Security Analysis With PacketQC

This section provides a step-by-step walkthrough on how to access PacketQC and perform a security assessment using the application. For a complete understanding of the process, we recommend following each section in sequence, from accessing PacketQC to generating a security report.

Step 1: Begin Your Network Analysis

To begin using PacketQC, you will need a PCAP or PCAPNG file, which can be obtained using tools such as Wireshark or from an existing capture. Refer to Capturing network traffic in pcap/pcapng for instructions on capturing network traffic.

Once uploaded, PacketQC allows you to explore discovered network connections and examine the cryptographic mechanisms used in your network communications.

Follow the steps below to start your network analysis.

  1. Access PacketQC:

    1. Access PacketQC through any web browser at http://localhost:80 if installed locally.

    2. Or visit our public demo at https://www.packetqc.com to explore the application online.

  2. Log in to your PacketQC account: Click LOGIN at the top right to log in to PacketQC. New users can register an account or contact info@pqcee.com for assistance.

  3. Access network analysis page: Once logged in, click NETWORK VIEW ① from the navigation bar at the top of the application.

  4. Upload PCAP:

    1. Click ADD PCAP ② to upload your network traffic file.

    2. Select a PCAP or PCAPNG file from your device.

    3. Wait for PacketQC to complete the analysis.

  5. Review network analysis: Review the results ③ displayed in NETWORK VIEW.

_images/usage-howtogetstarted.png

Fig. 3 PacketQC Network View, with numbered references to the instructions above.

Step 2: Cryptographic Discovery

After analysing the uploaded PCAP or PCAPNG file, PacketQC displays the discovered network connections in the NETWORK VIEW.

Explore the discovered network connections to identify where cryptographic mechanisms are used and understand how they protect network communications.

Follow the steps below to explore discovered connections.

  1. Review network analysis: In NETWORK VIEW, review the list of discovered network connections ①.

  2. Examine cryptographic information:

    1. Click the dropdown arrow ② beside any connection to view its details.

    2. Examine the cryptographic information ③ displayed, such as the encryption algorithms and key exchange mechanisms used.

  3. Filter connections: Use Filter by Protocol/Port ④ to narrow the results to specific protocols or ports.

_images/usage-cryptographicdiscovery.png

Fig. 4 PacketQC Network View, with numbered references to the instructions above.

Step 3: Asset Management

PacketQC maintains an inventory of network assets identified during network analysis. Assets that were not discovered through network analysis can be manually added.

Through Asset View, users can review and manage their assets, add new assets, and upload CBOMs to evaluate the cryptographic security of each asset.

Follow the steps below to manage your assets.

  1. Access Asset View: Click ASSET VIEW ① from the navigation bar at the top of the application.

  2. View and edit assets: Click the eye icon ② beside an asset to view its details, or the pencil icon ③ to edit its information. You can also use either icon to upload a CBOM to the asset.

  3. Manually add assets: To add an asset manually, click ADD ASSET ④, complete the required information, and click CREATE ASSET.

_images/usage-assetmanagement.png

Fig. 5 PacketQC Asset View, with numbered references to the instructions above.

Step 4: Security Assessment

PacketQC evaluates cryptographic mechanisms identified from network traffic and uploaded CBOMs against configured security policies to assess their security.

Users can review the assessment results to understand the security of their network connections and assets, and identify areas that require further attention.

Follow the steps below to review your security assessments.

  1. View overall security: Navigate to DASHBOARD ① to review the overall security assessment results.

  2. Review Security Assessment Results: In NETWORK VIEW ②, examine the Security Level ③ assigned to each connection:

    1. QS (Quantum Secure): Secure against classical and quantum threats.

    2. CS (Classically Secure): Secure against classical threats, but not quantum threats.

    3. IN (Insecure): Does not meet the configured security requirements.

    4. UC (Unclassified): Insufficient information to determine its security classification.

  3. Identify potential vulnerabilities: Use Filter by Security Level ④ to display connections with specific security levels.

  4. Review asset security: Navigate to ASSET VIEW ⑤ and examine the security assessment results of uploaded asset CBOMs.

_images/usage-understandingpqc-securityassessment.png

Fig. 6 PacketQC Network View, with numbered references to the instructions above.

Step 5: Reporting

Security reports provide a consolidated record of PacketQC’s cryptographic security assessments, supporting documentation, review, and further investigation.

Users can download interactive security reports and generated CBOMs to review security levels, and examine detailed findings for network connections and managed assets.

Follow the steps below to generate a security report.

  1. Generate Report: Once the network analysis is complete, click GENERATE REPORT ①.

  2. Download Vulnerability Report: Click Interactive Report to download the HTML version, or Printed Report to download the PDF version.

_images/usage-understandingpqc-reporting.png

Fig. 7 PacketQC Network View, with numbered references to the instructions above.

_images/usage-vulreport.png

Fig. 8 Sample Vulnerability Report