
\section{Exercise 2 - Task 1}
\subsection{Rep:2.a}
In order to use scapy we need to convert out pcap-ng dump to pcap.
\begin{verbatim}
$ editcap -F libpcap team15_ex21.pcapng team15_ex21.pcap
\end{verbatim}

We are only interested in flows with more (or equal) than 400 packets, each exported as a separate pcap file.

\begin{verbatim}
$ ./somefilter.py | sh
\end{verbatim}

./somefilter.py
\begin{redframe}\begin{scriptsize}\begin{verbatim}
#!/usr/bin/env python

from scapy.all import *

def somefilter(pcapfile):
    flows = dict()
    for p in PcapReader(pcapfile):
        if IP in p:
            src = p[IP].src
            dst = p[IP].dst

            if (src,dst) in flows:
                flows[(src,dst)] +=1
            else:
                flows[(src,dst)] = 1

    for flow,cnt in flows.items():
        if cnt >= 400:
            print 'tshark -r '+pcapfile+' -w "flow_'+flow[0]+'_'+flow[1]+'.pcap" -F pcap ' \
                   + '\'ip.src == '+flow[0]+' and ip.dst == '+flow[1]+'\''

if __name__ == "__main__":
    somefilter("team15_ex21.pcap")
\end{verbatim}\end{scriptsize}\end{redframe}

With Wireshark we poked around and exported the flows to csv to further investigate.

While poking around we came across an unexpected value of srcport.
\begin{verbatim}
$ ./srcfeat_power.py --input flow_114.176.157.191_221.72.61.209.csv --feature srcport
# 114.176.157.191,541,2,1.5469339647025981
\end{verbatim}
There seemed to be 2 different srcports, occuring nearly equally often.
We looked into it with Rapidminer and found a suspiciously alternating srcport jumping between \emph{\textbf{5950}} and \emph{\textbf{5960}}.

\includegraphics[width=0.6\columnwidth,keepaspectratio]{content/e21_flow_114_176_157_191_221_72_61_209_srcport.png}

\subsection{Rep:2.b}
The message is \emph{\textbf{Data acquired. Key for message (len=42 \& pkts>200): nSa123 (Scott)}}

\begin{redframe}\begin{scriptsize}\begin{verbatim}
#!/usr/bin/env python

import csv
import binascii

def somedecode(filename):
  with open(filename, 'rb') as csvfile:
    spamreader = csv.reader(csvfile, delimiter=',', quotechar='"')
    header = None
    bits = ""

    for row in spamreader:
      if header is None:
        header = row
        continue

      if row[2] == '114.176.157.191' and row[10] == '5950':
        bits += "0"
      if row[2] == '114.176.157.191' and row[10] == '5960':
        bits += "1"

    bits = bits[:-(len(bits)%8)]
    print binascii.unhexlify('%x' % int(bits, 2))

if __name__ == "__main__":
    somedecode("flow_114.176.157.191_221.72.61.209.csv")
\end{verbatim}\end{scriptsize}\end{redframe}


\section{Exercise 2 - Task 2}
\subsection{Rep:2.c}

Then we converted the file {\tt team15\_ex22.pcap} from the pcap-ng format to the pcap format to be able to use it with {\tt scapy}.

\begin{lstlisting}
$ editcap -F libpcap team15_ex22.pcap ex22.pcap
\end{lstlisting}

Then we filtered out the large flows with more than 200 packets and a frame length of 42 as mentioned in the solution from task 1.

% TODO \begin{didntwork}
./task2/readflows.py
% {('53.151.211.106', '217.115.203.44'): (213, 0)}

filter into file
ip.addr == 53.151.211.106 and ip.addr == 217.115.203.44 and eth.len == 42

generate graph:
large\_flow.png

save bytes (ipid) from stream to file
./decode\_ipid.py

try decoding with password from previous task
openssl enc -d -rc4 -nosalt -k nSa123 -in stream\_encrypted -out stream\_decrypted

-> didn't work

tried reversing the bytes (lower byte first, upper byte next)

-> didn't work

trying to decode the second-largest flow:
ip.addr == 96.55.191.225 and ip.addr == 217.115.203.44 and eth.len == 42

-> didn't work
% TODO \end{didntwork}

Finally we found out, that scapy removes the frame length when parsing packets with the {\tt PcapReader}.

This does not happen with the {\tt PcapRawReader}, so we rewrote the script a bit.

% TODO continue writing here

filter into files

./readflows.py

manually create csv files

for i in large\_flow\_*.csv ; do ./../../only\_decimal.sh \$i > \${i\%.csv}.dehexed.csv ; done

./autocorrelate.sh | grep -v "All values are identical" | sort -k2

-> ./parse\_stream\_data.py

\subsection{Rep:2.c}
Agent South was captured! Aborting operation. (Agent Scott)
