Top 5 false positives
Download as PPTX, PDF1 like116 views
The document outlines a presentation from Sharkfest '16 by Jasper Bongertz, focusing on the top five false positives in network analysis. These include negative delta times, frame size and checksum issues, retransmissions with duplicate acknowledgments, zero window conditions, and retransmission costs, each illustrated with Wireshark demos. The session aimed to educate attendees on common pitfalls in network traffic analysis.
Top 5 false positives
- 1. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 SharkFest ‘16 Top 5 False Positives Jasper Bongertz Thursday, June 16, 2016 Expert Analyst | Airbus Defence and Space CyberSecurity
- 2. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay Agenda 1. Negative Delta Times 2. Frame size and checksum problems 3. Retransmissions and Duplicate ACKs 4. Zero Window 5. Retransmission cost
- 3. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay 1. Negative Delta Times
- 4. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay 1 - Wireshark Demo
- 5. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay 2. Frame size and checksum problems
- 6. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay 2 - Wireshark Demo
- 7. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay False Positive 2 explained The offloading effect Application Operating System NIC driver Application Operating System NIC driver Dum pcap Sender Receiver
- 8. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay 3. Retransmissions and Dup ACKs
- 9. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay 3 – Wireshark Demo
- 10. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay False Positive 3 explained (1/3) Mirror Port Monitor Port SPAN with a single port mirrored
- 11. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay False Positive 3 explained (2/3) Mirror Port Monitor Port Mirror Port SPAN with two ports mirrored
- 12. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay False Positive 3 explained (3/3) Mirror Port Monitor Port Mirror Port SPAN with two ports mirrored
- 13. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay 4. Zero Window
- 14. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay 4 – Wireshark Demo
- 15. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay 5. Retransmission cost
- 16. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 @packetjay 5 – Wireshark Demo
- 17. SharkFest ‘16 • Computer History Museum • June 13-16, 2016 Q&A Mail: jasper@packet-foo.com Web: blog.packet-foo.com Twitter: @packetjay
Editor's Notes
- #18: Background Photo: Flickr user Fredrik Andreasson