Network forensics and investigating logs

<iframe src="http://www.slideshare.net/slideshow/embed_code/26123521" width="476" height="400" frameborder="0" marginwidth="0" marginheight="0" scrolling="no"></iframe>

Password Policy and Account Lockout Policies

<iframe src="http://www.slideshare.net/slideshow/embed_code/26122716" width="427" height="356" frameborder="0" marginwidth="0" marginheight="0" scrolling="no" style="border:1px solid #CCC;border-width:1px 1px 0;margin-bottom:5px" allowfullscreen webkitallowfullscreen mozallowfullscreen> </iframe> <div style="margin-bottom:5px"> <strong> <a href="https://www.slideshare.net/anilinvns/password-policy" title="Password Policy and Account Lockout Policies" target="_blank">Password Policy and Account Lockout Policies</a> </strong> from <strong><a href="http://www.slideshare.net/anilinvns" target="_blank">anilinvns</a></strong> </div>

Boot Loader

GNU grand unified bootloader (GRUB)

•  A multiboot specification that allows the user to choose one of several OSs

NT loader (NTLDR)

• A bootloader for Microsoft’s Windows NT OS that usually runs from the hard drive

Linux loader (LILO)

• A bootloader for Linux that generally runs from a hard drive or floppy disc

Network interface controller (NIC)

• Uses a bootloader that supports booting from a network interface such as Etherboot or pre-boot execution environment (PXE)

Steganography

Technically in simple words “steganography means hiding one piece of data within another”
Modern steganography uses the opportunity of hiding information into digital multimedia files and also at the network packet level.

Command Prompt Tools

Ping==Checks connectivity with a device on a network and identifies response times.
Ipconfig== Displays TCP/IP configuration assigned to network interface cards
Tracert== Checks connectivity with a device and shows routers in the path.
Nslookup==Verifies that DNS can resolve a host name to an IP address. It can verify
that a record exists in DNS.
Netstat== Shows network statistics, including a list of inbound and outbound connections
for a system.
Nbtstat==Shows statistics for NetBIOS.
Arp== Shows MAC address to IP address mappings.
Net Use==Used to map drives to remote shares.

Configure SSH On Router and Switch

Router>enable
Router#configure terminal
Router(config)#hostname jodhpur
Enter configuration commands, one per line.  End with CNTL/Z.
jodhpur(config)#interface FastEthernet0/0
jodhpur(config-if)#no shutdown

%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up

jodhpur(config-if)#ip address 192.168.1.1 255.255.255.0

jodhpur(config)#ip domain-name cdac.com
jodhpur(config)#username anil password 123

Router(config)#crypto key generate rsa

Router And Switch (L2,L3) Audit Check List

Disable Unneeded Services
Are unused interfaces disabled?	Unused interfaces on the router should be disabled. Router(config-if)# shutdown
Is DNS lookups for the router turned off ?	This client service is enabled by default and is not required on most routers. The following command is used to turn DNS lookup off. Router(config)#no ip domain-lookup
Is TCP small servers and UDP small servers service disabled on the router? {applicable before Cisco IOS 11.3}	These services are rarely used and hence can be disabled. This is disabled by default after Cisco IOS 11.3 Router(config)#no service tcp-small-servers Router(config)#no service udp-small-servers