#InvestigationMethodology

A worker is trying to access to Amazon.fr. We try to solve it.

First we check the transport layer.

1. L4 (Transport Layer) : tracert (windows) / traceroute (linux)

192.168.1.188
192.168.254.254
******
******
******
timeout

If I see this, it could be an internet problem. So it could be a problem of the firewall or proxy.

2. L3 (Network Layer) : ping 192.168.254.254 and ping 192.168.1.188 > a) result could be either ping KO or ping OK

   1. first option : firewall doesn't ping ;
      1. a physical problem (e.g.: cable not plugged correctly)
         1. is it a problem on wifi or Ethernet cable or cable of the switch ?
      2. a logical problem ;
         1. ICMP could be blocked
         2. 802.1X
         3. Could be a GPO rule that blocks the e-commerce websites
   2. second option : ping OK
      1. a physical problem
      2. a logical problem
         1. DNS

3. L3 (Network layer) : we do ping google.com > OK

4. I go to the browser and try https://google.com and it works

Another problem :

Let's say that a user computer got a malware from the email that manipulates the Powershell or cmd.

1. First thing we do is : cut the connection of the computer with the network