User manual CACE TECHNOLOGIES PILOT V1.0

[. . . ] User's Manual CACE Pilot Page 1 PUBLISHED BY CACE Technologies 1949 5th St. No part of the contents of this manuscript may be reproduced or transmitted in any form or by any means without the written permission of the publisher. Wireshark and the Wireshark icon are registered trademarks of Wireshark Foundation, Inc. Microsoft Word, DOS, Windows XP, Microsoft Excel, Microsoft Wordpad, and Windows Vista are registered trademarks of Microsoft. [. . . ] Pilot offers a complete collection of Charts including bar, pie, and strip charts, conversation rings and grids. Charts are interactive ­ they can be resized, moved, and most importantly, users can perform visual selections on graphical elements within a Chart, such as selecting individual bars within a bar chart or time intervals within a strip chart. The interactive charts can be thoroughly customized, saved, exported, imported, and shared with colleagues. Each of these charts can be included in Pilot's automated report generator and their data can be exported to multiple formats. CACE Pilot Page 13 Drill-Down Drill-Down is one of the most powerful and unique features of Pilot. Drill-Down occurs when the user applies a View to a source which itself is the result of a selection make within a Chart of a previously instantiated View ­ this powerful paradigm increases your analysis capabilities many fold. Through CACE Technologies' industry-leading and visually-based Drill-Down feature, Pilot can be used to analyze very large trace files, quickly guiding the user to the handful of packets responsible for the anomalous network behavior. Report Generation Graphically customizable reports can be automatically generated that show things such as: Conversations at any or all network layers IP fragmentation analysis DHCP address assignment Top talkers for TCP Unicast vs. broadcast traffic And much more; in fact, hundreds of easy to use charts that can be scoped and limited to whatever conditions necessary. These charts can be combined in a single report or created in separate reports in one or more formats, with just a click of the mouse. Supported formats include: PDF Microsoft Excel Microsoft Word HTML All relevant trace files and their MD5 digests can be automatically packaged in a ZIP file along with the generated reports for easy distribution. Wireless Integration Pilot was designed with wireless network analysis taken into heavy consideration. It features the following abilities: Aggregation of multiple wireless devices for easy management. Analysis that includes, but is not limited to, the following: o Per channel, per host, and per network analysis of things such as Bandwidth over time Signal versus noise over time 802. 11 frame types over time o Access point and station discovery o Vendor discovery Analysis and graphical displays of the following o Retransmission conversations o Access point associations o Top traffic across networks, channels, or any subset o Probe requests Purpose and Layout of this Manual CACE Pilot Page 14 It is assumed that the reader of this manual is familiar with networking protocols and the principles of a networking stack. Care was taken to avoid technical explanations except when necessary for conceptual understanding or functional explanation. This manual is meant to be coupled with videos available online and on the CD shipped with Pilot. Since certain things are better explained by visual example, to gain a full understanding of the capabilities of Pilot and to maximize your facility with this unique tool, we recommend that both this manual and the videos be viewed. Installation Although the system requirements for Pilot scale with usage, in order to use Pilot effectively, the following minimum configuration is recommended: Operating System Windows XP or Windows Vista Host Hardware A Core Duo class machine or equivalent Available Disk Space A base install requires approximately 250MB of disk space. Additional space is required to store generated reports or trace files created with Pilot. Memory At least 1024MB of system memory Video Hardware and Settings DirectX 9. 0 capable graphics card and a display of at least 1024x768 pixels. To run pilot, click on the Start Menu and select Programs -> Pilot -> Pilot 1. 0. CACE Pilot Page 15 Graphical User Interface Graphical User Interface Components Figure 2 User Interface Breakdown (Major) The graphical user interface of Pilot, broken up into the four main sections, is shown in Figure 2. The descriptions below are conceptual overviews of each section. Ribbon Panel The Ribbon Panel provides access to global settings, management, and general actions. There are two panels by default that can be tabbed through either by using the mouse wheel or clicking on the tabs. Figure 3 Ribbon Panel CACE Pilot Page 16 Devices and Files The Devices and Files panel is one of the most important parts of Pilot. The meaning of each is the following: Devices All devices that offer "live" network traffic to Pilot. Files PCAP formatted trace files. Figure 4 Devices and Files Panel Views The Views panel contains a library of visual analysis configurations called "views". [. . . ] CACE Pilot Page 74 Submenu 10 Decryption Keys with Key Submenu 11 Decryption Keys with Key (Detail) WPA Related Packet Injection Wireless networks secured using the WPA protocol cannot be decrypted as easily as their WEP counterparts. This is because unlike with WEP, simply having a decryption key is not enough to view the traffic of other stations on a network. The access point establishes a different, temporary, ostensibly unique trusted link with each station on the network. In order to successfully decrypt WPA traffic then, even with a valid decryption key, the set up of this link needs to be captured. [. . . ]