Network Device Logs, SSH Logs and Packet Sniffers

What it is

Network evidence comes in two forms. Logs record events that devices decided to write down, and packet captures record the traffic itself.

This page covers what each device log tells an investigator, how SSH activity appears in Linux logs, the protocols you need to recognize and how sniffers collect traffic as evidence.

How it works

Why investigate network traffic

Traffic shows what crossed the network, which is something host evidence cannot always prove. It helps to find the source and target of an attack, reconstruct a timeline, measure how much data left, and confirm what an alert really was.

Network data is volatile. A capture not taken now cannot be taken later, so collecting it early matters. Types of data are full packet capture, session records, statistical summaries and alerts.

Firewall, IDS, honeypot, router and DHCP logs

DHCP exchanges are Discover, Offer, Request and Acknowledge. On a Windows DHCP server, audit log event IDs include 10 (new lease), 11 (renew) and 12 (release). Without DHCP records you cannot map an IP address in an old log to a device.

Syslog uses UDP port 514 by default and eight severity levels: 0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational, 7 Debug. Lower numbers are more severe.

Cisco switch, VPN and DNS server logs

Cisco messages follow %FACILITY-SEVERITY-MNEMONIC. For example, %LINEPROTO-5-UPDOWN marks an interface state change and %SYS-5-CONFIG_I marks a configuration change. Port security violations show which MAC address broke the rule. show logging displays the buffer and show mac address-table links ports to MAC addresses.

VPN logs record who authenticated, from which public address, which internal address was assigned and when the session started and ended. Failed attempts from one address may indicate password guessing, and a login from an unusual country may indicate stolen credentials.

DNS logs record the name queries each client makes. Investigators look for lookups of known bad domains, long random looking names, high volumes of TXT queries (a sign of tunneling) and zone transfer requests from outside.

Investigating SSH logs

On Debian and Ubuntu, SSH events are in /var/log/auth.log. On Red Hat family systems they are in /var/log/secure. The journalctl -u ssh command (sshd on Red Hat family systems) reads the systemd journal.

Many failures followed by one Accepted from the same address is a pattern consistent with a successful brute force. A one line count is grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr. The last command reads /var/log/wtmp for logins, and lastb reads /var/log/btmp for failed ones.

Network protocols and packet analysis

TCP starts with a three way handshake of SYN, SYN-ACK and ACK. The flags SYN, ACK, FIN, RST, PSH and URG describe each segment. Wireshark display filters narrow a capture, such as ip.addr == 10.0.0.5, tcp.port == 22, dns and tcp.flags.syn == 1 && tcp.flags.ack == 0.

Gathering evidence via sniffers

A sniffer captures frames from the wire with the network card in promiscuous mode. On a hub, every device sees all traffic. On a switch, you need a SPAN (mirror) port or a network TAP, which copies traffic to the capture device.

Passive sniffing only listens. Active sniffing injects traffic, such as ARP spoofing, to redirect packets on a switched network, and it needs legal authority. Save captures as .pcap or .pcapng, record the capture point and time, and hash the file.

Sniffing tools

A worked example

An alert says a server received many SSH failures at 02:10. The investigator reads auth.log and finds 400 failures from 203.0.113.5, ending with Accepted password for deploy. The firewall log confirms the same address connected to port 22 only.

The DHCP and VPN logs show no internal device or VPN user holding that address. A tcpdump capture taken at the server's switch port after the event shows an outbound transfer on port 443 from that server, which the investigator reports as the next lead.

How the exam asks about this

• "Which log file records SSH logins on Ubuntu?" -> /var/log/auth.log.
• "What does a switch need so a sniffer can see all its traffic?" -> A SPAN (mirror) port or a TAP.
• "Which log maps an IP address to a MAC address at a point in time?" -> The DHCP server log.