Demystifying Network Investigations with Packet Data
By Michael Morris, Director of Global Business Development, Endace
As we discussed with Ixia and Plixer recently in our How to Combat Encrypted Threats webinar (which you can watch here if you are interested) newer versions – 1.2 and 1.3 – of TLS should be preferred over older versions – 1.0 and 1.1 – because they’re much more secure, and better protect data in flight.
But removing older versions of TLS from your network can be challenging. First, identifying which versions are actually being used. Second, identifying which servers and clients are using outdated versions. And lastly, updating any servers inside your network that are using older TLS versions, and potentially blocking access to servers outside the network using older versions too, all without causing your users to scream!
It’s not just users you need to worry about either. Potentially you may have IoT devices on your network that are still using older TLS versions.
Thankfully, if you have access to recorded network traffic there’s an easy way …
In this second installment of Packet Detectives, industry-renowned SharkFest presenter and all-round Wireshark guru, Betty DuBois, shows how you can quickly answer all these questions using Wireshark to analyze the TLS traffic on your network to see which hosts and clients are using which versions. She has even created a special, custom Wireshark profile you can download to make the analysis even easier!
The truth is in the packets …
We hope you find this video useful. Please let us know if you have ideas for other examples you’d like to see.