The Bro Monitoring Platform
|
|
|
- Sabina Weaver
- 10 years ago
- Views:
Transcription
1 Robin Sommer! International Computer Science Institute, &! Lawrence Berkeley National Laboratory
2 What Is Bro? 2
3 What Is Bro? Packet Capture 2
4 What Is Bro? Packet Capture Traffic Inspection 2
5 What Is Bro? Packet Capture Traffic Inspection Attack Detection 2
6 What Is Bro? Packet Capture Traffic Inspection Attack Detection NetFlow syslog Log Recording 2
7 What Is Bro? Packet Capture Traffic Inspection Attack Detection NetFlow syslog Log Recording Flexibility! Abstraction! Data Structures 2
8 What Is Bro? Packet Capture Traffic Inspection Attack Detection NetFlow syslog Log Recording Flexibility! Abstraction! Data Structures 2
9 What Is Bro? Packet Capture Traffic Inspection Attack Detection NetFlow syslog Log Recording Flexibility! Abstraction! Data Structures 2
10 What Is Bro? Packet Capture Traffic Inspection Attack Detection NetFlow syslog Domain-specific Python Log Recording Flexibility! Abstraction! Data Structures 2
11 The Bro Platform! Tap Network 3
12 The Bro Platform! Platform Programming Language Packet Processing Standard Library Tap Network 3
13 The Bro Platform! Apps Intrusion Detection Vulnerabilit. Mgmt File Analysis Traffic Measurement Traffic Control Compliance Monitoring Platform Programming Language Packet Processing Standard Library Tap Network 3
14 The Bro Platform! Open Source BSD License Apps Intrusion Detection Vulnerabilit. Mgmt File Analysis Traffic Measurement Traffic Control Compliance Monitoring Platform Programming Language Packet Processing Standard Library Tap Network 3
15 Who s Using It? Installations across the US Universities Research Labs Supercomputing Centers Government Organizations Fortune 50 Enterprises Examples Lawrence Berkeley National Lab National Center for Supercomputing Applications Indiana University Carnegie Mellon National Center for Atmospheric Research!... and many more sites I can t talk about. Fully integrated into Security Onion Popular security-oriented Linux distribution BroCon 2014, Urbana, IL Community 50/90/150 attendees at BroCon 12/ 13/ organizations at BroCon 14 2,500 Twitter followers 800 mailing list subscribers 70 users average on IRC channel 10,000 downloads / version from 150 countries > 30,000 Onion downloads ( 12) The NSF Bro Center of Expertise 4
16 What Can It Do? Log Files Alerts Custom Logic 5
17 What Can It Do? Log Files Alerts Custom Logic Network Ground Truth 5
18 Bro Logs > bro -i eth0! [ wait ] 6
19 Bro Logs > bro -i eth0! [ wait ] > ls *.log app_stats.log! communication.log! conn.log! dhcp.log! dns.log! dpd.log! files.log! ftp.log! http.log! irc.log! known_certs.log! known_hosts.log! known_services.log! modbus.log! notice.log! reporter.log! signatures.log! smtp.log! socks.log! software.log! ssh.log! ssl.log! syslog.log! traceroute.log! tunnel.log! weird.log 6
20 Bro Logs > bro -i eth0! [ wait ] > cat conn.log #separator \x09! #set_separator,! #empty_field (empty)! #unset_field -! #path conn! #open ! #fields ts uid id.orig_h id.orig_p id.resp_h [ ]! #types time string addr port addr [ ]! arkyemetxog [ ]! nqcgtwjvg4c [ ]! j4u32pc5bif [ ]! k6kgxlooskl [ ]! TEfuqmmG4bh [ ]! OKnoww6xl [ ]! FrJExwHcSal [ ]! PKsZ2Uye [ ]! [ ] 6
21 Connections Logs conn.log ts Timestamp uid Cy3S2U2sbarorQgmw6a Unique ID id.orig_h Originator IP id.orig_p Originator Port id.resp_h Responder IP id.resp_p 25 Responder Port proto tcp IP Protocol service smtp App-layer Protocol duration Duration orig_bytes 9068 Bytes by Originator resp_bytes 4450 Bytes by Responder conn_state SF TCP state local_orig T Local Originator? missed_bytes 0 Gaps history ShAdDaFf State History tunnel_parents (empty) Outer Tunnels 7
22 HTTP http.log ts uid CKFUW73bIADw0r9pl id.orig_h id.orig_p id.resp_h id.resp_p 80 method POST host com-services.pandonetworks.com uri /soapservices/services/sessionstart referrer - user_agent Mozilla/4.0 (Windows; U) Pando/ status_code 200 username anonymous password - orig_mime_types application/xml resp_mime_types application/xml 8
23 SSL ssl.log ts uid id.orig_h CEA05l2D7k0BD9Dda2 2a07:f2c0:90:402:41e:c13:6cb:99c id.orig_p id.resp_h 2406:fe60:f47::aaeb:98c id.resp_p 443 version cipher TLSv10 TLS_DHE_RSA_WITH_AES_256_CBC_SHA server_name CN= subject O=Netflix, Inc.,L=Los Gatos,! ST=CALIFORNIA,C=US issuer_subject CN=VeriSign Class 3 Secure Server CA,! OU=VeriSign Trust Network,O=VeriSign, C=US not_valid_before not_valid_after client_subject - client_issuer_subject - cert_hash validation_status 197cab7c6c92a0b9ac5f37cfb ok 9
24 Syslog & DHCP syslog.log ts uid CnYivt3Z0NHOuBALR8 id.orig_h id.orig_p 514 id.resp_h id.resp_p 514 proto facility severity message udp AUTHPRIV INFO sshd[13825]: Accepted publickey for! harvest from xxx.xxx.xxx.xxx 10
25 Syslog & DHCP syslog.log dhcp.log ts uid CnYivt3Z0NHOuBALR8 id.orig_h id.orig_p 514 id.resp_h id.resp_p 514 proto facility severity message udp AUTHPRIV INFO sshd[13825]: Accepted publickey for! harvest from xxx.xxx.xxx.xxx ts uid Ci3RM24iF4vIYRGHc3 id.orig_h id.resp_h mac 04:12:38:65:fa:68 assigned_ip lease_time
26 Files files.log ts fuid FnungQ3TI19GahPJP2 tx_hosts rx_hosts conn_uids CbDgik2fjeKL5qzn55 source SMTP analyzers SHA1,MD5 mime_type application/x-dosexec filename Letter.exe duration local_orig T seen_bytes md5 93f7f5e7a e06e[ ]1085bfcfb sha1 daed94a5662a920041be[ ]a433e501646ef6a03 extracted - 11
27 Software software.log ts host host_p - software_type name version.major 2 version.minor 4 DropboxDesktopClient version.minor2 11 version.minor3 - version.addl unparsed_version Windows DropboxDesktopClient/2.4.11! (Windows; 8; i32; en_us; Trooper ) 12
28 Help Understand Your Network Top File Types application/octet-stream text/html text/plain application/xml application/x-shockwave-flash application/pdf image/gif image/png image/jpeg cat files.log bro-cut mime_type sort uniq -c sort -rn 13
29 Help Understand Your Network (2) Top Software by Number of Hosts Firefox CaptiveNetworkSupport MSIE Safari DropboxDesktopClient GoogleUpdate ocspd Windows-Update-Agent Microsoft-CryptoAPI Chrome cat software.log bro-cut host name sort uniq! awk -F '\t' '{print $2}' sort uniq -c sort -rn 14
30 What Can It Do? Log Files Alerts Custom Logic 15
31 What Can It Do? Log Files Alerts Custom Logic Watch this!! Recorded in notice.log. Can trigger actions. 15
32 Alerts in Bro 2.2 CaptureLoss::Too_Much_Loss! Conn::Ack_Above_Hole! Conn::Content_Gap! Conn::Retransmission_Inconsistency! DNS::External_Name! FTP::Bruteforcing! FTP::Site_Exec_Success! Intel::Notice! PacketFilter::Dropped_Packets! ProtocolDetector::Protocol_Found! ProtocolDetector::Server_Found! SMTP::Blocklist_Blocked_Host! SMTP::Blocklist_Error_Message! SMTP::Suspicious_Origination! SSH::Interesting_Hostname_Login! SSH::Login_By_Password_Guesser! SSH::Password_Guessing! SSH::Watched_Country_Login! SSL::Certificate_Expired! SSL::Certificate_Expires_Soon! SSL::Certificate_Not_Valid_Yet! SSL::Invalid_Server_Cert! Scan::Address_Scan! Scan::Port_Scan! Signatures::Count_Signature! Signatures::Multiple_Sig_Responders! Signatures::Multiple_Signatures! Signatures::Sensitive_Signature! Software::Software_Version_Change! Software::Vulnerable_Version! TeamCymruMalwareHashRegistry::Match! Traceroute::Detected! Weird::Activity 16
33 Watching for Suspicious Logins 17
34 Watching for Suspicious Logins SSH::Watched_Country_Login!! Login from an unexpected country. 17
35 Watching for Suspicious Logins SSH::Watched_Country_Login!! Login from an unexpected country. SSH::Interesting_Hostname_Login!! Login from an unusual host name. smtp.supercomputer.edu 17
36 Intelligence Integration (Passive) Internet Enterprise Network 18
37 Intelligence Integration (Passive) Internet Enterprise Network Intelligence IP addresses DNS names URLs File hashes Traffic Monitoring HTTP, FTP, SSL, SSH, FTP, DNS, SMTP, Feeds CIF JC3 Spamhaus Custom/Proprietary 18
38 Intelligence Integration (Passive) Internet Enterprise Network Intelligence IP addresses DNS names URLs File hashes Feeds CIF JC3 Spamhaus Custom/Proprietary ts uid CAK677xaOmi66X4Th id.orig_h id.resp_h note indicator indicator_type notice.log Intel::Notice baddomain.com Intel::DOMAIN where!! source Traffic Monitoring HTTP, FTP, SSL, SSH, FTP, DNS, SMTP, My-Private-Feed 18
39 Intelligence Integration (Passive) Internet Enterprise Network Conn::IN_ORIG! Conn::IN_RESP! Intelligence Files::IN_HASH! Files::IN_NAME! DNS::IN_REQUEST! IP addresses DNS::IN_RESPONSE! DNS names URLs File hashes Feeds SMTP::IN_MAIL_FROM! SMTP::IN_RCPT_TO! SMTP::IN_FROM! CIF SMTP::IN_TO! SMTP::IN_RECEIVED_HEADER! JC3 SMTP::IN_REPLY_TO! Spamhaus SMTP::IN_X_ORIGINATING_IP_HEADER! Custom/Proprietary SMTP::IN_MESSAGE! SSL::IN_SERVER_CERT! SSL::IN_CLIENT_CERT! SSL::IN_SERVER_NAME! SMTP::IN_HEADER ts uid CAK677xaOmi66X4Th id.orig_h id.resp_h note indicator indicator_type notice.log Intel::Notice baddomain.com Intel::DOMAIN where!! source Traffic Monitoring HTTP, FTP, SSL, SSH, FTP, DNS, SMTP, My-Private-Feed 18
40 Intelligence Integration (Active) 19
41 Intelligence Integration (Active) # cat files.log bro-cut mime_type sha1 awk '$1 ~ /x-dosexec/! application/x-dosexec 5fd2f e2f6c593d6ec7ae882c9ab54! application/x-dosexec 00c69013d34601c2174b72c9249a da93a! application/x-dosexec 0d801726d49377bfe989dcca7753a62549f1ddda! [ ] 19
42 Intelligence Integration (Active) # cat files.log bro-cut mime_type sha1 awk '$1 ~ /x-dosexec/! application/x-dosexec 5fd2f e2f6c593d6ec7ae882c9ab54! application/x-dosexec 00c69013d34601c2174b72c9249a da93a! application/x-dosexec 0d801726d49377bfe989dcca7753a62549f1ddda! [ ] # dig +short 733a48a9cb4[ ]2a91e8d00.malware.hash.cymru.com TXT! " " 19
43 Intelligence Integration (Active) # cat files.log bro-cut mime_type sha1 awk '$1 ~ /x-dosexec/! application/x-dosexec 5fd2f e2f6c593d6ec7ae882c9ab54! application/x-dosexec 00c69013d34601c2174b72c9249a da93a! application/x-dosexec 0d801726d49377bfe989dcca7753a62549f1ddda! [ ] # dig +short 733a48a9cb4[ ]2a91e8d00.malware.hash.cymru.com TXT! " " notice.log ts Timestamp uid CjKeSB45xaOmiIo4Th Connection ID id.orig_h Originator IP id.resp_h Responder IP fuid! FEGVbAgcArRQ49347 File ID mime_type!!! application/jar MIME type description ] Source URL Bro saw note!! TeamCymruMalwareHashRegistry::Match Notice Type msg :06:51 / 20% MHR reply sub ] VirusTotal URL 19
44 What Can It Do? Log Files Alerts Custom Logic 20
45 What Can It Do? Log Files Alerts Custom Logic Don t ask what Bro can do. Ask what you want it to do. 20
46 Script Example: Matching URLs Task: Report all Web requests for files called passwd. 21
47 Script Example: Matching URLs Task: Report all Web requests for files called passwd.! event http_request(c: connection, # Connection.! method: string, # HTTP method.! original_uri: string, # Requested URL.! unescaped_uri: string, # Decoded URL.! version: string) # HTTP version.! {! if ( method == "GET" && unescaped_uri == /.*passwd/!)! NOTICE(...); # Alarm.! } 21
48 Script Example: Scan Detector Task: Count failed connection attempts per source address. 22
49 Script Example: Scan Detector Task: Count failed connection attempts per source address. global attempts: table[addr] of count &default=0;!! event connection_rejected(c: connection)! {! local source = c$id$orig_h; # Get source address.!! local n = ++attempts[source]; # Increase counter.!! if ( n == SOME_THRESHOLD ) # Check for threshold.! NOTICE(...); # Alarm.! } 22
50 Scripts are Bro s Magic Ingredient Bro comes with >10,000 lines of script code.! Prewritten functionality that s just loaded.! Scripts generate everything we have seen.! Amendable to extensive customization and extension.! Growing community writing 3rd party scripts.! Bro could report Mandiant s APT1 indicators within a day.! 23
51 Bro Ecosystem 24
52 Bro Ecosystem Internet Tap Internal Network Bro 25
53 Bro Ecosystem Internet Tap Internal Network Bro Control Output BroControl User Interface 25
54 Bro Ecosystem Internet Tap Internal Network External Scripts Functionality Bro Control Output BroControl User Interface 25
55 Bro Ecosystem Internet Tap Internal Network External Scripts Functionality Bro Events State Other Bros Control Output BroControl User Interface 25
56 Bro Ecosystem Internet Tap Internal Network External Scripts Functionality Bro Events State Other Bros Control Output BroControl User Interface Events Bro Client Communication Library Broccoli 25
57 Bro Ecosystem Internet Tap Internal Network External Scripts Functionality Bro Events State Other Bros Control Output BroControl User Interface Events Bro Client Communication Library Broccoli Python Broccoli Broccoli Ruby (Broccoli Perl) 25
58 Bro Ecosystem Internet Tap Internal Network Network! Control External Scripts Functionality Bro Events State Other Bros Control Output BroControl User Interface Events Bro Client Communication Library Broccoli Python Broccoli Broccoli Ruby (Broccoli Perl) 25
59 Bro Ecosystem Time Machine Internet Tap Tap Internal Network Network! Control External Scripts Functionality Bro Events State Other Bros Control Output BroControl User Interface Events Bro Client Communication Library Broccoli Python Broccoli Broccoli Ruby (Broccoli Perl) 25
60 Bro Ecosystem Time Machine Internet Tap Tap Internal Network Network! Control External Scripts Functionality Bro Events State Other Bros Control Output bro-aux BinPAC capstats BroControl Events Bro Client Communication Library Broccoli Python BTest tracesummary bro-cut Broccoli Broccoli Ruby User Interface (Broccoli Perl) 25
61 Bro Ecosystem Bro Distribution!! bro-2.3.tar.gz Internet Tap Time Machine Tap Internal Network Network! Control External Scripts Functionality Bro Events State Other Bros Control Output bro-aux BTest BinPAC tracesummary capstats bro-cut BroControl Events Bro Client Communication Library Broccoli Python Broccoli Broccoli Ruby User Interface (Broccoli Perl) 25
62 Bro Cluster Ecosystem Internet Tap Internal Network External Scripts Functionality Bro Events State External Bro Control Output BroControl User Interface Events Bro Client Communication Library Broccoli Python Broccoli Broccoli Ruby (Broccoli Perl) 26
63 Bro Cluster Ecosystem Internet Tap Internal Network External Scripts Functionality Bro Events State External Bro Control Output BroControl User Interface Events Bro Client Communication Library Broccoli Python Broccoli Broccoli Ruby (Broccoli Perl) 26
64 Bro Cluster Ecosystem Internet Tap Load- Balancer Internal Network External Scripts Functionality Bro Events State External Bro Control Output BroControl User Interface Events Bro Client Communication Library Broccoli Python Broccoli Broccoli Ruby (Broccoli Perl) 26
65 Bro Cluster Ecosystem Internet Tap Internal Network Packets Load- Balancer External Scripts Functionality Bro Bro Bro Bro Bro Events State External Bro Control Output BroControl User Interface Events Bro Client Communication Library Broccoli Python Broccoli Broccoli Ruby (Broccoli Perl) 26
66 Bro Cluster Ecosystem Internet Tap Internal Network Packets Load- Balancer External Scripts Functionality Bro Bro Bro Bro Bro Events State External Bro Control Control Output BroControl Output Events Bro Client Communication Library Broccoli Python Broccoli Broccoli Ruby User Interface (Broccoli Perl) 26
67 Bro Cluster Ecosystem Internet Tap Internal Network Packets Load- Balancer Frontend External Scripts Functionality Bro Bro Bro Bro Bro Workers Events State External Bro Control Control Output Manager BroControl Output Events Bro Client Communication Library Broccoli Python Broccoli Broccoli Ruby User Interface (Broccoli Perl) 26
68 Installing Bro Here: We ll use the VM (or Bro Live).! Comes with everything preinstalled.! Normally: Follow instructions on bro.org.! Building from source is pretty straight-forward: > yum install cmake flex bison swig libpcap-devel [ ]! > wget > tar xzvf bro-2.2.tar.gz! > cd bro!! >./configure - prefix=/usr/local && make && make install 27
69 Configuring Bro In many cases, just two files to edit. <prefix>/etc/node.cfg # If you have a small network and only one interface to monitor,! # this will do it. We ll talk about cluster mode later.! [bro]! type=standalone! host=localhost! interface=eth0! <prefix>/etc/networks.cfg # List of local networks in CIDR notation, optionally followed by a! # descriptive tag.! # For example, " /8" or "fe80::/64" are valid prefixes.!! /8 Private IP space! /16 Private IP space (There s also <prefix>/etc/broctl.cfg with more options you can tweak.) 28
70 Using BroControl Use broctl to start & stop. # broctl install! # broctl start! starting bro...! # broctl status! Name Type Host Status Pid Started bro standalone localhost running May 15:57:35! # ls <prefix>/logs/current/! conn.log http.log [ ] Reinstall after changing Bro s configuration. # broctl check! bro is ok! # broctl install! # broctl restart 29
71 Using Bro from the Command Line We ll use the Bro binary directly. # bro -r trace.pcap! # ls *.log! conn.log http.log [ ] bro-cut is a handy tool to work with logs. # cat http.log bro-cut -d ts id.orig_h host! T02:19: download.windowsupdate.com T02:19: [ ] Generally, use your standard Unix tools.! grep, awk, head/tail, sed, etc. 30
72 So much more 31
73 Bro is a Platform Intrusion Detection Vulnerabilit. Mgmt File Analysis Traffic Measurement Traffic Control Compliance Monitoring There s much more we can talk about Host-level integration Data import and export Automatic Reaction Monitoring Internal Networks Measurements SDN integration Industrial Control Systems Embedded Devices Current Research More File Analysis More Protocols More File Analysis 100Gb/s Networks Enterprise Protocols Summary Statistics Science DMZs ICSL SSL Notary Cluster Deployment 32
74 The U.S. National Science Foundation has enabled much of our work. Bro is coming out of almost two decades of academic research, along with extensive transition to practice efforts. NSF has supported much of that, and is currently funding a Bro Center of Expertise at the International Computer Science Institute and the National Center for Supercomputing Applications. The Bro Project! Commercial Support! 33
The Bro Monitoring Platform
Robin Sommer! International Computer Science Institute, &! Lawrence Berkeley National Laboratory [email protected] http://www.icir.org/robin What Is Bro? Packet Capture Traffic Inspection Attack
The Bro Monitoring Platform
Adam Slagell National Center for Supercomputing Applications Borrowed from Robin Sommer International Computer Science Institute What Is Bro? Packet Capture Traffic Inspection Attack Detection NetFlow
The Bro Network Security Monitor. Broverview
The Bro Network Security Monitor Broverview Outline 2 Outline Philosophy and Architecture A framework for network traffic analysis. 2 Outline Philosophy and Architecture A framework for network traffic
The Bro Network Security Monitor. Broverview. Bro Workshop 2011. NCSA, Urbana-Champaign, IL. Bro Workshop 2011
The Bro Network Security Monitor Broverview NCSA, Urbana-Champaign, IL Outline 2 Outline Philosophy and Architecture A framework for network traffic analysis. 2 Outline Philosophy and Architecture A framework
What is a Bro log? Justin Azoff. Aug 26, 2014
What is a Bro log? Justin Azoff Aug 26, 2014 What is a Bro log? A Bro log is a stream of high level entries that correspond to network events. A file downloaded via HTTP An email sent using SMTP A login
The Open Source Bro IDS Overview and Recent Developments
The Open Source Bro IDS Overview and Recent Developments Robin Sommer International Computer Science Institute, & Lawrence Berkeley National Laboratory [email protected] http://www.icir.org/robin
100G Network Monitoring with Bro and Time Machine
UNIVERSITY OF CALIFORNIA 100G Network Monitoring with Bro and Time Machine Vincent Stoffer Cyber Security Engineer CENIC Conference March 11th, 2015 Irvine, CA Agenda Intro / overview 100G monitoring challenges
Introduction. Background
Introduction Bro is an open-source network security monitor which inspects network traffic looking for suspicious activity. The Bro framework provides an extensible scripting language that allows an analysis
The Bro Network Security Monitor
Robin Sommer International Computer Science Institute, & Lawrence Berkeley National Laboratory [email protected] http://www.icir.org/robin What is Bro? 2 What is Bro? Packet Capture 2 What is Bro?
dns.log DNS query/response details
app_stats.log Statistics on usage of popular web apps ts time Measurement timestamp ts_delta interval Time difference from previous measurement app string Name of application (YouTube, Netflix, etc.) uniq_hosts
The Bro Network Intrusion Detection System
The Bro Network Intrusion Detection System Robin Sommer International Computer Science Institute, & Lawrence Berkeley National Laboratory [email protected] http://www.icir.org System Philosophy Bro
A Bro Walk-Through. Robin Sommer International Computer Science Institute & Lawrence Berkeley National Laboratory
A Bro Walk-Through Robin Sommer International Computer Science Institute & Lawrence Berkeley National Laboratory [email protected] http://www.icir.org Doing the Walk-Through... Going from simple
An Overview of the Bro Intrusion Detection System
An Overview of the Bro Intrusion Detection System Brian L. Tierney, Vern Paxson, James Rothfuss Lawrence Berkeley National Laboratory Typical Approach: Firewall with default deny policy A blocking router
AlienVault Unified Security Management (USM) 4.x-5.x. Deploying HIDS Agents to Linux Hosts
AlienVault Unified Security Management (USM) 4.x-5.x Deploying HIDS Agents to Linux Hosts USM 4.x-5.x Deploying HIDS Agents to Linux Hosts, rev. 2 Copyright 2015 AlienVault, Inc. All rights reserved. AlienVault,
VMware vcenter Log Insight Getting Started Guide
VMware vcenter Log Insight Getting Started Guide vcenter Log Insight 1.5 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by
Web Application Firewall
Web Application Firewall Getting Started Guide August 3, 2015 Copyright 2014-2015 by Qualys, Inc. All Rights Reserved. Qualys and the Qualys logo are registered trademarks of Qualys, Inc. All other trademarks
User-ID Features. PAN-OS New Features Guide Version 6.0. Copyright 2007-2015 Palo Alto Networks
User-ID Features PAN-OS New Features Guide Version 6.0 Contact Information Corporate Headquarters: Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 http://www.paloaltonetworks.com/contact/contact/
SSL Tunnels. Introduction
SSL Tunnels Introduction As you probably know, SSL protects data communications by encrypting all data exchanged between a client and a server using cryptographic algorithms. This makes it very difficult,
Networks and Security Lab. Network Forensics
Networks and Security Lab Network Forensics Network Forensics - continued We start off from the previous week s exercises and analyze each trace file in detail. Tools needed: Wireshark and your favorite
Network Traffic Analysis
2013 Network Traffic Analysis Gerben Kleijn and Terence Nicholls 6/21/2013 Contents Introduction... 3 Lab 1 - Installing the Operating System (OS)... 3 Lab 2 Working with TCPDump... 4 Lab 3 - Installing
OnCommand Performance Manager 1.1
OnCommand Performance Manager 1.1 Installation and Setup Guide For Red Hat Enterprise Linux NetApp, Inc. 495 East Java Drive Sunnyvale, CA 94089 U.S. Telephone: +1 (408) 822-6000 Fax: +1 (408) 822-4501
How To Test The Bandwidth Meter For Hyperv On Windows V2.4.2.2 (Windows) On A Hyperv Server (Windows V2) On An Uniden V2 (Amd64) Or V2A (Windows 2
BANDWIDTH METER FOR HYPER-V NEW FEATURES OF 2.0 The Bandwidth Meter is an active application now, not just a passive observer. It can send email notifications if some bandwidth threshold reached, run scripts
Make a folder named Lab3. We will be using Unix redirection commands to create several output files in that folder.
CMSC 355 Lab 3 : Penetration Testing Tools Due: September 31, 2010 In the previous lab, we used some basic system administration tools to figure out which programs where running on a system and which files
Flow-level analysis: wireshark and Bro. Prof. Anja Feldmann, Ph.D. Dr. Nikolaos Chatzis
Flow-level analysis: wireshark and Bro Prof. Anja Feldmann, Ph.D. Dr. Nikolaos Chatzis 1 wireshark tshark Network packet analyzer for Unix/Windows Displays detailed packet stats GUI (wireshark) or command-line
Bro at 10 Gps: Current Testing and Plans
U.S. Department of Energy Bro at 10 Gps: Current Testing and Plans Office of Science Brian L. Tierney Lawrence Berkeley National Laboratory Bro s Use at LBL Operational 24 7 since 1996 Monitors traffic
File Transfer Examples. Running commands on other computers and transferring files between computers
Running commands on other computers and transferring files between computers 1 1 Remote Login Login to remote computer and run programs on that computer Once logged in to remote computer, everything you
P and FTP Proxy caching Using a Cisco Cache Engine 550 an
P and FTP Proxy caching Using a Cisco Cache Engine 550 an Table of Contents HTTP and FTP Proxy caching Using a Cisco Cache Engine 550 and a PIX Firewall...1 Introduction...1 Before You Begin...1 Conventions...1
Secure Web Appliance. SSL Intercept
Secure Web Appliance SSL Intercept Table of Contents 1. Introduction... 1 1.1. About CYAN Secure Web Appliance... 1 1.2. About SSL Intercept... 1 1.3. About this Manual... 1 1.3.1. Document Conventions...
Using cyber intelligence to detect and localize botnets. ENRICO BRANCA Botconf'13 5-6 December 2013, Nantes, France.
Using cyber intelligence to detect and localize botnets ENRICO BRANCA Botconf'13 5-6 December 2013, Nantes, France. 1 IDEA Create a cyber intelligence system able to: Analyse network communications Detect
VMware Identity Manager Connector Installation and Configuration
VMware Identity Manager Connector Installation and Configuration VMware Identity Manager This document supports the version of each product listed and supports all subsequent versions until the document
MobaXTerm: A good gnome-terminal like tabbed SSH client for Windows / Windows Putty Tabs Alternative
MobaXTerm: A good gnome-terminal like tabbed SSH client for Windows / Windows Putty Tabs Alternative Author : admin Last 10+ years I worked on GNU / Linux as Desktop. Last 7 years most of my SSH connections
Preventing credit card numbers from escaping your network
Preventing credit card numbers from escaping your network The following recipe describes how to configure your FortiGate to use DLP (Data Loss Prevention) so that credit card numbers cannot be sent out
Management, Logging and Troubleshooting
CHAPTER 15 This chapter describes the following: SNMP Configuration System Logging SNMP Configuration Cisco NAC Guest Server supports management applications monitoring the system over SNMP (Simple Network
Using the Intrusion Prevention System in MultiNet V5.3
Using the Intrusion Prevention System in MultiNet V5.3 Jeremy Begg VSM Software Services Pty Ltd March 2009 Introduction One of the interesting new features in MultiNet V5.3 is a security mechanism called
Computer Networks. Lecture 7: Application layer: FTP and HTTP. Marcin Bieńkowski. Institute of Computer Science University of Wrocław
Computer Networks Lecture 7: Application layer: FTP and Marcin Bieńkowski Institute of Computer Science University of Wrocław Computer networks (II UWr) Lecture 7 1 / 23 Reminder: Internet reference model
Lab Objectives & Turn In
Firewall Lab This lab will apply several theories discussed throughout the networking series. The routing, installing/configuring DHCP, and setting up the services is already done. All that is left for
How To Monitor A Network On A Network With Bro (Networking) On A Pc Or Mac Or Ipad (Netware) On Your Computer Or Ipa (Network) On An Ipa Or Ipac (Netrope) On
Michel Laterman We have a monitor set up that receives a mirror from the edge routers Monitor uses an ENDACE DAG 8.1SX card (10Gbps) & Bro to record connection level info about network usage Can t simply
Firewall Firewall August, 2003
Firewall August, 2003 1 Firewall and Access Control This product also serves as an Internet firewall, not only does it provide a natural firewall function (Network Address Translation, NAT), but it also
Monitoring Network Security with the Open-Source Bro NIDS
Monitoring Network Security with the Open-Source Bro NIDS Robin Sommer Lawrence Berkeley National Laboratory & International Computer Science Institute [email protected] http://www.icir.org at Jefferson
VMware vcenter Log Insight Security Guide
VMware vcenter Log Insight Security Guide vcenter Log Insight 2.0 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new
MFPConnect Monitoring. Monitoring with IPCheck Server Monitor. Integration Manual Version 2.05.00 Edition 1
MFPConnect Monitoring Monitoring with IPCheck Server Monitor Integration Manual Version 2.05.00 Edition 1 TABLE OF CONTENTS 1. INTRODUCTION...3 2. REQUIREMENTS...4 3. RESTRICTIONS...5 4. INSTALLATION...6
Berkley Packet Filters and Open Source Tools. a tranched approach to packet capture analysis at today s network speeds
Berkley Packet Filters and Open Source Tools a tranched approach to packet capture analysis at today s network speeds 1 Agenda Packet Capture overview Bro description Security Onion description The problem
The Bro Network Security Monitor
The Bro Network Security Monitor Network Forensics with Bro Matthias Vallentin UC Berkeley / ICSI [email protected] Bro Workshop 2011 NCSA, Champaign-Urbana, IL Outline 1. The Bro Difference 2. Abstract
VMware vcenter Log Insight Getting Started Guide
VMware vcenter Log Insight Getting Started Guide vcenter Log Insight 2.0 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by
Getting Started with PRTG Network Monitor 2012 Paessler AG
Getting Started with PRTG Network Monitor 2012 Paessler AG All rights reserved. No parts of this work may be reproduced in any form or by any means graphic, electronic, or mechanical, including photocopying,
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A [email protected]
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A [email protected] A number of devices are running Linux due to its flexibility and open source nature. This has made Linux platform
IBM. Vulnerability scanning and best practices
IBM Vulnerability scanning and best practices ii Vulnerability scanning and best practices Contents Vulnerability scanning strategy and best practices.............. 1 Scan types............... 2 Scan duration
High-Performance Network Security Monitoring at the Lawrence Berkeley National Lab
High-Performance Network Security Monitoring at the Lawrence Berkeley National Lab Strategies for Monitoring External and Internal Activity Robin Sommer Lawrence Berkeley National Laboratory & International
Experian Secure Transport Service
Experian Secure Transport Service Secure Transport Overview In an effort to provide higher levels of data protection and standardize our file transfer processes, Experian will be utilizing the Secure Transport
Comodo MyDLP Software Version 2.0. Installation Guide Guide Version 2.0.010215. Comodo Security Solutions 1255 Broad Street Clifton, NJ 07013
Comodo MyDLP Software Version 2.0 Installation Guide Guide Version 2.0.010215 Comodo Security Solutions 1255 Broad Street Clifton, NJ 07013 Table of Contents 1.About MyDLP... 3 1.1.MyDLP Features... 3
Introduction to Passive Network Traffic Monitoring
Introduction to Passive Network Traffic Monitoring CS459 ~ Internet Measurements Spring 2015 Despoina Antonakaki [email protected] Active Monitoring Inject test packets into the network or send packets
Architecture and Data Flow Overview. BlackBerry Enterprise Service 10 721-08877-123 Version: 10.2. Quick Reference
Architecture and Data Flow Overview BlackBerry Enterprise Service 10 721-08877-123 Version: Quick Reference Published: 2013-11-28 SWD-20131128130321045 Contents Key components of BlackBerry Enterprise
Configuring Health Monitoring
CHAPTER4 Note The information in this chapter applies to both the ACE module and the ACE appliance unless otherwise noted. The features that are described in this chapter apply to both IPv6 and IPv4 unless
Security Power Tools
Security Power Tools nmap: Network Port Scanner nmap is a network port scanner. Its main function is to check a set of target hosts to see which TCP and UDP ports have servers listening on them. Since
Penetration Testing LAB Setup Guide
Penetration Testing LAB Setup Guide (External Attacker - Intermediate) By: magikh0e - [email protected] Last Edit: July 06 2012 This guide assumes a few things... 1. You have read the basic guide of this
Deploy the ExtraHop Discover Appliance with Hyper-V
Deploy the ExtraHop Discover Appliance with Hyper-V 2016 ExtraHop Networks, Inc. All rights reserved. This manual, in whole or in part, may not be reproduced, translated, or reduced to any machine-readable
Network Monitoring & Management Log Management
Network Monitoring & Management Log Management These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/) Syslog
Device Log Export ENGLISH
Figure 14: Topic Selection Page Device Log Export This option allows you to export device logs in three ways: by E-Mail, FTP, or HTTP. Each method is described in the following sections. NOTE: If the E-Mail,
Intrusion Detection and Prevention: Network and IDS Configuration and Monitoring using Snort
License Intrusion Detection and Prevention: Network and IDS Configuration and Monitoring using Snort This work by Z. Cliffe Schreuders at Leeds Metropolitan University is licensed under a Creative Commons
150-420. Brocade Certified Layer 4-7 Professional 2010. Version: Demo. Page <<1/8>>
150-420 Brocade Certified Layer 4-7 Professional 2010 Version: Demo Page QUESTION NO: 1 Given the command shown below, which statement is true? aaa authentication enable default radius local A.
Understanding Syslog Messages for the Barracuda Web Filter
Understanding Syslog Messages for the Barracuda Web Filter Overview This document describes each element of a syslog message so you can better analyze why your Barracuda Web Filter performs a particular
Penetration Testing Lab. Reconnaissance and Mapping Using Samurai-2.0
Penetration Testing Lab Reconnaissance and Mapping Using Samurai-2.0 Notes: 1. Be careful about running most of these tools against machines without permission. Even the poorest intrusion detection system
Classic IOS Firewall using CBACs. 2012 Cisco and/or its affiliates. All rights reserved. 1
Classic IOS Firewall using CBACs 2012 Cisco and/or its affiliates. All rights reserved. 1 Although CBAC serves as a good foundation for understanding the revolutionary path toward modern zone based firewalls,
Barracuda Networks Web Application Firewall
McAfee Enterprise Security Manager Data Source Configuration Guide Data Source: Barracuda Networks Web Application Firewall January 30, 2015 Barracuda Networks Web Application Firewall Page 1 of 10 Important
Linux VPS with cpanel. Getting Started Guide
Linux VPS with cpanel Getting Started Guide First Edition October 2010 Table of Contents Introduction...1 cpanel Documentation...1 Accessing your Server...2 cpanel Users...2 WHM Interface...3 cpanel Interface...3
Prerequisites and Configuration Guide
Prerequisites and Configuration Guide Informatica Support Console (Version 2.0) Table of Contents Chapter 1: Overview.................................................... 2 Chapter 2: Minimum System Requirements.................................
Installing, Uninstalling, and Upgrading Service Monitor
CHAPTER 2 Installing, Uninstalling, and Upgrading Service Monitor This section contains the following topics: Preparing to Install Service Monitor, page 2-1 Installing Cisco Unified Service Monitor, page
Sending an Email Message from a Process
Adobe Enterprise Technical Enablement Sending an Email Message from a Process In this topic, you will learn how the Email service can be used to send email messages from a process. Objectives After completing
Linux FTP Server Setup
17Harrison_ch15.qxd 2/25/05 10:06 AM Page 237 C H A P T E R 15 Linux FTP Server Setup IN THIS CHAPTER FTP Overview Problems with FTP and Firewalls How to Download and Install VSFTPD How to Get VSFTPD Started
Network Security Monitoring
Network Security Monitoring Network Startup Resource Center www.nsrc.org These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
SSL VPN Server Guide. Access Manager 3.2 SP2. June 2013
SSL VPN Server Guide Access Manager 3.2 SP2 June 2013 Legal Notice THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT ARE FURNISHED UNDER AND ARE SUBJECT TO THE TERMS OF A LICENSE AGREEMENT OR A
INASP: Effective Network Management Workshops
INASP: Effective Network Management Workshops Linux Familiarization and Commands (Exercises) Based on the materials developed by NSRC for AfNOG 2013, and reused with thanks. Adapted for the INASP Network
STABLE & SECURE BANK lab writeup. Page 1 of 21
STABLE & SECURE BANK lab writeup 1 of 21 Penetrating an imaginary bank through real present-date security vulnerabilities PENTESTIT, a Russian Information Security company has launched its new, eighth
Lab 1: Network Devices and Technologies - Capturing Network Traffic
CompTIA Security+ Lab Series Lab 1: Network Devices and Technologies - Capturing Network Traffic CompTIA Security+ Domain 1 - Network Security Objective 1.1: Explain the security function and purpose of
Network Monitoring & Management Log Management
Network Monitoring & Management Log Management Network Startup Resource Center www.nsrc.org These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
Desktop : Ubuntu 10.04 Desktop, Ubuntu 12.04 Desktop Server : RedHat EL 5, RedHat EL 6, Ubuntu 10.04 Server, Ubuntu 12.04 Server, CentOS 5, CentOS 6
201 Datavoice House, PO Box 267, Stellenbosch, 7599 16 Elektron Avenue, Technopark, Tel: +27 218886500 Stellenbosch, 7600 Fax: +27 218886502 Adept Internet (Pty) Ltd. Reg. no: 1984/01310/07 VAT No: 4620143786
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware
Analyze Traffic with Monitoring Interfaces and Packet Forwarding
Analyze Traffic with Monitoring Interfaces and Packet Forwarding Published: 2016-04-08 This guide explains how to configure an ExtraHop appliance to analyze network traffic using both monitoring interfaces
www.novell.com/documentation SSL VPN Server Guide Access Manager 3.1 SP5 January 2013
www.novell.com/documentation SSL VPN Server Guide Access Manager 3.1 SP5 January 2013 Legal Notices Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation,
Flow Analysis Versus Packet Analysis. What Should You Choose?
Flow Analysis Versus Packet Analysis. What Should You Choose? www.netfort.com Flow analysis can help to determine traffic statistics overall, but it falls short when you need to analyse a specific conversation
Installing and Configuring Websense Content Gateway
Installing and Configuring Websense Content Gateway Websense Support Webinar - September 2009 web security data security email security Support Webinars 2009 Websense, Inc. All rights reserved. Webinar
HOWTO: Set up a Vyatta device with ThreatSTOP in router mode
HOWTO: Set up a Vyatta device with ThreatSTOP in router mode Overview This document explains how to set up a minimal Vyatta device in a routed configuration and then how to apply ThreatSTOP to it. It is
Introduction to Analyzer and the ARP protocol
Laboratory 6 Introduction to Analyzer and the ARP protocol Objetives Network monitoring tools are of interest when studying the behavior of network protocols, in particular TCP/IP, and for determining
CommandCenter Secure Gateway
CommandCenter Secure Gateway Quick Setup Guide for CC-SG Virtual Appliance and lmadmin License Server Management This Quick Setup Guide explains how to install and configure the CommandCenter Secure Gateway.
Scan Report Executive Summary. Part 2. Component Compliance Summary IP Address : 69.43.165.11
Scan Report Executive Summary Part 1. Scan Information Scan Customer Company: Date scan was completed: rsync.net ASV Company: Comodo CA Limited 06-02-2015 Scan expiration date: 08-31-2015 Part 2. Component
Network Probe User Guide
Network Probe User Guide Network Probe User Guide Table of Contents 1. Introduction...1 2. Installation...2 Windows installation...2 Linux installation...3 Mac installation...4 License key...5 Deployment...5
Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding
Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding This chapter describes the configuration for the SSL VPN Tunnel Client and for Port Forwarding. When a remote user accesses the SSL VPN
FTP e TFTP. File transfer protocols PSA1
FTP e TFTP File transfer protocols PSA1 PSA2 PSA3 PSA4 PSA5 PSA6 PSA7 PSA8 PSA9 Firewall problems with FTP Client-side Firewalls the client is behind a firewall and cannot be reached directly from the
Volume SYSLOG JUNCTION. User s Guide. User s Guide
Volume 1 SYSLOG JUNCTION User s Guide User s Guide SYSLOG JUNCTION USER S GUIDE Introduction I n simple terms, Syslog junction is a log viewer with graphing capabilities. It can receive syslog messages
vshield API Programming Guide vshield Manager 4.1 vshield App 1.0 vshield Edge 1.0 vshield Endpoint 1.0
vshield API Programming Guide vshield Manager 4.1 vshield App 1.0 vshield Edge 1.0 vshield Endpoint 1.0 This document supports the version of each product listed and supports all subsequent versions until
Secure Web Development Teaching Modules 1. Security Testing. 1.1 Security Practices for Software Verification
Secure Web Development Teaching Modules 1 Security Testing Contents 1 Concepts... 1 1.1 Security Practices for Software Verification... 1 1.2 Software Security Testing... 2 2 Labs Objectives... 2 3 Lab
Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN
Virtual private network Network security protocols COMP347 2006 Len Hamey Instead of a dedicated data link Packets securely sent over a shared network Internet VPN Public internet Security protocol encrypts
Grandstream Networks, Inc. UCM6100 Security Manual
Grandstream Networks, Inc. UCM6100 Security Manual Index Table of Contents OVERVIEW... 3 WEB UI ACCESS... 4 UCM6100 HTTP SERVER ACCESS... 4 PROTOCOL TYPE... 4 USER LOGIN... 4 LOGIN TIMEOUT... 5 TWO-LEVEL
Lab Exercise SSL/TLS. Objective. Requirements. Step 1: Capture a Trace
Lab Exercise SSL/TLS Objective To observe SSL/TLS (Secure Sockets Layer / Transport Layer Security) in action. SSL/TLS is used to secure TCP connections, and it is widely used as part of the secure web:
Load balancing Microsoft IAG
Load balancing Microsoft IAG Using ZXTM with Microsoft IAG (Intelligent Application Gateway) Server Zeus Technology Limited Zeus Technology UK: +44 (0)1223 525000 The Jeffreys Building 1955 Landings Drive
Chapter 9 Monitoring System Performance
Chapter 9 Monitoring System Performance This chapter describes the full set of system monitoring features of your ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN. You can be alerted to important
Chapter 4 Managing Your Network
Chapter 4 Managing Your Network This chapter describes how to perform network management tasks with your ADSL2+ Modem Wireless Router. Backing Up, Restoring, or Erasing Your Settings The configuration
File Transfer Protocol (FTP) & SSH
http://xkcd.com/949/ File Transfer Protocol (FTP) & SSH Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Some materials copyright 1996-2012 Addison-Wesley J.F Kurose and K.W.