Enterprise Networks today are complex, difficult to investigate, require specialized tools and demand exceptional and expert skills in order to properly respond to incidents. When dealing with incidents that involve critical infrastructure or other regulated industry environments the specialization of the toolkits can indeed be daunting.

One of the first challenges that face incident response teams and forensic investigation units is “What does your network consist of and how is it configured?” This may seem like a simple question that is easily answered by the Information Technology group. However, when responding to incidents like Heartbleed, Operation Shady Rat, and breaches at major retailers, the technical information and details regarding the network map can be vital.

More specific questions may also include:

If some or all of these questions can be answered the follow-up questions are of course:

Typically these answers come from the Chief Information Officer (CIO) or the directed IT personnel responsible for the network along with the (Chief Information Security Officer) CISO and related cyber security staff members. Each of these groups utilize a variety of tools to assist in managing the cyber assets under their control. These tools can range from a simple set of spreadsheets to complex asset control inventory and management systems, or in the worst case, stored between the ears of the staff members themselves. Don’t get me wrong, many of these folks are very talented and have a pulse and deep understanding of the networks they manage. All of this information regardless of its source or form factor is important and valuable to incident response and forensic investigation teams. They of course have the arduous task of determining what is happening or has happened, who is doing it, how to mitigate and remediate the damage and better defend against future incidents. All of the data regardless of the means of collection however, is necessary to execute a comprehensive forensic investigation.

Python Passive Network Mapping: P²NMAP - An open source solution to uncovering nefarious network activity deals with the challenge “what does your network consist of and what are identifiable or unusual behaviors?” Traditionally, network mapping is an active process whereby IT and cyber teams utilize tools to identify network based assets.

Nmap, (Network Mapper - a security scanner originally written by Gordon Lyon - also known by his pseudonym Fyodor Vaskovich) used to discover hosts and services on a computer network, works by communicating raw IP packets to specified IP address ranges to determine:

…and a plethora of other characteristics that can be tested and measured through this active interrogation method.

By way of a quick introduction let’s take a look at the current instantiation of Nmap for Windows using the Zenmap Graphical User Interface (GUI).

Figure 1-2 depicts the main display of Nmap running under the Zenmap GUI version 6.47. Zenmap is a multi-platform graphical front-end that interfaces with the standard command line of Nmap and then displays the results in a more useable and interactive format.

As you can see in Figure 1-2A, I have selected a simple ping Scan with a target selection of 192.168.0.0/24. Zenmap displays the exact Nmap command that will be executed based on the selections that I have made. Dissecting the command reveals the specific instructions delivered to the Nmap engine.

The results of this quick scan can be seen in Figure 1-3. As you scan through the list of computers and other devices on my local network you might find some interesting hits and responses.

If you are a more visual person, Figure 1-4 provides a graphical view of the network IP addresses identified. This allows users to drill down into specific devices and discover additional information.

There are several advantages and some disadvantages of this method. Table 1-2 defines some of these advantages and disadvantages.

Much like cartography which is described as both the art and science of map making, network mapping requires the same discipline, patience and consistency. Unlike cartography, however, where maps are re-drawn every 50-100 years, the maps of our digital network can change dramatically in just days.

You can see the contrast between a modern network map and a cartographer’s map in Figure 1-8 and Figure 1-9, respectively.

One of my favorite examples of this comes from a release by Hewlett Packard in the midst of the discovery of the Heartbleed vulnerability:

I want these processes to be easily usable by novice and expert users, students, academics, practitioners, programmers, incident response teams and those wanting to learn about both Python and network investigation as the same time. I always have found learning a new programming language or environment is much more fun if there is a problem to solve first.

In Chapter 2, I explain what you don’t know about your network - and more importantly, why you need to know it and why it is important. Also, I look at who is touching your network, and from where. Why should you be concerned about this?

Chapter 3 focuses on how to capture network packets with Python and some special tools. We also look at how you can efficiently store, index and manage what you capture. Most importantly, I discuss how you can do this silently.

Chapters 4 and 5 tackle the analysis of what we have captured, how to make sense of it and how to create an extensible toolkit. This toolkit can be freely used, shared, evolved and also includes opportunities for you to participate in the future expansion.

Chapter 6 takes a look at future opportunities and outlines next steps for P2NMAP.

Finally, each chapter includes a summary of topics covered, challenge problems and review questions making the book suitable for use in college and university academic environments.