Statistic Key Additions Key Deletions Rekeys Active Tunnels Bad SPI Packets in VS .NET

Drawing QR Code 2d barcode in VS .NET Statistic Key Additions Key Deletions Rekeys Active Tunnels Bad SPI Packets

Packets With Replay Detection Confidential Bytes Sent Confidential Bytes Received Authenticated Bytes Sent

Authenticated Bytes Received Transport Bytes Sent Transport Bytes Received Bytes Sent In Tunnels Bytes Received In Tunnels Offloaded Bytes Sent Offloaded Bytes Received

11-38

11

Netcap.exe is a command-line utility that you can use to capture network traffic to a cap ture file. You can then load the file in Network Monitor to view the captured traffic. The Network Monitor tool does not have to be installed on the computer running Windows Server 2003 to use Netcap. You can also use Netcap on computers running Windows XP, which makes it an extremely attractive way to capture traffic for later review. The tool is available after the Windows Server 2003 Support Tools have been installed. When you first run the command, the Network Monitor driver is automatically installed. Table 11-9 describes the syntax used to obtain a capture.

Table 11-9

/t Type Buffer HexOffset Informs trigger when to stop the capture, when either the buffer or HexPattern pattern is reached. The capture stops when the buffer is full if no trig ger is defined. /t N can be used to cause the capture to continue when the buffer is full. New frames overwrite the oldest frames. Valid values for the Type parameter are B = buffer; P = pattern; BP = buffer then pattern; PB = pattern then buffer; N = no trigger. Valid values for the Buffer parameter are % Buffer size 25, 50, 75, and 100. This parameter is used with all Type values except P. Valid values for the HexOffset parameter are hex offset from start of frame used with P, BP, PB, but not B. Valid values for the HexPattern parameter are hex pattern to match. Used with P, BP, PB, but not B. The pattern needs to be an even number of digits. /C:CaptureFile Specifies a location where Netcap will move the temporary capture files. This location can be any valid local or remote path. If /C is not specified, the capture path remains in the default temporary capture folder. Specifies a filter to use during the capture. A filter file has a .cf extension. Captures for some amount of time. Changes temporary capture folder. Path must be on a fixed local hard disk drive. Removes Netcap instance of the Network Monitor driver. Provides the NIC index number for this computer. 0 = PPP/SLIP interface. 1 = Local Area Connection 2; 2 = Local Area Connection. Determine the NIC index number using the Netcap / command. All adapters installed on the local computer will be listed.

Monitoring Network Protocol Security 11-39

The following are two example commands: Capture the packets received on NIC 2 using a 20-MB buffer:

Netcap /n:2 /b:20

Capture for one hour:

Netcap /L:01:00:00

Kerberos is a complex authentication protocol described in RFC 1510. It is used as the preferred authentication protocol for Windows 2000 and Windows Server 2003 domains. Windows XP Professional, Windows 2000, and Windows Server 2003 com puters that are domain members will preferably use Kerberos authentication. Knowl edge of the authentication process allows you to determine the following:

Whether Kerberos is being used. Kerberos is a more secure protocol than its pre decessor, NTLM. Whether Kerberos errors represent normal functions, Kerberos problems that need to be corrected, or symptoms of attack. Whether Kerberos errors or issues mean problems with replication, Active Direc tory operation, DNS, or other critical network services.

Reading the RFC and even reading a shortened version of the algorithm is instructive, but it is much more fun to follow Kerberos logons using Network Monitor, the Security Event log, and Resource Kit utilities Kerbtray.exe and Klist.exe. The following sections introduce Kerberos by using these tools to monitor logon sessions. Be sure to complete the exercises so that you can observe Kerberos activity firsthand.

See Also To read the Kerberos RFC 1510, The Kerberos Network Authentication Ser vice, go to http://www.ietf.org/rfc/rfc1510.txt number=1510. You can also find more information on how Kerberos is implemented in Windows in the Kerberos white paper at http://www.microsoft.com/TechNet/prodtechnol/windows2000serv/deploy/kerberos.asp.