◇ OpenCyber Academy
Technologist · Chapter 2 · English

Chapter 2 — Networks and internet services

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Networks and internet services

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 The city network"]
  N2["2.2 DHCP"]
  N3["2.3 DNS"]
  N4["2.4 Firewall and proxy"]
  N5["2.5 VPN"]
  N6["2.6 Correlation"]
  N7["2.7 Clock and retention"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 The city network"]
  N2["2.2 DHCP"]
  N3["2.3 DNS"]
  N4["2.4 Firewall and proxy"]
  N5["2.5 VPN"]
  N6["2.6 Correlation"]
  N7["2.7 Clock and retention"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 The city network]
    |
    v
[2.2 DHCP]
    |
    v
[2.3 DNS]
    |
    v
[2.4 Firewall and proxy]
    |
    v
[2.5 VPN]
    |
    v
[2.6 Correlation]
    |
    v
[2.7 Clock and retention]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) explain how city systems connect to each other and the internet; (2) identify network logs useful in investigations; (3) understand DNS, DHCP and proxy records; (4) correlate an internal address to a device at a time.

2.1 The city network

Alder Falls has office VLANs, a server network, a guest Wi-Fi network and an internet edge with a firewall and web proxy. Services include DNS, DHCP, email and a remote-access VPN.

Each of these zones produces different evidence and is owned by different people. For an investigation on an office PC like CLERK-03, Jonah expects DHCP and DNS records from the internal services, firewall and proxy records from the internet edge, and possibly VPN records if remote access is involved. Guest Wi-Fi traffic should never reach the office VLANs; if it does, that is itself a finding.

2.2 DHCP

DHCP assigns IP addresses to devices for a lease period. Its logs map an IP address to a device's MAC address and hostname at a given time — essential, because addresses change.

A lease record typically holds the IP address, the MAC address, the hostname the device reported, and the lease start and end times. At Alder Falls, Jonah checks that the DHCP server's clock is synchronised and that its logs are kept for at least as long as the firewall logs, otherwise an old firewall entry cannot be tied to any device at all.

2.3 DNS

DNS logs show which names devices looked up. A burst of lookups to unusual domains from one PC is a lead.

A lookup is not a connection: the PC asked for a name, which may or may not have been followed by traffic. Answers are also cached, so a PC may connect again without a new lookup. Jonah therefore treats DNS as a lead to be checked against firewall or proxy records, and notes which resolver logged the query and in which time zone.

2.4 Firewall and proxy

The firewall logs allowed and blocked connections; the proxy logs web requests with URLs. Together they show where traffic went.

Each has limits. The firewall records addresses and ports but not content; the proxy records URLs only for web traffic that passes through it, and encrypted traffic may show just the host name. A connection that bypassed the proxy appears only in the firewall log. Jonah writes down which device produced each record, because the two often disagree slightly on time.

2.5 VPN

VPN logs show which accounts connected remotely, from which public addresses, and when.

At Alder Falls, a VPN record ties a city account to a public address and a session period. That helps answer whether an account was used from outside the city during an incident, but it says nothing about who was at the keyboard. A connection from an unusual country or at an odd hour is a lead to verify with the account owner, not proof of compromise.

2.6 Correlation

To answer "which device was 10.20.4.37 at 08:02?", Jonah checks the DHCP lease log: CLERK-03 held that address from 07:55 to 15:55. Without the DHCP record, the IP alone could mislead if leases changed.

Jonah also checks the lease window against the question: 08:02 falls well inside the 07:55 to 15:55 lease, so the mapping is firm. If the time had been close to a lease boundary, he would note that the address might have belonged to another device and look for the neighbouring lease records before naming CLERK-03 in a report.

2.7 Clock and retention

Network devices must sync time; logs must be kept long enough to cover the period before an incident is discovered.

In practice Renata checks both points at the start of any case. All city devices should take time from the same internal server, so a firewall entry and a DHCP lease can be compared to the second. Retention must cover the period between compromise and discovery, which is often weeks; if logs roll over in a few days, earlier activity simply cannot be reconstructed.

Guest Wi-Fi

Guest Wi-Fi is separated from office networks, and its logs record device MAC addresses rather than accounts. Jonah notes that many phones randomise MAC addresses, making guest records weak for identifying devices over time.

Worked example

The proxy log lists web requests from 10.20.4.37 at 08:02, around the time CLERK-03 began misbehaving. DHCP maps that address to CLERK-03 for the whole period. Renata notes the finding with both log sources and their times, and checks that both devices sync to the same time server. The remote-desktop attempts against CLERK-03 itself do not appear in the firewall log, which records only internet traffic; they are found later in the desktop's own security log.

Synthetic case. The logs are invented.

Errors and limits

An IP-to-device mapping is only as good as the DHCP log; static addresses or spoofing break it.

Exercises

Synthesis

Network services leave records that, correlated by time, tie traffic to devices — within the limits of those records.

Continue studying — chapter 02 of 30

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →