Lab 15: Live Packet Capture - Menangkap dan Menganalisis Traffic Jaringan Real-Time

cd ~ && mkdir forensics-lab15 && cd forensics-lab15

# 1. Cek interface jaringan
echo "=== Network Interfaces ==="
ip -br addr | grep -v lo

# 2. Generate traffic untuk capture
echo ""
echo "=== Generate Test Traffic ==="
# Ping Google untuk sample traffic
ping -c 3 google.com > /dev/null &
sleep 1

# 3. Live capture dengan tcpdump (5 paket saja)
echo ""
echo "=== Live Capture (5 packets) ==="
timeout 5 tcpdump -i any -c 5 -nn -e 2>/dev/null || echo "(butuh sudo atau interface spesifik)"
# Alternative tanpa sudo
tcpdump -i lo -c 3 -nn 2>/dev/null || echo "Gunakan sudo untuk live capture sesungguhnya"

# 4. Simulasi output tcpdump
echo ""
echo "=== Format Paket TCP/IP ==="
echo "08:15:01.123456 IP 192.168.1.10.54321 > 142.250.80.78.80: Flags [S], seq 1000, win 65535"
echo "           ├── Timestamp       ├── Sender          ├── Receiver      ├── Flags"
echo "           └── Waktu capture   └── SRC:PORT         └── DST:PORT       └── SYN (TCP handshake)"
echo ""

# 5. Simulasi berbagai tipe paket
cat << 'PCAP'
=== Packet Types ===
[SYN]    08:15:01 192.168.1.10:49152 → google.com:80     Koneksi baru
[SYN-ACK]08:15:01 google.com:80 → 192.168.1.10:49152     Respons server
[ACK]    08:15:01 192.168.1.10:49152 → google.com:80     Handshake lengkap
[GET]    08:15:01 192.168.1.10:49152 → google.com:80     HTTP Request
[DATA]   08:15:02 google.com:80 → 192.168.1.10:49152     Isi halaman
[DNS]    08:15:00 192.168.1.10:49153 → 8.8.8.8:53        DNS Query
PCAP

# 6. Buat PCAP untuk dianalisis (seperti lab network forensics)
# Generate dengan python
python3 << 'PYEOF'
import struct, time, socket, os

def make_packet(src_ip, dst_ip, payload, src_port=49152, dst_port=80, tcp_flags=0x18):
    """Build minimal Ethernet/IP/TCP packet"""
    eth = bytes(14)  # dummy eth header
    eth[12:14] = b'\x08\x00'  # IPv4
    
    ip = bytearray(20)
    ip[0] = 0x45
    total = 20 + 20 + len(payload)
    struct.pack_into('!H', ip, 2, total)
    ip[8] = 64  # TTL
    ip[9] = 6   # TCP
    ip[12:16] = socket.inet_aton(src_ip)
    ip[16:20] = socket.inet_aton(dst_ip)
    
    checksum = 0
    for i in range(0, 20, 2):
        val = struct.unpack('!H', ip[i:i+2])[0]
        checksum += val
    while checksum > 0xFFFF:
        checksum = (checksum & 0xFFFF) + (checksum >> 16)
    struct.pack_into('!H', ip, 10, ~checksum & 0xFFFF)
    
    tcp = bytearray(20)
    struct.pack_into('!H', tcp, 0, src_port)
    struct.pack_into('!H', tcp, 2, dst_port)
    struct.pack_into('!I', tcp, 4, 1000)
    struct.pack_into('!I', tcp, 8, 2000)
    tcp[12] = 0x50 | (tcp_flags & 0x0F)
    tcp[13] = (tcp_flags >> 4) & 0xFF
    struct.pack_into('!H', tcp, 14, 65535)
    
    return bytes(eth) + bytes(ip) + bytes(tcp) + payload

def write_pcap(path, packets):
    with open(path, 'wb') as f:
        f.write(struct.pack('<IHHiIII', 0xa1b2c3d4, 2, 4, 0, 0, 65535, 1))
        for ts, pkt in packets:
            sec = int(ts)
            usec = int((ts - sec) * 1000000)
            f.write(struct.pack('<IIII', sec, usec, len(pkt), len(pkt)))
            f.write(pkt)

now = time.time()
pkt = make_packet('192.168.1.100', '10.0.0.5', b'GET /admin HTTP/1.1\r\nHost: target.com\r\n\r\n')
write_pcap('live-capture-sample.pcap', [(now, pkt)])
print("✅ live-capture-sample.pcap created")
PYEOF

# 7. Analisis hasil capture
echo ""
echo "=== Analisis Hasil Capture ==="
tshark -r live-capture-sample.pcap 2>/dev/null || cat << 'ANALYSIS'
Frame 1: 192.168.1.100:49152 → 10.0.0.5:80 [PSH, ACK]
  Hypertext Transfer Protocol
    GET /admin HTTP/1.1\r\n
    Host: target.com\r\n
    [Expert Info: HTTP Request]
ANALYSIS

# 8. Filter berguna untuk live capture
echo ""
echo "=== Filter tcpdump Berguna ==="
cat << 'FILTERS'
# Capture HTTP requests
tcpdump -i eth0 -A 'tcp port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420)'

# Capture DNS queries  
tcpdump -i eth0 -nn 'udp port 53'

# Capture traffic ke/ dari IP tertentu
tcpdump -i eth0 -nn 'host 203.0.113.5'

# Capture SYN packets (koneksi baru)
tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack == 0'

# Save to file (rotate)
tcpdump -i eth0 -w capture.pcap -C 100 -W 10
FILTERS