Packet Matching. Paul Offord, Advance7

Transcription

1 Packet Matching Paul Offord, Advance7

2 Relax!

3 Model network Server Farm Client Router / Firewall Firewall Load Balancer LAN 1 Internet

4 The challenge Matching packets from PC to 1 st server tier NAT and PAT VIPs SSL especially with load balancers Volumes increase deeper into the system Capture time sync inaccuracies

5 Packet matching based on Protocol field values o o Direct match Translated match Packet content Temporal match (relative times) Supplementary data e.g. web logs

6 Edge inwards Traffic volume increases Server Farm Client Router / Firewall Firewall Load Balancer LAN 1 Internet Start the analysis here Fewer packets to analyse Best chance of match to users experience Provides signposts for the other traces Establish problem timeframe

7 Problem timeframe Server Farm Client Router / Firewall Firewall Load Balancer LAN 1 Internet Network Trace Analysis Guide for details

8 Client and Service Fileserver Browser Web Server S C Network S C C Database S HTTP SMB TDS

9 Identifying a stream - the 5-tuple Client IP Addr : Client Port : Service IP Addr : Service Port : Protocol : 1515 : : 80 : TCP : : : 53 : UDP

10 Across the LAN Server Farm Client LAN 1 Firewall Internet DC Firewall Load Balancer

11 Across the LAN: Client to Service Identifies the stream

12 Across the LAN: Service to Client Identifies the stream Wireshark shortcut for TCP Follow TCP stream

13 Finding actual packets - TCP Cross checks More correlation points needed Preferred

14 Finding actual packets - UDP Use applicationrelated IDs

15 DHCP Example

16 TCP Segmentation Offload Process NIC PC or Server T C P I P D r i v e r T C P I P E t h Ethernet Switch PC or Server Without Large Receive Offload (LRO) L = 5 KB S = 1 L = 1,460 bytes L = 1,460 bytes L = 1,460 bytes L = 798 bytes S = 1 S = 1,461 S = 2,921 S = 4,381 L = 1,460 bytes L = 1,460 bytes L = 1,460 bytes L = 1,460 bytes

17 Across the LAN: Summary 5-tuple Direction (C->S or S->C) TCP o o Sequence number Watch out for TSO UDP o Application-related ID TSO => intermediate Sequence Numbers

18 Time for Questions

19 Across the firewall Server Farm Client LAN 1 Firewall Internet DC Firewall Load Balancer

20

21

22 SNAT, DNAT, SPAT and DPAT When talking NAT: Source = Client Destination = Service Think Source of SYN

23 Multiport capture Inside and outside trace on a common Time of Day clock Firewall

24 Across a firewall: Summary NAT/PAT o o Client address always translated Client port maybe translated IP ID and TCP Seq matching o o o Should work May not on some firewalls Try enabling TCP Relative Sequence Numbers Common ToD clock is a big help

25 Time for Questions

26 Across a WAN (or the Internet) 2 Internet 3 5-tuple + IP ID TCP: Seq Number UDP: App-related ID

27 Across the WAN: Summary Same as LAN Data volumes may be high o o Carefully filter Keep original trace files! Sync d clocks helps o o o AD time sync every 8 hours Clock drift up to 8ms in 24 hours Take care with time zones and DST

28 Across the DC firewall Server Farm Client LAN 1 Firewall Internet DC Firewall Load Balancer

29 Across the DC firewall: Dest NAT Server Farm Client LAN 1 Firewall Internet DC Firewall Load Balancer Public LB VIP = translated to Private LB VIP =

30

31

32

33 Across the DC firewall: Summary ALWAYS trace both sides of a firewall WARNING may fiddle with Seq Numbers Use a dual port capture if possible Consider possibility of HA failover If SNAT and DNAT also use o o o Application-related ID, or Content (especially with SSL), or Web log information (X-Forwarded-For)

34 Time for Questions

35 Across the Load Balancer Server Farm Client LAN 1 Firewall Internet DC Firewall Load Balancer Typically, full proxy SNAT, DNAT and SPAT Can t match on TCP Seq or IP ID

36

37

38

39 When to connect to the server? What if I want load balancing Delayed Binding based on a cookie value?

40

41 The Load Balancer - Summary Similar to Firewall, but worse Will obscure details as a TCP full proxy May re-segment TCP with different packet sizes TCP session starts are separate on client and server sides Always capture both sides of a load balancer Preferably with a common clock

42 Time for Questions

43 Airline booking system example

44 System topology Web Servers Firefox Firewall Another Firewall Check Point Load Balancer 1 Internet 2 3

45 Packet flow summary From the RPR Manual

46 Time for Questions

47 SSL Matching on content

48 Across the Load Balancer Server Farm Client LAN 1 Firewall Internet DC Firewall Load Balancer

49 Delayed binding Use RR turns to help with alignment Last req APDU First rsp APDU

50 Multiport capture Inside and outside trace on a common time clock Load Balancer

51 Mobile phone app example

52 Web server response times [09/Jul/2012:08:25: ] 379 "GET / HTTP/1.1" "- " "Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/ Firefox/ user01 [09/Jul/2012:08:25: ] "GET / HTTP/1.1" "-" "Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/ Firefox/ user01 [09/Jul/2012:08:25: ] "GET /Setup.php HTTP/1.1" "-" "Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/ Firefox/13.0.1"

53 IIS Advanced Logging

54 Load Balancer (SSL) - Summary Not much to go on in the capture file: o o Packet sizes (approx.) Temporal relationships Use turns to align o o Last packet of APDU Request First packet of APDU Response Use web logs to help Very difficult without time sync

55 Overall Summary 5-tuple and TCP Seq will get you a long way Use application-related ID for UDP Overcome SSL with: o o o Match on content Temporal relationships Packet lengths (even if approx.) Time sync d traces help a lot Visualise in spreadsheet

56 Further information Tech community at TribeLabZero.com Amazon or free ebook Paul Offord Mobile: +44 (0) Web: