Reference no: EM133255474

PART 2 & PART 3: FILTERING, INSPECTING, AND ANALYZING THE PCAP FILE- Analysis of the Packet Details of the Loaded PCAP Files | Using the Statistics | Flow Graph Tool

1. What is the BSSID of each device being used, and the MAC address of the WAP found? Remember that the BSSID is the MAC address of the device.   
2. What is the name and vendor of the WAP found? What is/are the channel(s) being used in those cases? 
3. Were any of these in the approved device whitelist? Note that those not on the list are unapproved devices on the network.
4. By analyzing the packet details of the loaded PCAP file, determine the nature of communications occurring between the source and destination endpoints (or IP addresses). What differentiates the receiver and transmitter addresses from the source and destination addresses?
5. Do you see any indication of any wireless vulnerabilities such as the use of default SSIDs and passwords and the security implications of the frame check sequence upon analyzing the WLAN traffic? Why or why not?
6. Does the channel information match any device in the approved whitelist?  Does the source device, using this channel, match those in the approved whitelist? If not, then this is an unapproved device on the channel being used. 
7. What devices do you suspect as rogue WAPs overall? Explain why.
8. By analyzing the packet details of the loaded PCAP file, determine the nature of communications occurring between the source and destination endpoints (or IP addresses). 
9. What useful information can you determine from the flow graph based on your analysis w.r.t. any IOC of the wireless/mobile communications?
10. How is this indication different from the Statistics information retrieved earlier and from the perspective of this attack? Is there any Wireshark feature that can help you arrive at the same conclusion?
11. If malicious actors got into your network to access your network security logs, how could they use the packet details to their advantage? Specifically, what utilities within Wireshark can you count on?
12. Describe some automated tools and techniques that could be added to prevent similar events. Also, consider statements to add to the BYOD policy to strengthen compliance requirements.