Monitoring Tools

1. Monitoring Tools

2. Focus Question What are the common ways of specifying network packets used in tcpdump, wireshark, and snort?

3. Packet Generators • ping – test network connectivity - icmp • hping – sends TCP/IP packets to network hosts • traceroute – probes network connectivity • telnet – connects to various ports • nc – establishes tcp and udp connections • sock – acts as arbitrary client and server • nmap – security port scanner

4. Packet Sniffers • tcpdump – command-line tool for capturing packets. • wireshark – graphical sniffer and packet analyzer. • snort – packet sniffing and network intrusion detection

5. Packet Anatomy • ICMP Header information 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 TYPE= CODE= Checksum DATA ::: (depends on Type and Code and is variable in length – some logged

6. Packet Anatomy • IP Header information 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Version IHL TOS=, PREC= Total Length: LEN= Identification: ID= Fragment Offset: FRAG= Flags TTL= PROTO= Header Checksum Source Address: SRC= Destination Address: DST= Padding Options: OPT=, (not decoded, requires –log-ip-options)

7. Packet Anatomy • TCP Header information 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Source Port: SPT= Destination Port: DPT= Sequence Number: SEQ=, (requires –log-tcp-sequence) Acknowledgment Number: ACK=, (requires –log-tcp-sequence) WINDOW= RES= ECN SYN,ACK… Data Offset URGP= Checksum Options: OPT=, (not decoded, requires --log-tcp-options

8. Packet Anatomy • UDP Header information 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Source Port: SPT= Destination Port: DPT= Length: LEN= Checksum

9. Common tcpdump Options • tcpdump [-options] [expression] • c count# exit after count packets captured • iifc # interface to listen on: eth0, lo … • s snaplen # number of bytes to capture/packet • w filename # save output to filename (binary) • e # include the frame header info. • n # don’t convert addresses to names • x # print data of each packet in hex • v # verbose mode expression: [tcp|udp] [dst|src] [host|net|port] id

10. Wireshark

11. Wireshark

12. Snort • Components • Binary: /usr/sbin/snort • Configuration: • /etc/sysconfig/snort • /etc/snort/snort.conf • /etc/snort/*.rules • Logging: • /var/log/snort • /etc/logrotate.d/snort

13. Uses of Snort • Packet sniffing: • snort –vde • Packet Logging mode: • snort –vde –l ./log # log is a directory • snort –vde –l ./log –h 192.168.1.0/24 • snort –b –l .log # logs in binary format • Intrusion Detection: • snort –d –l /var/log/snort –c /etc/snort.conf

14. The Snort Engine Packetacquisition Detection Engine Packet decode Preprocessors Log orAlert? Yes Output plugins No Finished Next Packet

15. Writing Snort Rules • Figure out what is “bad” • Capture traffic that includes the “bad stuff” • Learn the protocol • Figure out why the “bad stuff” is bad • Write a rule • Test the rule • Goto 5.

16. Rule Format – basic rule alert tcp 192.168.1.2 any -> 192.168.1.3 80 (msg:”your message”;content:”blah”;sid:10001;) • Other keyword:value pairs • - reference:url,www.cabrillo.edu - rev:# - priority:# - classtype:type( see classification.config) - nocase; - depth:# - offset:#

17. Review

18. Focus Question What are the common ways of specifying network packets used in tcpdump, wireshark, and snort? • Network packets are most often identified by IP address, network address or port number • Keywords: host, net, and port are used to describe the the above identifiers. If no keyword is specified, host is assumed. e.g. net 192.168.1.0/24 or port 22 • Direction keywords: src and dst can be used with with logical operators: and, or, not. e.g. src host 192.168.1.5 and dst port 22