Cisco Router and i Л . , 1 T,

Switch Forensics: Investigating and

ing Malicious Network Activity D a l e Liu Lead Author and Technical Editor

James Burton Thomas Millar Tony Fowlie Kevin O'Shea Paul A. Henry James "Jim" Steele Jan Kanclirz, Jr. Scott Sweitzer Dave Kleiman Craig Wright

Analyz

Contents

Introduction An Overview of Cisco Router and Switch Forensics 1

Chapter 1 Digital Forensics and Analyzing Data 15 Chapter 2 Seizure of Digital Information 39 Chapter 3 The Mindset of a Network Administrator 75 Chapter 4 Arrival on the Scene 85 Chapter 5 Diagramming the Network Infrastructure 111 Chapter б Cisco IOS Router Basics 149 Chapter 7 Understanding the Methods and Mindset

of the Attacker 207 Chapter 8 Collecting the Non-Volatile Data

from a Router 251 Chapter 9 Collecting the Volatile Data from a Router 305 Chapter 10 Cisco IOS Switch Basics 391 Chapter 11 Collecting the Non-Volatile and Volatile

Data from a Switch 437 Chapter 12 Preparing Your Report 465 Chapter 13 Preparing to Testify 477 Index 499

XI