network trace analysis - patterndiagnostics.com · network trace analysis . dmitry vostokov ....
TRANSCRIPT
![Page 1: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/1.jpg)
Network Trace Analysis
Dmitry Vostokov Software Diagnostics Services
Version 1.0
Facebook LinkedIn Twitter
![Page 2: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/2.jpg)
Wireshark Hark Listen (to) “Hark! There’s the big bombardment.” Speak in one’s ear; whisper
Shorter Oxford English Dictionary
Hark back (idiom) To return to a previous point, as in a narrative
http://www.thefreedictionary.com/hark
© 2013 Software Diagnostics Services
![Page 3: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/3.jpg)
Prerequisites Interest in software diagnostics,
troubleshooting, debugging and network trace analysis
Experience in network trace analysis using Wireshark or Network Monitor
© 2013 Software Diagnostics Services
![Page 4: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/4.jpg)
Why? A common diagnostics language
Network diagnostics as software diagnostics
© 2013 Software Diagnostics Services
![Page 5: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/5.jpg)
Software Diagnostics A discipline studying abnormal software structure and behavior in software execution artifacts (such as memory dumps, software and network traces and logs) using pattern-driven, systemic and pattern-based analysis methodologies.
© 2013 Software Diagnostics Services
![Page 6: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/6.jpg)
Diagnostics Pattern
A common recurrent identifiable problem together with a set of recommendations and possible solutions to apply in a specific context.
© 2013 Software Diagnostics Services
![Page 7: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/7.jpg)
Pattern Orientation
© 2013 Software Diagnostics Services
Pattern-driven Finding patterns in software artefacts Using checklists and pattern catalogs
Pattern-based Pattern catalog evolution Catalog packaging and delivery
![Page 8: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/8.jpg)
Catalog Classification By abstraction
Meta-patterns
By artifact type
Software Log* Memory Dump Network Trace*
By story type
Problem Description Software Disruption UI Problem
By intention
Malware
© 2013 Software Diagnostics Services
![Page 9: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/9.jpg)
Traces and Logs
© 2013 Software Diagnostics Services
![Page 10: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/10.jpg)
Trace and Log Patterns
© 2013 Software Diagnostics Services
![Page 11: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/11.jpg)
Software Narrative
A temporal sequence of events related to software execution.
© 2013 Software Diagnostics Services
![Page 12: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/12.jpg)
Software Trace
© 2013 Software Diagnostics Services
A sequence of formatted messages Arranged by time A narrative story
![Page 13: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/13.jpg)
Network Trace
© 2013 Software Diagnostics Services
A sequence of formatted packets as trace messages
Arranged by time A narrative story
![Page 14: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/14.jpg)
Network Trace Analysis
© 2013 Software Diagnostics Services
Software Trace Analysis Patterns
Network Trace Analysis Patterns
![Page 15: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/15.jpg)
Capture Tool Placing Sniffer placing Process Monitor placing
© 2013 Software Diagnostics Services
![Page 16: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/16.jpg)
Trace Maps Network map
Deployment architecture map
© 2013 Software Diagnostics Services
![Page 17: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/17.jpg)
Name Resolution MAC -> IP and IP -> DNS
PID -> process name
© 2013 Software Diagnostics Services
![Page 18: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/18.jpg)
Trace Presentation
© 2013 Software Diagnostics Services
Full Trace (Story, Fable, Fabula)
Trace 1 (Plot, Sujet)
Trace 2 (Plot, Sujet)
Trace 3 (Plot, Sujet)
Trace 4 (Plot, Sujet)
Trace 5 (Plot, Sujet)
Trace Presentation
A (Discourse)
Trace Presentation
B (Discourse)
Trace Presentation
C (Discourse)
![Page 19: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/19.jpg)
Minimal Trace Graphs
© 2013 Software Diagnostics Services
Time# Src Dst Time Message
![Page 20: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/20.jpg)
Pattern-Driven Analysis
© 2013 Software Diagnostics Services
Logs Checklists Patterns Action
![Page 21: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/21.jpg)
Pattern-Based Analysis
© 2013 Software Diagnostics Services
Software Trace
New Pattern
Discovery
Pattern Catalog
+
Usage
![Page 22: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/22.jpg)
Pattern Classification
© 2013 Software Diagnostics Services
Vocabulary Error Trace as a Whole Large Scale Activity Message Block Trace Set
![Page 23: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/23.jpg)
Reference and Course
© 2013 Software Diagnostics Services
Catalog from Software Diagnostics Library
Software Trace Analysis Patterns
Free reference graphical slides
Accelerated-Windows-Software-Trace-Analysis-Public.pdf
Training course*
Accelerated Windows Software Trace Analysis
* Available as a full color paperback book, PDF book, on SkillsSoft Books 24x7. Recording is available for all book formats
![Page 24: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/24.jpg)
Selected Patterns
© 2013 Software Diagnostics Services
![Page 25: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/25.jpg)
Master Trace
Normal network capture
© 2013 Software Diagnostics Services
Pattern Category Trace Set
![Page 26: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/26.jpg)
Message Current
Packets/s
© 2013 Software Diagnostics Services
Time# Src Dst Time Message
Time# Src Dst Time Message
10.100
10.200
10.100
12.100
J1 > J2
Pattern Category Trace as a Whole
![Page 27: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/27.jpg)
Message Density
D1 > D2
© 2013 Software Diagnostics Services
Time# Src Dst Time Message
Pattern Category Trace as a Whole
![Page 28: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/28.jpg)
Characteristic Block
D1 < D2 L1 > L2
© 2013 Software Diagnostics Services
Time# Src Dst Time Message
Pattern Category Large Scale
![Page 29: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/29.jpg)
Example
© 2013 Software Diagnostics Services
![Page 30: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/30.jpg)
Thread of Activity
© 2013 Software Diagnostics Services
Pattern Category Activity Time
# Src Dst Time Message
Time# Src Dst Time Message
![Page 31: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/31.jpg)
Adjoint Thread
Filtered by: Source Destination Protocol Message Expression
© 2013 Software Diagnostics Services
Pattern Category Activity Time
# Src Dst Time Message
Time# Src Dst Time Message
![Page 32: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/32.jpg)
No Activity
© 2013 Software Diagnostics Services
Time# Src Dst Time Message
We messages from other servers but only see our own traffic
Pattern Category Activity
![Page 33: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/33.jpg)
Discontinuity
© 2013 Software Diagnostics Services
Pattern Category Activity Time
# Src Dst Time Message
Time# Src Dst Time Message
![Page 34: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/34.jpg)
Dialog
Conversation between 2 endpoints
© 2013 Software Diagnostics Services
Time# Src Dst Time Message
![Page 35: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/35.jpg)
Significant Event
Time Reference feature in Wireshark
© 2013 Software Diagnostics Services
Time# Src Dst Time Message
Pattern Category Message
![Page 36: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/36.jpg)
Marked Messages
Marked Packets feature in Wireshark
© 2013 Software Diagnostics Services
Annotated messages: session initialization [+] session tear-off [-] port A activity [+] port B activity [-] protocol C used [-] address D used [-] [+] activity is present in a trace [-] activity is undetected or not present
Pattern Category Message
![Page 37: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/37.jpg)
Partition
Connection initiation (Prologue) and termination (Epilogue)
© 2013 Software Diagnostics Services
Tail
Epilogue
Head
Time
Prologue
Core
# Src Dst Time Message
Pattern Category Trace as a Whole
![Page 38: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/38.jpg)
Inter-Correlation
Several packet sniffers at once
Internal and external views
Process Monitor log + network trace
© 2013 Software Diagnostics Services
Pattern Category Trace Set
![Page 39: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/39.jpg)
Circular Trace
© 2013 Software Diagnostics Services
Pattern Category Trace as a Whole
Time# Src Dst Time Message
ProblemRepro
![Page 40: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/40.jpg)
Split Trace
© 2013 Software Diagnostics Services
Pattern Category Trace Set Time
# Src Dst Time Message # PID TID Time Message # PID TID Time Message
![Page 41: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/41.jpg)
Paratext Info column in Wireshark
© 2013 Software Diagnostics Services
![Page 42: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/42.jpg)
Frames
OSI, TCP/IP Layers
© 2013 Software Diagnostics Services
Time# Src Dst Time Message
Pattern Category Large Scale
![Page 43: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/43.jpg)
Visibility Limit Visibility window for sniffing
© 2013 Software Diagnostics Services
PC 1
PC 2
PC 3
sniffer
Pattern Category Trace as a Whole
![Page 44: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/44.jpg)
Incomplete History Packet loss
Missing ACK
© 2013 Software Diagnostics Services
![Page 45: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/45.jpg)
Possible New Patterns
Full Trace (promiscuous mode)
Embedded Message (PDU chain, protocol data unit, packet)
Ordered Message (TCP/IP sequence numbers)
Illegal Message (sniffed with illegally obtained privileges)
Dual Trace (in / out, duplex)
© 2013 Software Diagnostics Services
![Page 46: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/46.jpg)
Further Reading
Practical Packet Analysis, 2nd edition, by Chris Sanders Software Diagnostics Institute
Memory Dump Analysis Anthology: Volumes 3, 4, 5, 6, … Volume 7 is in preparation (July, 2013)
Introduction to Software Narratology
Malware Narratives
© 2013 Software Diagnostics Services
![Page 47: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/47.jpg)
What’s Next?
© 2013 Software Diagnostics Services
Accelerated Network Trace Analysis
Generative Software Narratology
Pattern-Oriented Hardware Signal Analysis
![Page 48: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/48.jpg)
Q&A
Please send your feedback using the contact form on DumpAnalysis.com
© 2013 Software Diagnostics Services
![Page 49: Network Trace Analysis - patterndiagnostics.com · Network Trace Analysis . Dmitry Vostokov . Software Diagnostics Services . Version 1.0 . Facebook. LinkedIn Twitter](https://reader034.vdocuments.net/reader034/viewer/2022052611/5f08fe6e7e708231d424b83a/html5/thumbnails/49.jpg)
Thank you for attendance!
© 2013 Software Diagnostics Services Facebook LinkedIn Twitter