Fun with FCC part 15

1. Fun with FCC part 15 Home speaker system on 107.3 (and that’s not easy in the NYC/PHL area)

2. Emulating large intranets with honeyd Bill Cheswick ches@lumeta.com

3. This talk was going to be boring…

4. Another Reason Why I Like the Window Seat Bill Cheswick

5. Mapping the Internet and Intranets Steve Branigan, Hal Burch, Bill Cheswick ches@lumeta.com

7. How To Take the Internet Down for a week Bill Cheswick <startup-name> ches@bell-labs.com ches@cheswick.com

8. Our digital house By Kestrel, Terence, Lorette, and Bill Cheswick

9. Emulating large intranets with honeyd Bill Cheswick ches@lumeta.com

12. Free at last! • Nagata • Varley • Etc.

13. Anything large enough to be called an “intranet” isout of control

14. Lumeta • Spun off from Bell Labs in Sept. 2000 • B round funding last June • Building a hang glider…

15. Inside the Kimono…

26. Some intranet statisticsfrom Lumeta clients

27. But how do we debug our software? • We used to use Lucent’s network back when I was working at Bell Labs • We have a very light touch on our clients’ networks, and they like it that way • The Bank of Zork (NASDAQ: BOZO) doesn’t want us practicing on their network

28. Simulation vs emulation • Simulators run packet flows over imaginary networks • Often run to test routing and queuing algorithms • Emulator wants to appear to be the network

29. What does a chief scientist do? • Primarily a prima donna • Certainly not in development • Travel too much to keep deadline promises • Never was good at all-nighters • Find a project that would be nice, but nobody is waiting for • QA was a fine place to look

30. Honeyd • Written by Niels Provos at citi.umich.edu • Name unrelated to, and vexes, Peter Honeyman, also of citi.umich.edu • Designed to emulate one or more computers in a single host to lure and confuse hackers • Responds using nmap and other host fingerprinting databases • User scripts available to emulate specific web and other network server software

31. Honeyd • Designed to emulate one or more computers in a single host to lure and confuse hackers • User scripts available to emulate specific web and other network server software • Microsoft IIS web server • A number of text-based services are emulated in available scripts

32. Honeyd • Host fingerprint identification based on probe databases • Nmap • xprobe

33. My Honeyd project • Make honeyd configuration scripts that build our clients’ networks from the data we obtain • Add UDP servers for • DNS (name service) • SNMP (Simple Network Management Protocol)

34. Uses • Perfect test network for QA • Unchanging….diff the pages • Build pathological network configurations • Training • Sales demos • Could this be a product?

35. My honeyd scripts • Generates entire network description for honeyd based on our client data • You want a 50,000 node network based on real data? No problem. 300,000 nodes? OK • DNS emulates name server lookups • Routers respond with SNMP data

36. How good is the emulation? • Handles pings and traceroutes with no problem • Handles “stealth hosts”, routers that don’t issue TTL exceeded messages • Even does a fair job of simulating latencies • Emulator for SNMP and DNS queries • This is good enough for us: we don’t collect other data at present • Real networks change as you test them.

37. Real

38. Simulated

39. Certainly not perfect • There isn’t nearly as much state in our network emulation as there is in a real network • CPU time becomes an issue, and the emulator is not efficient at the moment • Moore’s law is a big help here • Host fingerprinting could make the network much more convincing • We are working on it • Could just fake it

40. Future work • Many incremental improvements to network simulations • Honeyd performance improvements • Might release a large cleansed network configuration for research purposes

41. Emulating large intranets with honeyd Bill Cheswick ches@lumeta.com