -s <malicious_IP> -j DROP
```

***

### **3. Monitor Network Traffic**

Deploy tools like **Wireshark** or **Suricata** to monitor and analyze ongoing network activities for signs of further compromise.

***

### **4. Harden Network Configurations**

* Use a **firewall** to block unnecessary ports.
* Enable **IDS/IPS** systems for real-time threat detection.
* Configure **logging and alerting** to monitor future unauthorized connections.

***

## **Key Commands**&#x20;

| **Command**                 | **Purpose**                                                       |
| --------------------------- | ----------------------------------------------------------------- |
| `netstat -nlpt`             | List listening ports with associated processes.                   |
| `ss -ltnp`                  | Display detailed information about listening ports and processes. |
| `iptables -L -v -n`         | List all current IPTables rules.                                  |
| `tcpdump -i eth0 port 53`   | Capture DNS traffic for analysis.                                 |
| `kill -9 <PID>`             | Terminate a malicious process.                                    |
| `iptables -A INPUT -s <IP>` | Block a malicious IP.                                             |

***

## **Key Points**&#x20;

Network connection analysis is a crucial aspect of incident response. By leveraging tools like `netstat`, `ss`, and `tcpdump`, responders can quickly identify and investigate suspicious network activities. Proactive measures such as monitoring network traffic and hardening firewall configurations significantly enhance the system's security posture.
