Build Your Own SIE. Oct 22, 2012 Baltimore, MD. Eric Ziegast <info@sie.isc.org>

Similar documents
SIE, PassiveDNS, and data combining

Wireless LAN Apple Bonjour Deployment Guide

Apache CloudStack 4.x (incubating) Network Setup: excerpt from Installation Guide. Revised February 28, :32 pm Pacific

White Paper. Intrusion Detection Deploying the Shomiti Century Tap

How to Create VLANs Within a Virtual Switch in VMware ESXi

NOC PS manual. Copyright Maxnet All rights reserved. Page 1/45 NOC-PS Manuel EN version 1.3

VLAN for DekTec Network Adapters

Network Monitoring and Management NetFlow Overview

CounterACT 7.0 Single CounterACT Appliance

Forensic Network Analysis Tools

nfdump and NfSen 18 th Annual FIRST Conference June 25-30, 2006 Baltimore Peter Haag 2006 SWITCH

1.0 Basic Principles of TCP/IP Network Communications

Securing end devices

Change Log. 2 per vices corporation

Introduction to Netflow

New Products and New Features May, 2015

Application Protocols for TCP/IP Administration

Red Hat Linux Networking

6.0. Getting Started Guide

Watch your Flows with NfSen and NFDUMP 50th RIPE Meeting May 3, 2005 Stockholm Peter Haag

Scalable Linux Clusters with LVS

Network Traffic Analysis

Lab VI Capturing and monitoring the network traffic

Netcat Commands. I am going to give you insight and knowledge so that you can understand netcat Me0wwww. WOW, something useful and FREE

Catalyst Layer 3 Switch for Wake On LAN Support Across VLANs Configuration Example

McAfee Asset Manager Sensor

Device Interface IP Address Subnet Mask Default Gateway

Wireshark in a Multi-Core Environment Using Hardware Acceleration Presenter: Pete Sanders, Napatech Inc. Sharkfest 2009 Stanford University

Configure IOS Catalyst Switches to Connect Cisco IP Phones Configuration Example

Deployment Guide: Cisco Guest Access Using the Cisco Wireless LAN Controller

Tcpdump Lab: Wired Network Traffic Sniffing

Unix System Administration

Configuring Your Computer and Network Adapters for Best Performance

IP Address: the per-network unique identifier used to find you on a network

Socket = an interface connection between two (dissimilar) pipes. OS provides this API to connect applications to networks. home.comcast.

VMware ESX Server Q VLAN Solutions W H I T E P A P E R

Penetration Testing with Kali Linux

TotalCloud Phone System

ClusterLoad ESX Virtual Appliance quick start guide v6.3

: Interconnecting Cisco Networking Devices Part 1 v2.0 (ICND1)

CT5760 Controller and Catalyst 3850 Switch Configuration Example

Configuring Redundancy

QualNet 4.5 Network Emulation Interface Model Library

Configuring IPS High Bandwidth Using EtherChannel Load Balancing

Network Security. Network Packet Analysis

Routing. Static Routing. Fairness. Adaptive Routing. Shortest Path First. Flooding, Flow routing. Distance Vector

Cisco Certified Network Associate Exam. Operation of IP Data Networks. LAN Switching Technologies. IP addressing (IPv4 / IPv6)

NetFlow Collection and Processing Cartridge Pack User Guide Release 6.0

OLT LTP-8X_v Appendix to Operation Manual OLT LTP-8X Quick Configuration Guide Central Office Node Terminal

Interconnecting Cisco Network Devices 1 Course, Class Outline

In order to upload a VM you need to have a VM image in one of the following formats:

Network Defense Tools

Network forensics 101 Network monitoring with Netflow, nfsen + nfdump

HOST AUTO CONFIGURATION (BOOTP, DHCP)

Vulnerability Assessment and Penetration Testing

Configuring Flexible NetFlow

VIA CONNECT PRO Deployment Guide

Signiant Agent installation

OpenCPN Garmin Radar Plugin

IPv6.marceln.org.

1 Data information is sent onto the network cable using which of the following? A Communication protocol B Data packet

Monitoring VMware ESX Virtual Switches

The Book of GNS by Jason C. Neumann

LECTURE 4 NETWORK INFRASTRUCTURE

vsphere Networking vsphere 6.0 ESXi 6.0 vcenter Server 6.0 EN

VoIP monitor sniffer manual

Configuring EtherChannels

SSVP SIP School VoIP Professional Certification

How To Monitor And Test An Ethernet Network On A Computer Or Network Card

What is VLAN Routing?

Networking. Systems Design and. Development. CRC Press. Taylor & Francis Croup. Boca Raton London New York. CRC Press is an imprint of the

Secure Networks for Process Control

Network Detector Setup and Configuration

Configuring DHCP Snooping and IP Source Guard

Open Source in Network Administration: the ntop Project

Network Probe User Guide

Linux KVM Virtual Traffic Monitoring

Dissertation Title: SOCKS5-based Firewall Support For UDP-based Application. Author: Fung, King Pong

AlliedWare Plus OS How To Use sflow in a Network

Introduction To Computer Networking

SolarWinds Technical Reference

Quick Start for Network Agent. 5-Step Quick Start. What is Network Agent?

An Introduction to Open vswitch

SonicWALL DHCP Server Enhancements in SonicOS Enhanced 4.0

Monitoring high-speed networks using ntop. Luca Deri

Twin Peaks Software High Availability and Disaster Recovery Solution For Linux Server

PANDORA FMS NETWORK DEVICE MONITORING

Performance Evaluation of Linux Bridge

INTERCONNECTING CISCO NETWORK DEVICES PART 1 V2.0 (ICND 1)

ADVANCED NETWORK CONFIGURATION GUIDE

Design of an Application Programming Interface for IP Network Monitoring

Helsinki University of Technology Department of Electrical and Communications Engineering Networking Laboratory

Host Configuration (Linux)

PasserellesNumeriquesCambodia (PNC)

PANDORA FMS NETWORK DEVICES MONITORING

OpenFlow with Intel Voravit Tanyingyong, Markus Hidell, Peter Sjödin

16-PORT POWER OVER ETHERNET WEB SMART SWITCH

Cisco TelePresence Authenticating Cisco VCS Accounts Using LDAP

Transcription:

Build Your Own SIE Oct 22, 2012 Baltimore, MD Eric Ziegast <info@sie.isc.org>

Agenda Limited Scope (internal only - no policy stuff) Hardware Infrastructure concepts nmsgtool Q&A

Hardware SIE Switch Many will fail over to broadcast traffic Some that work D-Link DGS-3026 (early, had issues) Extreme Networks x450a-24t (production Cisco 3750X (in beta) Servers 2 or more 2.0GHz amd64 cores lots of ram Intel server-grade GigE NICs 3

ISC SIE Infrastructure - Sensors - Sensor upload relays - Inter-node relays - Participants

Functionality / roles SIE switch partition VLANs broadcast data trunk to other switches Sensor collect data (ethernet tap, stream input) upload: dump to file regularly, rsync, ssh broadcast directly to channel relay over network to another nmsgtool 5

Functionality / roles Inter-node relay Listen to VLAN and rebroadcast to another nmsgtool on remote side (lossy) Dump to file, rsync to other side, replay (no loss, but might delay or clog) Participants Listen to data off the wire or broadcast Dump to file for batch processing, or multithreaded programmng to process in real time Relay into server or off server to remote processing 6

Functionality / roles Participants (properties) Loosely coupled multi-processor 7

VLANs (Cisco) interface GigabitEthernet1/0/48 description SPLIT2 switchport trunk encapsulation dot1q switchport trunk allowed vlan 7,14,25,26,80,81,201-204,206-209 switchport mode trunk interface GigabitEthernet1/0/7 desciption mc7.sie switchport trunk encapsulation dot1q switchport trunk allowed vlan 7,14,25,80 switchport mode trunk interface GigabitEthernet1/0/8 description mc8.sie switchport trunk encapsulation dot1q switchport trunk allowed vlan 7,14,25,80,202-204,206-208 switchport mode trunk

VLANs (Extreme) create vlan "sie-ch7" configure vlan sie-ch7 tag 7...etc... create vlan "sie-ch209" configure vlan sie-ch209 tag 209 configure ports 7 display-string mc7.sie configure ports 8 display-string mc8.sie configure ports 48 display-string SPLIT2 configure vlan sie-ch7 add ports 7-8, 48 tagged configure vlan sie-ch14 add ports 7-8, 48 tagged configure vlan sie-ch25 add ports 7-8, 48 tagged configure vlan sie-ch26 add ports 48 tagged configure vlan sie-ch80 add ports 7-8, 48 tagged configure vlan sie-ch81 add ports 48 tagged configure vlan sie-ch201 add ports 48 tagged configure vlan sie-ch202 add ports 7, 48 tagged...etc... configure vlan sie-ch208 add ports 7, 48 tagged configure vlan sie-ch209 add ports 48 tagged

VLANs (servers) Linux: ip link add link eth1 name eth1.209 type vlan id 209 ip link set up eth1 mtu 9000 vconfig add eth1 209 ip addr add 10.0.209.18/24 dev eth1.209 eth1.7 inet addr:10.255.1.18 Bcast:0.0.0.0 Mask:255.255.255.0 eth1.14 inet addr:10.0.14.18 Bcast:0.0.0.0 Mask:255.255.255.0...etc... eth1.209 inet addr:10.0.209.18 Bcast:0.0.0.0 Mask:255.255.255.0 BSD: ifconfig create vlan 209 vlandev em1 vlan7: inet 10.255.1.18 netmask 0xffffff00 broadcast 10.255.1.255! vlan: 7 parent interface: em1 vlan14: inet 10.0.14.18 netmask 0xffffff00 broadcast 10.0.14.255! vlan: 14 parent interface: em1 vlan209: inet 10.0.209.18 netmask 0xffffff00 broadcast 10.0.209.255! vlan: 209 parent interface: em1 Study our auto-config script: http://rsfcode.isc.org/git/sie-update/tree/sie-update

nmsgtool NMSG read/write from UDP unicast (remote copy) broadcast (SIE switch) read/write from 0mq (Unix or TCP sockets) read/write from files in NMSG binary print presentation output read presentation output 11

nmsgtool Receiving messages off the switch: [-C channel] or --readchan read nmsg data from socket(s) [-l so] or --readsock read nmsg data from socket (addr/port) See: (/usr/local)/etc/nmsgtool.chalias -C ch25 == -l 10.0.25.255/8430 -l 10.0.25.255/9430 [-c count] or --count stop or reopen after count payloads output Example: nmsgtool -C ch202 -o - -c 5 12

nmsgtool Capturing data: [-i if[+][,snap]] or --readif read pcap data from interface ('+' = promisc) [-p file] or --readpcap read pcap data from file [-b filter] or --bpf filter pcap inputs with this bpf [-V vendor] or --vendor vendor [-T msgtype] or --msgtype message type Darknet relay example: nmsgtool -V ISC -T pkt -i sie.14+ -m 1280 \ -s ${REMOTE_SERVER_IP}/50140 -z 13

nmsgtool SIE DNS sensor: NMSG_KICKER=/usr/local/lib/sie/sie-kicker ch202 DNSQR_CAPTURE_RD=0 DNSQR_RES_ADDRS=149.20.XX.YY, 2001:4f8:ZZ:XX::YY ARGV_NMSGTOOL= -i rl0 -V ISC -T dnsqr -z -t 60 -w /var/spool/sie/new/ch202/xx.isc.org /usr/local/bin/nmsgtool -D -P /var/run/sie_dns_sensor.pid Take a look at scripts included with sie-dns-sensor on rsfcode.isc.org or these: ftp://ftp.isc.org/isc/nmsg/misc/sie-scripts/ 14

nmsgtool Cheating to create messages from text input: [-f file] or --readpres read pres format data from file [-V vendor] or --vendor vendor [-T msgtype] or --msgtype message type Event injection example (old ch21): #!/bin/sh REASON=$1 NMSGTOOL="nmsgtool -V sie -T reputation -f - \ --setsource $NMSG_ID -s 10.0.21.255/8430" while read ip do $NMSGTOOL <<EOF type: ADDRESS address: $ip tag: aa419_ddos_add value: $REASON EOF done 15

nmsgtool Writing them to files: [-w file] or --writenmsg write nmsg data to file [-z] or --zlibout compress nmsg output [-c count] or --count stop or reopen after count payloads output [-t secs] or --interval stop or reopen after secs have elapsed [-k cmd] or --kicker make -c, -t continuous; run cmd on new files Writes files every 15 minutes and processes: nmsgtool -C ch113 -w /data/ch204 -z -t 900 -k convert2csv.sh The convert2csv.sh script gets $1 set as file argument 16

nmsgtool Rebroadcasting them: [-s so[,r[,f]]] or --writesock write nmsg data to socket (addr/port) [-m mtu] or --mtu MTU for datagram socket outputs [--mirror] mirror payloads across data outputs [--unbuffered] don't buffer writes to outputs Take a file and spit it out to a channel: nmsgtool -r FILE -s 10.0.113.255/8430,10000,1000 --unbuffered Stripe it across multiple USP ports: nmsgtool -r FILE --unbuffered \ -s 10.0.113.255/8430,10000,1000 \ -s 10.0.113.255/8431,10000,1000 Mirror it to another port: nmsgtool -r FILE --unbuffered --mirror \ -s 10.0.113.255/8430,10000,1000 \ -s 127.0.0.1/8430 17

nmsgtool Misc: [--getsource sonum] only process payloads with this source value [--getoperator opname] only process payloads with this operator value [--getgroup grname] only process payloads with this group value [--setsource sonum] set payload source to this value [--setoperator opname] set payload operator to this value [--setgroup grname] set payload group to this value 18

Relay uploader Used to run chroot sshd+rsync or sftp server on FreeBSD. Maintained custom script to take an upload and queue uploaded FILEs for nmsgtool -r FILE -s IP/PORT playback. Now: http://rsfcode.isc.org/git/isc-sleigh/ isc-sleigh: Debian-based minimal privilege rsync/ssh file service ----------------------------------------------------------------- sleigh is a utility for automatically setting up a multi-user minimal privilege rsync-over-ssh file submission service on Debian-based systems. The sleigh Debian package ships a dedicated sshd_config file and runit service directory. Authentication is public key based, with public keys stored outside of chroot user home directories in the directory /etc/sleigh/authorized_keys.d. Individual users and "queues" (per-user writeable upload directories) are configured with the "sleigh" command line utility. sleigh makes use of the Debian libnss-extrausers package in order to avoid modifying the main /etc/passwd and /etc/group databases, and also depends on the isc-rsync-static and isc-rsync-server-wrapper packages, which are available from http://rsfcode.isc.org/. 19

ISC SIE Properties (cont.) - Loosely Coupled Multi Processor - Open sourced data - making intermediate products available 20

Build Your Own Internally - Get a switch - We use Extreme Networks x450a-24t - Testing Cisco 3750X - Configure VLANs - Find data - nmsgtool sensors JSON, XML, sie-dns-sensor - darknet arp vrf onto switch - sinkhole httpk null web server - netflow nfdump + nfreplay to roadcast address 21

Build Your Own Internally - Relays - batched replay (sie-scripts) 1. dump data to file 2. kicker script runs every N seconds 3. rsync/ssh uploader to relay servers 4. nmsgtool on relay servers replays data onto VLAN 5. scripts manage backlogs to prevent overflow ftp://ftp.isc.org/isc/nmsg/misc/sie-scripts/sie-scripts-0.21.tar.gz - nmsgtool can forward using unicast udp - use when data loss is ok - nmsgtool can use 0mq for TCP 22

Build Your Own Internally - Automation - sie-update auto-configuring interfaces on participant servers (per-vlan and per-customer address) - channel data replication - server build template - Robustness - wrapsrv 23

Questions? Email: info@sie.isc.org Web: https://sie.isc.org/ Eric Ziegast SIE Programme Manager +1.650.423.1363 (Pacific Time)