Netwerkverkeeranalyse met Wireshark

network-traffic-analysis/
├── sample-captures/
│   ├── legitimate-traffic.pcap
│   ├── malware-c2.pcap
│   ├── data-exfiltration.pcap
│   └── ddos-attack.pcap
├── analysis-scripts/
│   ├── pcap-parser.py
│   ├── flow-analyzer.py
│   └── threat-detector.py
├── filters/
│   ├── common-filters.txt
│   ├── threat-specific-filters.txt
│   └── custom-filters.txt
├── documentation/
│   ├── wireshark-guide.md
│   ├── protocol-reference.md
│   └── analysis-checklist.md
├── reports/
│   └── traffic-analysis-template.md
└── README.md

# Toon alleen HTTP verkeer
http

# Toon alleen DNS verkeer
dns

# Toon verkeer van/naar specifiek IP
ip.addr == 192.168.1.100

# Toon verkeer op specifieke poort
tcp.port == 443

# Sluit lokaal netwerkverkeer uit
not ip.addr == 192.168.0.0/16

# Potentieel malware beaconing (regelmatige intervallen)
frame.time_delta > 300 and frame.time_delta < 400

# Verdachte user agents
http.user_agent contains "curl"

# Grote bestandsoverdrachten
http.content_length > 1000000

# PowerShell verkeer
tcp.port == 5985 or tcp.port == 5986

# RDP verbindingen
tcp.port == 3389

# SSH verbindingen
tcp.port == 22

# TLS/SSL verkeer
ssl

# Certificaat problemen
ssl.alert_message

# Handshake failures
ssl.handshake.type == 0

from scapy.all import *
import pandas as pd
from collections import Counter

def analyze_pcap(pcap_file):
    """
    Analyseer PCAP bestand op beveiligingsgebeurtenissen
    """
    packets = rdpcap(pcap_file)
    
    analysis = {
        'total_packets': len(packets),
        'protocols': Counter(),
        'top_sources': Counter(),
        'top_destinations': Counter(),
        'top_ports': Counter(),
        'suspicious_patterns': []
    }
    
    for packet in packets:
        # Protocol analyse
        if IP in packet:
            analysis['protocols'][packet[IP].proto] += 1
            analysis['top_sources'][packet[IP].src] += 1
            analysis['top_destinations'][packet[IP].dst] += 1
        
        # Poort analyse
        if TCP in packet:
            analysis['top_ports'][packet[TCP].dport] += 1
        elif UDP in packet:
            analysis['top_ports'][packet[UDP].dport] += 1
    
    return analysis

def detect_beaconing(packets, time_threshold=60):
    """
    Detecteer potentiële C2 beaconing patronen
    """
    connections = {}
    
    for packet in packets:
        if IP in packet and TCP in packet:
            key = f"{packet[IP].src}:{packet[TCP].sport}-{packet[IP].dst}:{packet[TCP].dport}"
            
            if key not in connections:
                connections[key] = []
            
            connections[key].append(packet.time)
    
    beacons = []
    for conn, timestamps in connections.items():
        if len(timestamps) >= 3:
            intervals = []
            for i in range(1, len(timestamps)):
                intervals.append(timestamps[i] - timestamps[i-1])
            
            # Controleer op regelmatige intervallen
            avg_interval = sum(intervals) / len(intervals)
            variance = sum((x - avg_interval) ** 2 for x in intervals) / len(intervals)
            
            if variance < time_threshold:  # Lage variantie wijst op regelmatig patroon
                beacons.append({
                    'connection': conn,
                    'avg_interval': avg_interval,
                    'packet_count': len(timestamps)
                })
    
    return beacons

import pyshark
import socket

def analyze_flows(pcap_file):
    """
    Analyseer netwerk flows op anomalieën
    """
    cap = pyshark.FileCapture(pcap_file)
    
    flows = {}
    for packet in cap:
        try:
            if hasattr(packet, 'ip') and hasattr(packet, 'tcp'):
                src_ip = packet.ip.src
                dst_ip = packet.ip.dst
                src_port = packet.tcp.srcport
                dst_port = packet.tcp.dstport
                
                flow_key = f"{src_ip}:{src_port}-{dst_ip}:{dst_port}"
                
                if flow_key not in flows:
                    flows[flow_key] = {
                        'packet_count': 0,
                        'bytes_total': 0,
                        'start_time': float(packet.sniff_timestamp),
                        'end_time': float(packet.sniff_timestamp),
                        'flags': set()
                    }
                
                flows[flow_key]['packet_count'] += 1
                flows[flow_key]['end_time'] = float(packet.sniff_timestamp)
                
                if hasattr(packet, 'tcp'):
                    flows[flow_key]['flags'].add(packet.tcp.flags)
                
                # Bereken bytes (vereenvoudigd)
                flows[flow_key]['bytes_total'] += int(packet.length)
        
        except AttributeError:
            continue
    
    return flows

def detect_anomalous_flows(flows):
    """
    Identificeer verdachte netwerk flows
    """
    anomalies = []
    
    for flow_key, flow_data in flows.items():
        # Langdurige verbindingen
        duration = flow_data['end_time'] - flow_data['start_time']
        if duration > 3600:  # Meer dan 1 uur
            anomalies.append({
                'flow': flow_key,
                'type': 'long_connection',
                'duration': duration,
                'details': flow_data
            })
        
        # Hoge byte overdrachten
        if flow_data['bytes_total'] > 100000000:  # Meer dan 100MB
            anomalies.append({
                'flow': flow_key,
                'type': 'large_transfer',
                'bytes': flow_data['bytes_total'],
                'details': flow_data
            })
        
        # Frequent kleine pakketten (potentieel beaconing)
        if flow_data['packet_count'] > 1000 and flow_data['bytes_total'] < 10000:
            anomalies.append({
                'flow': flow_key,
                'type': 'frequent_small_packets',
                'packet_count': flow_data['packet_count'],
                'details': flow_data
            })
    
    return anomalies

# Zoek naar lange DNS queries
dns.qry.name contains "很长" or dns.flags.rcode == 3

# Hoog volume DNS queries naar enkel domein
dns and frame.time_delta < 0.1

# WinRM verkeer
tcp.port == 5985 or tcp.port == 5986

# PowerShell Web Access
http.request.uri contains "/powershell"

# Grote HTTP POST verzoeken
http.request.method == POST and http.content_length > 1000000

# FTP uploads
ftp and ftp.request.command == "STOR"

Flow Analyse Resultaten:
- Verbinding: 192.168.1.50:54321-185.14.28.100:443
- Gemiddeld interval: 301 seconden (5 minuten)
- Pakket telling: 47 verbindingen
- Patroon: Regelmatige HTTPS beacon met POST data
- Beoordeling: Hoge betrouwbaarheid C2 communicatie

Anomalie Gedetecteerd:
- Flow: 10.0.0.15:5555-203.0.113.10:21
- Overdracht grootte: 250MB
- Duur: 2 minuten
- Protocol: FTP
- Bestanden: customer_data_2026.zip
- Beoordeling: Potentiële data exfiltratie