And come here, walk with me for a second. We're going to talk about encryption and how that lines
up with deep packet inspection. You see, sometimes packets are sent from point A to point B
and they're encrypted. And the only way to be able to do a deep packet inspection on some of those
packets is if you open up the actual packet using the encryption keys that it was either sent with
or intended to be opened up with. And that can cause some problems too, because if the contents
of a packet are encrypted, most of the time, we don't have the keys to be able to open them.
And therefore, it makes it to where the contents are a little bit difficult for us to understand
and see if it's either good or malicious to our actual network overall. Now, as an example of
what I'm talking about here, I want to point out something I use kind of as an example while I go,
and that are my two fuel cans right there. Now, if you see, I have a red and a yellow one.
Normally, a red gas can or a fuel can is reserved for gasoline. And the reason that we do this is,
is because that way, if anybody walks up on it and they say, I need fuel,
the color indicates what type of fuel is in that can. And the yellow one indicates diesel.
And I trust based on the color of those cans, that the contents within are matching to what
matches the color code for those cans. So gasoline in the red one, diesel in the yellow one.
But if somebody comes around and changes those two up, there has to be a way for us to verify
the contents of those individual packets. And that is a purpose of the packet inspection,
because if I were to use those fuel cans, let's say the red one on this one, the tractor,
that would cause a lot of damage seeing as how that tractor is diesel. But if I were to use
the yellow one on that one, it'd cause a lot of damage because that mower is gasoline.
So I'd have to make sure that whatever packets get delivered are supposed to be going
to their intended recipient and also contain contents that aren't harmful to the recipient
as well. Well, that's all well and good, but that's considering the fact that those fuel cans
aren't filled up with encrypted fuel of some type. Because if you open them up and they both look
alike, smell alike, and taste alike, don't taste it, I promise you don't taste it, but and you
can't tell what they are, then you're taking a wild guess that whoever the intended recipient is
knows exactly what they're supposed to be doing with those cans. And that's a risk you don't want
to take with fuel or a packet going to its intended recipient. So we try our best to be
able, as security technicians, to be able to inspect the packets as best as we can. Now there
are tip-offs too because in previous skills we've gone through and noticed that there are ways for
us to be able to take a look at the contents of a packet because not all packets are encrypted or
encapsulated like that. We could go through and recover files from Wireshark and we'll go through
an example of that here in a minute. We could also go through and take a look at some of the hashing
of the contents of those files and make sure against websites like VirusTotal that the contents
are actually okay. And we've seen too that once those packets are opened up on the intended
recipients, like our BWAP system or our host VM inside of our labs, that if it's something malicious
the endpoint security system, whether it be IDS or IPS, triggers and says hey we got something
malicious on the system. Well why didn't the network in between catch all that? And that's
because in our lab environment we don't have deep packet inspection devices set up in a way for us
to be able to inspect said packets. And if we did we would want to try to wrap it up in such a way
to where it's not read on the inside, let's say like with encryption or whatever.