Using PacketQC

This section guides users through the use of PacketQC, covering its key features and activities involved in managing cryptographic assets and evaluating post-quantum security readiness.

In This Section

1. PacketQC features walkthrough

2. Capturing network traffic in pcap/pcapng

---

1. PacketQC features walkthrough

Here are the key features of PacketQC.

• User registration and login

• Generating a network report

• Dashboard

• Network View

• Asset View

---

User registration and login

Users can begin using PacketQC by registering for a new account and logging in with their registered credentials.

Steps

1. Click on the REGISTER button on the top right to register a new user.

2. After a user is registered, click the LOGIN button to login with the registered credentials.

Fig. 4 Register a new user

Fig. 5 Login with registered user

Note

Using PacketQC without logging in

PacketQC supports PCAP file analysis without user login; however, most key features require users to be authenticated.

---

Generating a network report

A network report describes the overall security posture of the network by consolidating detected connections, cryptographic assets, protocol security classifications, and related security findings. PacketQC’s key features work together to present a comprehensive view of the report, enabling users to assess risks, investigate findings, and prioritize remediation activities more effectively. Perform the following steps to generate a security report with PacketQC:

Steps

1. Click the ADD PCAP button.

2. Select a pcap or pcapng file in the file selection window. Please wait for report generation to complete.

For instructions on capturing packets in pcap or pcapng format, refer to the Capturing network traffic in pcap/pcapng section.

Fig. 6 Click to add pcap

Cryptographic Analysis

PacketQC detects a wide range of protocols, with cryptographic analysis provided for the following supported protocols:

• IPsec

• QUIC

• RDP

• SSH

• TLS

PacketQC’s cryptographic analysis categorizes protocol security according to four defined security levels:

Abbreviation	Colour	Denotes	Description
QS	Green	Quantum Secure	Quantum-secure connections, such as those using TLS 1.3
CS	Yellow	Classical Secure	Connections classified as classically secure, but not quantum-secure, such as those using TLS 1.2
IN	Red	Insecure	Connections that use insecure cryptographic mechanisms, such as MD5
UC	Grey	Unclassified	Security level of this connection is not known, usually due to the lack of a cryptographic layer

---

Dashboard

After a network report has been generated, navigate to the DASHBOARD to access the security overview.

Fig. 7 Dashboard view

The dashboard presents key insights through the following graphs:

• Security Overview and Network Traffic Security collectively summarizes the overall quantum security posture by comparing the number of detected quantum-secure connections, classical-secure connections, insecure connections, and those that are unclassified.

• Network Traffic Graph visualizes the communications between assets, providing visibility into the network links and protocols observed across these connections.

• Protocol Security Distribution summarizes the detected protocols (eg. HTTPS, TCP, UDP) and their corresponding quantum security posture.

• Network Quantum Readiness tracks quantum-safe readiness over time, providing visibility into the network’s post-quantum security progress.

---

Network View

After a network report has been generated, the Network View provides a detailed list of all detected connections, including their associated connection information and security details.

The main view

This view provides a detailed overview of all detected connections, providing information such as:

Network View information

1. Connection timestamp

2. Protocol: HTTPS, TCP, UDP etc

3. Version: Protocol version

4. Source and destination addresses: IP, MAC and port numbers

5. Total data: Total traffic of the connection in bytes

6. Security level: Quantum Secure, Classical Secure, Insecure or Unclassified

Click on any of these columns to sort them in ascending/descending order.

Fig. 8 Network view and connection details

Filter by Security Level and Filter by Protocol/Port

These filtering options on the left allow users to efficiently identify, review, and prioritize connections based on their quantum security posture.

Steps

1. Click on either Filter by Security Level or Filter by Protocol/Port on the left to display a list of available filters.

2. Select a filter, such as Classical Secure, to display only the relevant connections for easier investigation.

Fig. 9 Filter the Network View to display classically secure connections.

Detailed information about cryptographic protocols

Detailed information about cryptographic protocol used for each connection can be viewed to support further investigation.

Steps

1. Click on the dropdown arrow to the right of a connection.

The information displayed is specific to each protocol and protocol version, for example:

IPsec IKEv1 Encryption Algorithm Hash Algorithm Authentication Method Key Exchange Method

IPsec IKEv2 PPK Usage Encryption Algorithm Pseudo Random Function Integrity Algorithm Key Exchange Method

Fig. 10 Click any of these dropdown arrows

Fig. 11 Cryptographic information is displayed

Asset management

Users can view and manage assets corresponding to a connection.

Steps

1. Click on any source of destination address of a connection.

Asset management features

1. View/Set asset name

2. View/Set asset type: internal or external

3. View/Set custom notes

4. Assign user-defined tags

5. View creation and last modified dates

6. Upload CBOMs

7. View/Set addresses: Provides a detailed list of IP addresses, connection peers, along with their associated security level classifications

Fig. 12 Click any address on any connection

Fig. 13 Asset management view

Download Network Report

Users can download the analyzed network information as a JSON file for further analysis or record-keeping.

Steps

1. Click on the DOWNLOAD NETWORK REPORT button to begin download.

Fig. 14 Download network report button

Fig. 15 Downloaded network report in JSON

---

Asset View

Once a network report has been generated, the Asset View provides a detailed list of all assets associated with connections discovered.

The main view

This view organizes assets into two primary categories.

• Internal: Assets located within the organization’s managed network environment.

• External: Assets outside of the organization’s managed network environment.

Fig. 16 Asset View

Expand either category to view its list of assets.

Fig. 17 Internal assets in Asset View

Manually add assets

Assets are typically generated from pcap analysis. Users can also manually add an asset:

Steps

1. Click the ADD ASSET button to add a new asset.

2. Complete the form and click CREATE ASSET.

Fig. 18 Manually add a new asset

Fig. 19 Complete form and create asset

Asset management

Users can view and manage assets.

Steps

1. Find an asset in either internal or external view.

2. Click on the eye icon to view asset, or pen icon to edit asset.

Asset management features

1. View/Set asset name

2. View/Set asset type: Internal or external

3. View/Set custom notes

4. Assign user-defined tags

5. View creation and last modified dates

6. Upload CBOMs

7. View/Set addresses: Provides a detailed list of IP addresses, connection peers, along with their associated security level classifications

Fig. 20 Click either the eye or pen icon

Fig. 21 Asset management view

CBOM management

Users can maintain Cryptographic Bills of Materials for individual assets, helping them track cryptographic components and support post-quantum migration planning.

Steps

1. Find an asset in either internal or external view.

2. Click on the eye icon to view asset.

3. Under Cryptographic Bill of Materials, select an Effective Date.

4. Click CLICK TO UPLOAD CBOM and select a CBOM.

5. Once everything is done, click SUBMIT.

Fig. 22 Interface to upload CBOM

Once uploaded, a CBOM analysis is presented with the following information:

• Metadata: CBOM format, version, and serial number.

• Algorithm Components: A summary of detected cryptographic algorithms and their associated security level classifications.

• Crypto Properties: Displays the type of cryptographic function (eg. used for Signatures).

• Locations: Assets or components where this cryptographic algorithm is detected (eg. files within the filesystem).

The following screenshots illustrate sample views of an uploaded CBOM.

Fig. 23 CBOM view 1

Fig. 24 CBOM view 2

Fig. 25 CBOM view 3

---

2. Capturing network traffic in pcap/pcapng

Here are some ways to capture network traffic.

• Wireshark: Capture network traffic in pcap format

• Wireshark: Capture network traffic in pcapng format

• tcpdump: Capture network traffic in pcap format

• tshark: Capture network traffic in pcapng format

---

Wireshark: Capture network traffic in pcap format

Wireshark provides a convenient way to capture network traffic and export it in PCAP format for further analysis.

Steps

1. Identify the network interface card (NIC) on which network traffic will be captured. Select it and click the fin icon on the top left to start packet capture.

2. Wait until a sufficient number of packets has been captured. Click the red square icon on the top left to stop packet capture.

3. Select Save as: Wireshark/tcpdump/... - pcap, enter a file name, and click Save.

Fig. 26 Start packet capture

Fig. 27 Stop packet capture

Fig. 28 Save in pcap format

---

Wireshark: Capture network traffic in pcapng format

Wireshark provides a convenient way to capture network traffic and export it in PCAPNG format for further analysis.

Steps

1. Identify the network interface card (NIC) on which network traffic will be captured. Select it and click the fin icon on the top left to start packet capture.

2. Wait until a sufficient number of packets has been captured. Click the red square icon on the top left to stop packet capture.

3. Select Save as: Wireshark/... - pcapng, enter a file name, and click Save.

Fig. 29 Start packet capture

Fig. 30 Stop packet capture

Fig. 31 Save in pcapng format

---

tcpdump: Capture network traffic in pcap format

tcpdump is a CLI tool useful for capturing network traffic on headless Linux devices, such as Ubuntu Server environments, and can also be used in shell scripts for automated packet capture workflows.

Steps

1. Run the following command to identify the network interface card (NIC) on which network traffic will be captured.

   ip addr
   

2. Run the following command to begin a basic packet capture. Replace your_nic with the NIC from which traffic is captured. For additional packet capture configuration options, refer to the official tcpdump manual.

   sudo tcpdump -i your_nic -s 0 -w packets.pcap
   

3. Wait until a sufficient number of packets has been captured. Press Ctrl + C to end network traffic capture.

Fig. 32 Finding your NIC

---

tshark: Capture network traffic in pcapng format

tShark is a terminal oriented version of Wireshark useful for capturing network traffic on headless Linux devices, such as Ubuntu Server environments, and can also be used in shell scripts for automated packet capture workflows.

Steps

1. Run the following command to identify the network interface card (NIC) on which network traffic will be captured.

   ip addr
   

2. Run the following command to begin a basic packet capture. Replace your_nic with the NIC from which traffic is captured. For additional packet capture configuration options, refer to the official tshark manual.

   sudo tshark -i your_nic -w /tmp/packets.pcapng
   

3. Wait until a sufficient number of packets has been captured. Press Ctrl + C to end network traffic capture.

Fig. 33 Finding your NIC