Network forensics 101 Network monitoring with Netflow, nfsen + nfdump

Transcription

1 Network forensics 101 Network monitoring with Netflow, nfsen + nfdump

2 Agenda Intro to netflow Metrics Toolbox (Nfsen + Nfdump) Demo 2

3 What is Netflow Netflow = Netflow is a traffic monitoring technology developed by Cisco Networks. Flows are unidirectional/bidirectional and contain connection related data such as: Source and destination IP address. Source and destination port. Source and destination AS. Protocol ( TCP, UDP, ICMP etc. ), TCP flags. Logical input and output interfaces. Bytes and packet counters. 3

4 Background - OSI layer model Netflow contains information from layers 3 and 4. [Packets + Segments] 4

5 Pcap vs Netflow TCP/IPv4 Header Netflow TCP/IPv4 Netflow UDP 5

6 Netflow <=> Call logs Netflow it s like detailed phone bill for your network traffic. Contains metadata of network packets without the actual payload. Full pcap 100GB Netflow 375MB 6

7 Netflow versions Netflow versions available 7

8 Netflow example Netflow SYN SYN-ACK ACK GET /index.html ACK (Content) Date flow start Duration Proto Src Ip addr:port Dst IP addr:port Flags Packets Bytes :00: TCP : > :80..S :00: TCP :80 -> :5431 A.S

9 Uni-directional vs Bi-directional Uni-directional netflow Host A -> Host B Host B -> Host A Src Dst Dst Src Bi-directional netflow Host A <-> Host B Src Dst 9

10 Flow sampling Flow sampling is used to reduce load on routers by limiting the number of packets selected for analysis Not all the traffic might be relevant for our purpose. - Samples can be taken every n packets - Sample particular time intervals - Discard not relevant ports & interfaces - Collect only for particular subnets - Random sampling & deterministic sampling 10

11 Architecture considerations 11

12 Adversaries 12

13 Security metrics & Security goals Security metrics Peak on particular ports (139, 445 etc ) Top talkers / Top bandwidth consumers Increased numbers of concurrent connections to the web server Large number of SYN packets Connections to suspicious IPs Connections to a-typical ports Security goals Investigate past attacks (forensics) Detect on-going attacks Prevent against future attacks 13

14 Netflow analysis and visualization Overview Details Flows on demand 14

15 Go with the flow Example of how to activate netflow export. Cisco IOS netflow export example: Router(config)#ip flow-export version 5 Router(config)#ip flow-export source FastEthernet 2/48 Router(config)#ip flow-export destination Router(config)#interface FastEthernet2/48 Router(config-if)#ip route-cache flow 15

16 Toolbox nfsen + nfdump Nfsen Web based frontend Display flows Framework to automate tasks NfDump Collect and store flows Process flows on cmd-line 16

17 nfdump ( v1.5.7 ) features: Nfdump CMD line based tool comparable to tcpdump. Written in C, designed to be fast. Stores netflow data in time sliced files. Supports sflow, netflow format v5,v7 and v9. All processing options support IPv4 and IPv6. Powerful pcap like filter syntax: ( proto tcp and dst net /16 and src port > 1024 and bytes < 600 ) or ( bps > 1k and ip in [ /24 ].. Flexible flow aggregation: srcip,dstip,srcport,dstport,srcas,dstas,proto Efficient filter engine: > 6 Mio flows/s on 3GHz Intel. Lots of fast Top N statistics. User defined output formats. 17

18 Nfdump Nfdump architecture 18

19 Nfdump syntax Protocol version: inet or ipv4 inet6 or ipv6 Protocol: TCP, UDP, ICMP or Proto <num> Ip address: IP a.b.c.d or HOST a.b.c.d SourceDestination: SRC or DST Network: NET a.b.c.d / num Port: <SourceDestination> PORT [comp]<num> TCP Flags: flags <tcpflags> A. ACK S. SYN F. FIN R. Reset P. Push U. Urgent X all flags Packets, Pkt/s Bytes: packets [comp] num [scale] bytes [comp] num [scale] pps [comp] num [scale] Examples: host host and port 123 net /24 and not host tcp and (src ip or dst ip ) and flags S and bytes >

20 Nfsen general overview page Nfsen - home 20

21 Nfsen - nav Nfsen navigation page 21

22 Netflow processing output Nfsen - out 22

23 Netflow profile & alert tab Nfsen - profile 23

24 Profile: Nfsen more about profiles Custom view of netflow data with filters applied Can be created on historical netflow data as well as live data (static, continuous) Can contain one or more channels Channel are incoming sources of netflow, for ex: firewall, border router, webserver, dmz etc 24

25 Intro to the scenarios 1. Boot the imported VM image ENISA_CERT_Exercises.ova 2. Log into `Trainee` account (user:trainee, pass:exercises) 3. `cd /home/trainee/desktop` On the desktop there are two scripts: `nfsen_start.sh`, `nfsen_stop.sh` First run the `./nfsen_stop.sh` afterwards run the `./nfsen_starts.sh` 4. The netflow data is available in the folder `/data/nfsen/profiles-data/live/upstream1` 25

26 The story We are working in ITSec dep. for a big ISP. There is a netflow collector for monitoring the ISP address space. The ISP has received a report about a Ddos attack being carried by a customer 1 Identify when the attack was carried 2 Identify the target of the attack Identify what IPs are involved in the attack 3 Identify modus operandi Mitigation measures 26

27 Step.1 Lets check the overview panel `cd /data/nfsen/profiles-data/live/upstream1` `ls lhs` (long-listing format + human readable + sorted) What do we notice? 27

28 Step

29 Step.2 Top 10 statistics for DST IP ordered by flows/packets/bytes 29

30 Step.2+ Top 10 flow records aggregated by dstip 30

31 Step.2+ continued We have our victim 31

32 Step.3 Role of the attacked server? 32

33 Step.4 Attackers Who are the badboys? 33

34 How the attack was carried out? Step.5 How? 34

35 Online demo At the following link there is production nfsen:

36 Wireshark & pcap intro Wireshark capture & display filters A capture filter is used to select which packets should be saved to disk while capturing. For capture filters Wireshark uses the BPF syntax. (BPF is module that runs in the kernel) like tcpdump Display filters are used to change the view of a capture file. They take advantage of the full dissection of all packets. This makes it possible to do very complex and advanced filtering when analyzing a network tracefile. ers.pdf 36

37 Wireshark & pcap intro Capture filter Display filter 37

38 Example capture/display filters Example capture filters: host net /24 host and not (port 80 or port 25) dst port 135 and tcp port 135 and ip[2:2]==48 Example display filters: 38

39 Pcap = packet capture Pcap analysis part 1 Step 1. Go to: cd /home/trainer/documents/exercises/07_nf/adds We will investigate the following pcap: drive-by-download_fast-flux.pcap Open it with wireshark One of the customer IPs got infected. Let s try to figure out how. See `dns` & `http` requests 39

40 Pcap part 2 First let s play with display filters, filtering different protocols Filter: dns Who is our client? Which is the dns server? What kind of interesting requests/answers we spot? Now lets try to exclude legitimate IPs and see http requests Filter:!(ip.addr == ip.addr == ip.addr == ) && http Can we spot anything in particular? 40

41 tshark tcpdump Tshark [ -2 ] [ -a <capture autostop condition> ]... [ -b <capture ring buffer option>]... [ - B <capture buffer size> ] [ -c <capture packet count> ] [ -C <configuration profile> ] [ - d <layer type>==<selector>,<decode-as protocol> ] [ -D ] [ -e <field> ] [ - E <field print option> ] [ -f <capture filter> ] [ -F <file format> ] [ -g ] [ -h ] [ - H <input hosts file> ] [ -i <capture interface> - ] [ -I ] [ -K <keytab> ] [ -l ] [ -L ] [ -n ] [ -N <name resolving flags> ] [ -o <preference setting> ]... [ -O <protocols> ] [ -p ] [ - P ] [ -q ] [ -Q ] [ -r <infile> ] [ -R <Read filter> ] [ -Y <display filter> ] [ - s <capture snaplen> ] [ -S <separator> ] [ -t ad a r d dd e ] [ - T pdml psml ps text fields ] [ -v ] [ -V ] [ -w <outfile> - ] [ -W <file format option>] [ -x ] [ -X <extension option>] [ -y <capture link type> ] [ -z <statistics> ] [ <capture filter> ] tshark R http.request T fields e http.host -r drive-by-download_fast-flux.pcap tshark R http.request T fields e http.request.uri r drive-by-download_fastflux.pcap tshark R http.request T fields e http.request.full_uri r drive-by-download_fastflux.pcap Can you see any malicious requests? tshark r drive-by-download_fast-flux.pcap R dns T fields e dns.qry.name e dns.resp.addr e dns.resp.ttl 41