# Forensic Analysis on Internet of Things (IoT) Device Using Machine-to-Machine (M2M) Framework
## 4 Results and Discussion
### Traffic Generation of Attacks on IoT Device  
In the traffic generation of attacks on IoT device Raspberry Pi, we used Kali Linux as an attacking machine, which has the IP address 192.168.56.3, to launch attacks on victim IoT device with IP address 192.168.56.101. Multiple attacks such as Port scanning using NMAP tool, brute force attack using Metasploit tool, denial of service (DoS) Syn Flooding attack using HPING3, and Man in the Middle (MITM) ARP spoofing using Ettercap were launched on the IoT device.  
Port scanning is used to locate the target IoT device's entry ports to conduct a cyberattack. The NMAP software is used to locate the target IoT device's open ports and services for this purpose. After gaining the necessary information about the targeted IoT device, an SSH connection has been established to connect virtually. We used Metasploit framework to launch brute force attacks on an IoT device that opened port 22. Metasploit tries all combinations of usernames and passwords to find the correct one. As Metasploit succeeds in matching the correct username and password, an SSH connection is established between the Kali Linux (attacking device) and Raspberry Pi (IoT device). It is analyzed that when Metasploit opens an SSH session with an IoT device. Then, on the IoT device, there is no footprint found that it has an SSH session with attacking system 192.168.56.3. For testing, a normal SSH session is created from another system having the IP address 192.168.56.4, which is security onion being used as the forensic server. Now, the IoT device shows that it had only one opened remote SSH session with the system having IP address 192.168.56.4 but did not show any information of SSH session from 192.168.56.3 attacking system.  
Denial of service (DoS) attack is launched through the HPING3 and Metasploit software using the Kali Linux platform. Multiple instances of DoS attacks were started to make the attack scenario more severe. After some time, the DoS attacks occupy all the resources of the IoT device and, as a result, the IoT device stops communication with the other devices. After the DoS attack completion, logs are analyzed to find out the cause and destruction of the attack. The log files generated by the logging server are gathered for forensic purposes. Log files of the DoS attack are monitored through the Wireshark and squert. Wireshark shows the detail of captured packets and highlights that source address 192.168.5.3 attack on port 80 of destination address 192.168.56.101 using TCP-Out-of-Order packet sequence number. We observed the traffic coming to the IoT device using Wireshark which shows plenty of traffic coming from the attacker but Raspberry Pi failing to respond to this traffic and halts its services.  
Man-in-Middle attack on IoT devices using Ettercap is launched. ARP spoof changes the ARP entries of target systems with the MAC address of the attacking system. All the communication between the victim machines is intercepted by the attacker because the attacking system resides between them. To verify that the attack is successful, the ARP tables of both source and destination change the destination MAC addresses of each other with the attacking system. For further analysis, the log files generated by the logging server are analyzed through Wireshark. Wireshark also points out the duplication of addresses in the network packets. The target IP addresses are of both the attacking device and victim machine and are set as 192.168.56.3 and 192.168.56.101, respectively.  
Ettercap provides many attack options, we selected ARP poisoning. Remotely sniffing is selected. Ettercap starts listening at the eth0 of the IoT device, which has the IP address of 192.168.56.101. While an IoT device tries to make communicate with any other device, then it can be observed via Ettercap. We opened the Raspbian browser, then it can be observed.