网际网路数位监听网际网路通讯监察.pptVIP

Lawful Interception Packet Forensics Analysis System Casper Kan Chang Decision Group June 2010 IP Packet Capture Way There are 3 types of IP packet capture ways based on application and industry standard ： Packet captured from IP network： for IP network infrastructure in enterprises, ISP, IDC and LTE/WiMAX operators IP packet from Telco switch ： Tradition switch through Mediation Platform For IMS and all IP networks, IP Packet can be captured through service broker of application layer or directly from IP core switch of Media and End Point layer of IMS system From Cable TV ● ● IP Packet Capture Way– Sniffer All data packets on Ethernet are broadcasted in the network, i.e., all physical signals will flow to the network Interface card of the appliance. NIC card can be under promiscuous mode, so it can receive all data no matter what the MAC address it is. This is what the basic of Sniffer all about. Enterprise, ISP, IDC, LTE/WiMAX E-Detective Lawful Interception Can get that evidence? * For example : Email Sender email address, Receive email address Time and date Content Location … … More Sample: Email (POP3, SMTP and IMAP) Sample: IM -Yahoo, MSN, ICQ, IRC, QQ, GTalk etc… What Lawful Interception Needs Now….. Network Packet Capture and Reconstruction Ethernet VoIP Off-line Training Support Wireless 802.11a/b/g/n HTTPS/ SSL E-Detective – Mirror Mode Implementation Organization or Corporate Network Deployment Wireless-Detective Standalone System - Captures WLAN packets transmitted over the air ranging up to 100 meters or more (by using enhanced system with High Gain Antenna) Wireless-Detective – Implementation Diagram (1) WLAN Lawful Interception – Standalone Architecture Wireless-Detective Deployment (Capture a single channel, a single AP or a single STA) Wireless-Detective – WPA-PSK Cracking Sol. WPA-PSK Cracking Solution WPA Handshake packets need to be captured for cracking WPA key. Utilize Single Server or Distributed Servers (multiple smart pass