Hack3rcon 3 04 Intro to Network Traffic Analysis Part 2 Jon Schipp

All right, so in the materials I gave you a tarball that when you unzip it you can use tar xzf and then the filename traf-workshop.tgz and then it'll extract it. And here's the files and I'm in the directory right now. You got some scripts I've written at work or have used. Just a few of them where you can play around with them, automate certain things. I also have this malpcap directory which will have some malicious pcap files I've collected from sources like Millworm, openpacket.org, there's pcapr.net, there's a few other ones. And there's a big one here in this DEF CON 17 that I found. Basically the capture of their CTF challenge, so it's rather large. That's why the file's so big, it's over almost 2 gigs. So that'd be something you can definitely play with. Headers, real quick, I have a number of IP and TCP headers, stuff that you might use as a reference. So we'll just use GQ real quick and then we have an example header and you can use these with TCPdump if you need to count the bits, you wanna get real specific. We also have Source code, which if we had time I was gonna take a look at a few things. We probably will not have time for that. And then I have two of the best documents I've ever found on the internet on tcpdump filters. This tcpdump advanced filters and the tcpdumpfilters.txt, these two text files, these are excellent. Very technical filters already laid out for you to do all kinds of cool stuff and already detect certain attacks like WinNuke, LAN TAC. Fragmentation, ping of death, just some really neat stuff done in BPF. So you can just copy and paste those if you need to. I don't really wanna try to explain those, they're quite difficult. And then here's this txv fault directory has traftgen configurations. These come with the tool when you compile it, so it gives you the actual configuration language, file that the traffic can use when you wanna create packets. And we might get a little into that. Okay, so back to the next few items that we're gonna cover. Start with basic tcpdump usage. And here, so we're gonna be in the traffic workshop directory. I'm gonna go to, let's just go to malpcap. Any one of these can be used. Let's just use, let's try a challenge. I don't wanna type those long names.

Let's do openpacket.org.

Okay, so here's an example, it's at the very bottom, let's just use that one, the Zeus. So we can use tcpdump. Typically you just wanna use -nn for do not resolve names and do not resolve port names to the numbers and as it reads the ncservices file. So that they'll save time in capture, especially a DNS resolution. If you do not specify these, it'll ask your resolver to resolve the address for every single packet and that takes up so much network traffic and so much CPU time, you'll definitely slow your traffic down. You'll probably lose tons of packets during the process. So you never do that. And also, I suppose if an attacker made a breach in your network and you were querying on his IP address and he had access to a DNS server or just a PCAP analysis or something where he can see the request that you've made asking for his name server, he would know that maybe you have a network monitoring station because you're actually resolving his names. If he sees that DNS traffic. So that's another thing, you might not want to alert anybody. So good practice just to avoid that by using -nn. That's almost in every pcap tool you can imagine. So here is a, just a quick pcap cap or a read. So we use -nn for no name resolution, no port resolution, -r for reading. And there's the output. One thing we might wanna, when we only wanna capture a few packets, like we wanna do a count, let's just grab one. We can get one single packet here with a SYN flag set. So it's initiating a connection to port 80 from a local port. This is an ephemeral port, 1032. And if you wanna ask for more information, such as IP options and such, we use -v for verbose. And so you can see it gives you a few other options like TTL, ID, ID type of service, offset, the don't fragment bit is set, and then tells you the upper layer protocol TCP, the protocol number 6, the length of the IP header, or excuse me, the datagram, and so on. And if you want to get further, if you want to actually dump payload data, you can specify -x, and then we actually get the hex and ASCII output. And if you want to dump the payload data with the link layer headers, you use two X's. And now we have lower-level stuff. We can use -e, excuse me, -e, and we can get Ethernet information.

Hold on here.

So now we have MAC addresses. We get the ethertype field and 0x0800 is IPv4. So that's just a basic, really basic introduction to tcpdump. tcpdump, the best thing to learn to use is the man page. Just open it up and then do a forward slash space and a particular option such as frag.

Oops. Frag.

And you can use -n, just press n to go to the next, and then eventually explains, you can get all the information like here, right here. Fragmented internet datagrams are printed as frag ID, size, at the offset, and you can go in here and further get more information on how tcpdump presents the data. And most of my trying to figure out how something works or how it's presented, what it means, is just from reading this man page. So you can use Shift+N, capital N, to go backwards to reverse the search for the matches. So it's just a quick thing to do. But basically TCPdump is all about doing, just like most things. Just get down and use these examples, you'll eventually catch on pretty quickly. Okay, so things about PCAPs. So PCAP, I think the current version is 2.4, and a PCAP file, like any file really, starts with a header. If we do file command, and let's just do this zoo sample PCAP, it says TCPdump capture file little indian in version 2.4 and it gives you a little information. Now with this, tcpdump looks for that header when it reads a file to know that it's a pcap. So we can do a cat, we can cat that zeus file, let's do -3 and pipe it just to kinda show you the things you can do with redirection filtering. You can play around with this. We can use the dash here to specify take standard input from the filter, which is the pipe. So we redirected output from cat to input of tcpdump, and we can get the same packet. However, if you specify more than one packet—

so get rid of this—

so everything in the directory, it printed some of the first, failed here, and it says pcaploop bogus savefile header. So what actually happened is, after we captured the first one, the next one comes in, it reads what it expects to be part of the packet, more data, but it's actually reading the header of the next pcap file. So that way you know that it says, hey, this isn't packet data, this is a header. Well, it doesn't really know that, but it checks the packet data and fails. So there's ways around this. And we would use a Wireshark tool called mergecap. Probably to combine multiple pcaps and read from a single large pcap. But there's other things we can do, some little command line tricks I included because I thought they were really neat. So let's just do this one more time.

Sorry, I keep hitting keys.

Let's do cat zeus3 and zeus2 tcpdump. -r and take our standard in and here we have that pcap loop focus header. 'Cause it's an actual header of the pcap file and the pcap's, or tcpdump's expecting data. So we can do a few tricky things here. One is we can use dd to input the file and output a new file skipping the first 24 bytes. Because the actual TCP, or excuse me, the actual pcap header is 24 bytes so we can skip those It basically removes that part and then if you cat the file and the new pcap file without the header, it's just one big stream of data. And you can pipe that into tcpdump, I recommend trying that. I'm not gonna try all these 'cause they're quite a bit to type. Tail, you can use tail to remove, this starts at 1, so this would be the 25th byte. So this does the same thing, just another way of doing it, removes the first 24. You output to a new file then you cat a different one file and then add that one that you've modified to change out the first 24 pcap header bytes and pipe it to tcpdump and it works. And you can get a little more tricky and use subshells like these examples with the parentheses. Each one of these are a subshell. And here, let's go to one, let's look at this one right here. So we cat the, you can just one stream, cat file pcap and we take off the first 24 bytes of file2.pcap 'cause it's coming in, you got the arrow, the redirection in, and then that will be piped to tcpdump, so therefore it's cat this file, then that file starts next without the first 24 bytes, so it looks like a whole stream of data. And you can keep piping these just like that. Of course it's really ugly and I don't know why anyone would wanna do that unless they didn't have necessary tools and stuff. But that's one quick way you can use the shell to get what you need. Okay, so we saw the 2.4 pcap header. There is a number of different variations. We can use mergecap, which is included with the Wireshark suite, and -f, and it gets you a bunch of different styles of pcap files, different formats. And obviously the libpcap is the most common use. There's also Snoop, which is used on Solaris systems. You may encounter that, so you can use a program like Etercap to modify or change the Snoop file to a libpcap format, which EditCap is also included in Wireshark. Okay, so one thing is, has anybody ever used the any listening device on tcpdump? So it listens on all the interfaces on the system. How does it do that? Well, it actually creates a pseudo-link layer header, excuse me, and the format's called Linux cooked. So if you actually find a file that uses the any that's written with it, you'll find whenever you use the file command, surely I have one in here, let me, let's do file grep for cooked.

I don't know if it was capitalized or not, I'm just gonna do that. Nope, not in there. I surely have one in here.

But basically whenever we did that file command earlier and it shows libpcap version 2.4 instead of Ethernet, the Ethernet won't be there, it'll actually say cooked which specifies that this was written or read from a link or the Linux cooked pseudo header on the frame level. So in case you ever encounter that, 'cause I've encountered that a couple of times where packets I couldn't find files I couldn't even read because they were malformed from that. And I'm not sure if that is— it's harder to write good data like that, but I've encountered a few. And usually just have to remove the files because I can't read them at all.

But this might take a while. I assume it's gonna find something, but I could be wrong.

Okay, so Mergecap. Here I got the example, here we created a cooked file. You can just do this right now if you're on the network, just listen to your wireless device if you're connected to the wireless segment. And you can just dump 10 packets, then you can do file cooked.pcap, so if you listen on the NE, it should show that it's a Linux cooked file. Okay, mergecap, so— nope, didn't find anything that completed, that's a bummer.

Okay, let me try, let's see here, mergecap.

Alright, we're just gonna take— let's just do all these. Let's do milworm exploits and we're gonna merge all these files into one large file. So we're gonna specify that we're gonna use the libpcap format, the -f, okay, and then we specify, we'll use a shell expression which is the asterisk to say all the files in this directory that match the .pcap file format, and we'll write it—

sorry, I'm kind of messing it up here—

to, we'll call it, "milworm.comb" for combination, ".pcap." And let's see here, file milworm. Okay, looks like there it is. I believe those files, yeah, all those, these, all these little, they're all little files so it didn't take very long. But you got big PCAPs, you can merge them together. And one thing you could do to test your IDS would be to take that combined file or a bunch of them and just replay it on the interface that your Snort instance is listening or your Suricata and then have it check the signatures on those packets and that's one way you could test from real world exploits assuming that you have the signatures for the things. In there, which I've done that already. And there's quite a few on the Millworm that my rules, including the emerging threats, doesn't ring on but does cover quite a bit. So, okay, so let's go back to the pcap file. We're just following along. And here, by default, Mergecap reads the timestamps, will put each one in order, by chronological order. So if you don't want to, you actually want to have like a cat-like thing, just add one pcap and the next one on top of it and the next one on top of it and the next one on top of it to one big file, then you would specify -a. So it does not take timestamp into consideration and sort all the files by their times. Especially if you're looking at a bunch of files, you might not want that. Okay, statistical data. Let's quickly go through these. Capinfos is a Wireshark tool, so let's go to, I guess we're already here. Let's do, let's just go back to Malware Exploits and we'll do capinfo on a file here.

What do we got?

Let's do this barcode, I don't know what that is. ActiveX pcap and this is interesting because this will give you all kinds of information on your file. The number of bytes, the size of the file, capture duration, when it started, when it stopped. So if you have a pcap file and you wanna keep records of things, I recommend using our capinfos. What I actually do is, if you notice the hashes at the bottom and you wanna prevent data from being tampered, every time I write a new pcap I run a script at midnight or so that actually does the, use capinfos on the pcap file, I write the hashes to a file, I set an immutable bit on that in the pcap file and then no one can read or write to it and then we store it somewhere. So then we have a hash and other information describing the file. So if it's tampered with you may know if you're inclined to look at the data about it. You can also do normal hashing tools too if you don't want all the extra information like SSHSUM or MD5. You can just pipe the hash into there, MD5D barcode. Then we get the hash and we store it in a file. So it's definitely stuff you need to keep for records and What's the forensic, we call it the chain of custody, I believe, is that correct? Okay, so we have a few other tools. TCP Slice is how you can slice pcaps into different sets, you can get the time and stuff, we're not gonna worry about that at the moment. We will use, if you wanna get a quick timestamp, Do we even have this on here?

Okay, let that run there for a second.

Okay, TCPDSTAT, so let's go to our— we'll come back to this. Go to our source directory, we're gonna compile some code. I got this offline, this is a cool tool. Okay, it's just a tar, it's not zipped or anything.

Let's extract it.

Okay, so we're going to go and enter this directory now.

Okay, so let's see here.

Got the Makefile, we can cat the Makefile. Looks pretty simple, so just type make install. It should fail. This is actually from the author's website. There is a bug in this, but I figured out a way to get it to compile. It's really simple. There's a few other GitHub repositories that actually— people have forked it and fixed it too, but I just tried this one day and it worked, so I'm satisfied.

Look for— so hold on, let me get you— up the speed here.

Okay, so we're in the directory. We want to vi or use another text editor on tcpdstat.h.

I believe it's h. Let me look for a specific variable. Packet length into that file.

Yeah, there it is. So that's the file we want. Okay, so line 415. We add -n to get the line number. So let's do vi +415. 415 tcpdstat, it puts us right here. We change this to static int, I believe is what I did in the past, change that line to static int, and then we compile. Yes, we got it installed now. So this is a statistics program that does statistics on PCAPs. A little more detailed than capinfo, so it actually looks at traffic rates and ranges and number of connections and stuff like that. So let's go back. TCP, it should be in the path.

Yes it is.

Okay, make installed, installed it in the correct directory in the path. So let's go to a MALPCAP directory and pick any one you'd like.

You can do, I'll just go back to the normal because they're working out for me.

And tcdstat, and if you look at the -h options, there's barely any options, so I'll just let it go do its thing by default. And we'll specify, let's just do the zoom one at the bottom. I use Tab to autocomplete, by the way. And here's some information, basic information. Takes a little bit to look at the output, I recommend doing that. But you got the start time, end time, seconds. Average bitrate, the protocol statistics, like here protocol breakdown gives you the total, looks like 100% of IP traffic, 100% TCP, so there's only TCP segments in this. We also have HTTP traffic, which is 50%, and the other 50% is, let's see, I actually don't know what that means.

Anybody has any idea, let me know. HTTP, actually, hold on, let me check this real quick. Um, uh, TCP, sorry, Zoom, let's do a filter, do port 80, port 430, there's no port port, so that's not secure, that's S1, okay.

But this is one tool I look at especially for the protocol breakdown.

It's very convenient.

We'll go on to another one. There's normally these little tools around the web. I haven't even touched on many of them yet. There's quite a few of them. TCPProf is a really interesting one. I believe it's included with TCPstat if you install that, but unfortunately on this older, much older version of Security Onion, it is not there. I was looking for it, I was disappointed, but here We specify a number of options, print the ports, no name resolution. I wish the man page would show those, I should explain these too. But we say -P, don't print statistics on ports greater than 30,000, 'cause if you do all of the ports and you have this run on big pcap files, it can take days and it drives me insane, so I try to cut it in half. So we won't do all the 65,536 total ports. And we read a file in pcap and it basically just pushes out information just like tcpdump but much more detailed. It gives you rates on where a specific host was talking and it gives you a percentage of how much of that traffic was in the pcap file from that particular host. So you can narrow down quickly on who your biggest talkers are. Okay, so here are more advanced filters on tcpdump. Here, these are just ones I just wrote up really quick so you guys can see an example use of combinations here. So here we use, we listen on the eth0 interface, no name resolution, no port resolution, and we specify we only want IP traffic, so no IPv6, and traffic between host 1.1 and 1.2, but not host 1.254.253, but of those of these two do grab traffic that address to port 80, 443, and 53. So common ports, DNS and HTTP and HTTPS. And if you don't want to, you'll need to use these, when you get in the ands and use the parentheses, you'll need to use the single quotes so that the shell interprets that as is, it comes back to tcpdump. However, if you don't, you can also use, you can escape the actual parentheses right here. You can use escape for each one, it depends on what you wanna do. If you wanna type that out, that's fine too, that does the same thing though. It makes these literal. So you gotta put an escape before each parentheses. Okay, next. Number space convert, or excuse me, number system conversions. Earlier we used printf for a little bit. Whenever you're looking at pcap files or you need to look for specific ASCII characters, it's best to use or get familiar with a tool called printf. It basically can convert between number systems and hexdump is useful to use too. Like whenever I did that tcpdump filter that grabbed the GET request earlier for the web traffic, I used, let's show you my process for that I suppose.

Let's just go back here. I guess I didn't wanna do that.

Echo, well echo GET, pipe that into hexdump. And here shows the hex value, so we have G-E-T, and 0A is the newline character. So when you press enter, you're actually putting a 0A in there. So what we'll do is, since we have the— in the GET method in the HTTP payload, it actually has a space. You need that spacer, so put a space and then end it with a parenthesis. And now we have the space there. So 47455420. I would take that, add that to my filter and do it with the whole hex thing, find out where the offset is. You can use my, those header, the TCP headers I included in here, the headers folder directory, and you can look at there and count, or you can go back to my slides, it was 32 bytes over and then 4 bytes G-E-T, each character being a byte in the space and then you'd find the data. And this, I mean, a lot of this you really won't need to know but it's good to know. You won't, actually take that back, you really won't need to use 'cause there are better tools but it's good to have a fundamental understanding of how everything goes on underneath. And this way when you're reversing or messing with trying to figure out maybe encoding mechanisms and stuff, you can use tools like this to try to figure out what's actually being pressed or what was actually being sent across the line.

Wire.

Okay, now let's get into session data. Iftop is a really cool tool.

I wish, let's see here, I guess I found that, I should have, crap.

That was there, hold on a second. I found that tcpslice program is in a different directory.

Let's do while 1.

Create a little loop here. Do ping -c 1 Google's DNS server, I suppose.

And let's do sleep 2 seconds. Done. Yeah, real lame. Okay. Hold on, am I connected?

Yes. No, I'm not.

I'm having problems. That was connected earlier. Let's see. Let that go for a second.

But there we can actually use iftop and it's gonna actually show session data flying across. This is really good for live traffic. If you're on a router, maybe not a Cisco router but like a Linux or BSD router or something, there's traffic right there. We can see communication coming back and forth. And you have a lot of traffic, it will get ugly. And you wanna turn off name resolution, so I press H, it gives you help, and top left-hand corner, toggle DNS resolution. So I press N, now they're not displaying the host names, which it has to make a request to the DNS server to get the host names, so that makes extra traffic. So, and if you look, wordofmouth.local is my host name, It's picking that up from my hosts file because typically in a Linux system the hosts file is read first depending on your host settings or your NS switch settings. But so here's this traffic going through, not very much at the moment.

Let's see if I'm—

okay, so we're sending traffic now. Now here's extra traffic I'm sending. So here we got a little graph here, and for each time— let's just change this to wget google.com. Here we go, right here, there it is. This is one of Google's IP addresses, most of us know it. They have this weird name you might find in your logs and wonder what it is. It's actually Google. But on a heavy traffic system, this is very useful. You can easily dig and find out what you want. You can also apply BPF filters, so I can do -f and port 80.

Actually, I'm gonna pull in filter code.

You gotta specify, in this one you have to specify the single quotes.

I only want port 80 traffic.

It applies a BPF filter to it. Google.com, there it is right there. So do that. You can also, one cool thing is you can do regular expressions. In the display mode. So no matter, all the packets will come in, but you can do regular expressions on what is displayed. So we can do L, I think it's set screen filter, if you wanted to, whoops, L grab 152.168.1.1.

Okay, sorry.

Okay, so if you wanted to use regular expressions, you can use a screen filter. So I'll do a scan, press L, and you can type in what you want. So you can, like, if you just want things with the numbers 80 in it, you should be able to, I do, hold on here.

So let's just do my IP address. Sorry, I haven't done this in a while.

The only big downside of iftop is the fact that you cannot read from a pcap file, which is a bummer. So what you do is you would take NetStiffNG or TCP Replay, another program like that, take a pcap file, read it in, push it out on one of your interfaces, and then have iftop listen on the interface in a different terminal. That way you can do live traffic of previously recorded traffic that you have. You can see it as if it were on your network at a certain period in time, as if it happened, which is really, really nice.

Let me just make a bunch of, uh, in there. Okay, so let's do this.

I have an article on SipMist and Network Labs on iftop that has examples of cool screen filters I've used.

So if you're interested in that, let's do—

here's one. That one worked. It took that one, so it's still showing my addresses. Looking for everything that had 172.16.

So we'll go on to the next one now, I'm trying to breeze through these guys.

It's quite a bit of material. Alright, so let's do, here's a hands-on one. I guess you could all be following along anyway, but this one I have an image pcap here, hold on. Let's do, let's take a look at one of these pcap files. If you guys are curious why I'm going back and forth like that, I'm using a program called Screen. It's a multiplexer, a terminal multiplexer, it's by the GNU project. So I can use control keys and switch back to multiple terminals.

Makes things much easier. Look at that find, I don't know if that was the window I ran it in or not. No, but I can fix this. Okay, so let's go into malpcap and we'll go into Open packet and I'm gonna do a flow. I take that back, let's do the diff.

Well, I think I have that gzipped, yep. Okay, so you can try these on any of your files. I'm just basically trying to pick one. I don't know what is in what, what data is in which file 'cause they're just a collection of online files I grabbed from online.

Websites.

Let's do TCP flow mode. TCP flow, we're going to read from— let's try this MySQL one.

Let's see if this has got any good information. No, it does not. Not for flow data.

We'll give it colored output though.

Okay, so let's go back.

Let's take my, here's what I'm gonna do, I got an idea.

Let's go to malpcap, actually no, DEF CON, cd, 'cause this has a ton of traffic. Everybody wanna unzip this, gzip -d to uncompress that, let that go for now, we'll come back to that.

Here's the TCP slice, so on this old version of security onion, it's in /usr/bin, tcpslice, I suppose that's not in the path.

/usr/bin/spin, yeah, it's not, huh? /usr/bin, I don't know why I couldn't complete it, it looks like it's there. Oh, there it is.

I wonder why that was. Okay, well anyways, we have tcpslice now. We can use -r, and this is more statistics, you can just get the quick start and stop times.

I'm sorry, where am I at, traf-workshop, Go back to the home folder, let's do a maliciouspcap and Milworm will be fine. I think it was, yes, let's do barcode again. Barcode active.

And here, this is just a quick way to show you start and stop times for the pcap capture file if you don't want to look through capinfos. Okay, so on the next few things, let's go ahead and do the forensics.

I'm not sure how I'm doing on time.

There were forensics, file extraction. So I have a file, here's one of the ones I was prepared for.

Let's do the extract, if you go to the extract directory there's an image.pcap.

And I just basically did a wget across the internet and grabbed this file right here, just whatever I quickly Googled for, BSD daemon image. And then we can use a number of tools. First we're gonna use tcpflow and then we're gonna run a file carver on it called foremost.

So let's just run tcpflow on it, get back to my right window, tcpflow -r image.qpcap.

Okay, ran it. It gives me two flows, client and server direction, back and forth. So here's the client, here's the server, the reply. So we're gonna run foremost, and we see here we specify -v for verbose, and we give it two files. The reason we need to do this is we need to break up these files into streams. That's what these are now. TPCFlow breaks things into flows or streams or sessions, however you wanna look at it. There's different terms for sort of the same thing. Because if you run this on a big pcap, foremost on everything, you don't break up the streams, the problem is foremost looks for specific things in the header called an MZ header or an MZ character code set. They basically specify the file type like PDF or HTML or JPEG, they each have their own MZ code that specifies the file, what type it's gonna be. So foremost looks for these, looks at the start, say it's usually a hex character or a few hex digits, say 4 bytes for one of them, and then it'll look for the ending one. And then it takes those and pulls them out. And if you have a big pcap file, it's gonna get confused on which, where's the start and the stop, and it's gonna overwrite some of them. It might start here, skip the stop, and end up over here. So by breaking them into flows, the actual files from each stream. So foremost -v 192.168.1.28. Okay, here we go, it ran. It gave me some verbose information. It created a directory called output and an audit file which is basically just displayed above in the output. It just writes this, gives you a record. What you can then do is go to JPEG 'cause it found a JPEG file. Qview001 and we should get the BSD picture.

Yay!

Alright, so here's our first forensic extraction. But this is useful for executables. There is a problem, I believe, there's some hardship when it comes to extracting a PE32 executable. So now you can extract, I don't think Foremos does MP3s but you can add that in there. There are a number of other tools. Another one would be TCP Extract, which basically is a file, hold on, maybe it's TCPX, yes, that is it. This is a file just for that, so you wouldn't need to actually break it into flows and then you wouldn't need to use Formort. So you can just run TCP Extract on the file and it will do the same thing. And this is tunable, they have a configuration file you can specify. You can add your own headers in there by looking, go on the internet, look for MZ header and you get a file format list of thousands of different file types and you can add them in there. So what you would like to do maybe later, you could take this and run this on those exploit pcaps. You might find some exploit, some code, some .c files or some bad binaries in there and you may be able to extract those. So we're done with that.

Let's go to the next one here.

I have the example here. If you guys wanna do it right off the bat, just specify the pcap file and the out where you wanna put it, 'cause it generates a lot of files. I'd recommend creating your own directory, make dir and then test or wherever you want, just put the output in there.

Okay, so we'll come back to some of these. Let's see here.

Okay, that's done, that's done. Let's do, let's see if we get anything out of here. I haven't actually looked through any of these, just so you know.

It's gonna be a while. Let's do, I want some color. There we go.

So here you're actually getting flow data now. You can see a bunch of ASCII art back there that's flowing across the screen. So some probably C file where a guy put their logo in there. So you can look through flows like that. You can also specify if you only want port 80 flows, just web traffic, what people have done. What's really cool to do is look at FTP connections. Let's try another tool real quick though. TCPdump, TCPpick is another one.

-c -r ctf.

And we can get this to, this is better color output in my opinion, that's why I like using this one. And there's more options. -y -p will print the data to the screen, the session data. We're not getting anything right now. There we go, there's some of it. I just saw some ASCII art in there. You can go through flow data like that and you can filter on what you need.

480. That wasn't filtered right though. Looks like you can just specify the filter at the end.

So you can try to play with those, just specify the filter at the end, give it the, the single quote and the filter and then the single quote. Okay, so let's try ntop. I probably should test this one before it came, but like I said before, I haven't really had a whole lot of time. I'm behind. I wanted to have a whole environment set up for this, but I wasn't able to get it to work and other activities I'm involved in. Let's do ntop. This is a really quite lengthy ntop configuration. We won't worry about that, we can just do something basic.

Should be able to— ntop, let's see what I got in here.

Something simple as this. This says read the pcap file, specify the port for ntop to listen on. It's gonna open a web interface, which is very useful. And then we're gonna use an SSL port, HTTPS on 443.

So let's Let's try to do that DEFCON one. ntop -r ctf -w 80.

ntop is a tool that can be demonized, you can run it in the background.

Let's see here. Nope, wrong argument. Whoops. So let's read from a file.

Here it is, -f. That's my mistake.

So you can change that if you'd like. Canton -f ctf-wa-3. There we go. Except I had an error here. Okay, let's do, um, Let's just put something in there and see if that'll work. Otherwise, I'll move on to the next one.

Oop, oop, uh, okay, it's working now.

Hold on, I'll explain this thing. And top, and down, let's see here. Getting a little bit farther. So let's do— well, I apologize.

I wasn't expecting this many demos to break, to not work.

Normally I don't have any problem with that.

But then again, I'm using— I just booted up, I installed that old version of SecureYN just so I had something to work with. SSL binding problem, there it is. Okay, so it looks like there's probably something already using that port. I hope that's it anyway. I hope that's one of the things.

Let's do, uh, specify a number that's probably not used. And 1001. Oh, yay.

Alright, so now we can open our web browser.

And do— close up Chromium.

And this will be reading in the background. This file is rather large, so it probably won't— it might take some time to read it all.

Let's do 1,000 for now. There we go.

So here we go. Here's ntop. And here, if you refresh, this will refresh periodically. There's a set time for it. I think it's 60 seconds or 5 minutes, one of the two. Total received packets so far, Total packets processed, it gives you length information, bytes, pie graphs of just about everything, percentage of network traffic, here's protocol percentages. See, this is 96% odd traffic, so you know that's not good, or most likely not good. And you got a number of cool Settings here, we can go to, let's do the hosts. It actually shows the hosts that you have communicated with and then the direction of the bandwidth, ingress and egress. You can see, so the green is the sent, the purple has been the received on the host. You can see who's most traffic hogs on there too. So that's just a quick introduction to ntop. You got a bunch of other things, you got some plugins so you can watch ICMP echo requests and other information like timestamps and other stuff. So if you want to monitor that, there's all— ntop has the ability to log suspicious traffic you can set up. I think I have that information in one of my files on how to do that. If not, I'll put it, uh, something on the website.

Okay, so we're done with that one. Phil, how am I doing on time? Should I—

'cause I got a lot of stuff.

I get a little confused when I have so many terminals open. Don't worry, I got it all recorded. I'm gonna insert some slides of Lemon Party and so forth.

All right, yeah, yeah. We should have PCAPs of Lemon Party images.

That's what I should have done.

Maybe next year. Okay, so let's go back down here. Let's touch on Argus. Argus is pretty cool. I haven't really done a whole lot with Argus, I've just begun, but I kind of regret not seeing this sooner. It is an excellent tool for recording network data. And since it writes it all to the screen, standard out, you can bust out any of your normal Unix command line tools. And all of the big guys that do network monitoring and all that, I believe, use Argus. 'cause it's so versatile. It stands for the Audit Record Generation Utilization System. It's written by guys that do this network monitoring stuff all the time. So what we're gonna do is we're gonna take a pcap. In this case, all this stuff is offline traffic. Or most of the notes anyway. You can have Argus listen on the interface, listen on the, and then all the traffic comes in, it'll actually write it to its own Argus format. Let's do a mal pcap. Let's do Openpcap.org, let's do Argus, let's read a file, let's just read the Zeus one, 3, and we'll write it to Zeus.argus. Okay, so it's gonna take it in, it's gonna put it in the Argus file format. Let's just do Zeus.argus, see what it looks like. It says it's a DB3 data file, some sort of database. Then we use a tool called ra, and just like nmap, or excuse me, just like TCPDump, we specify --nr for no name resolution, no port resolution, and read. And we'd read that Argus file that we had just written. And we get flows. So if you have recorded data, one thing I do in my environment is when system load is low and not let's say at midnight or 1 AM, I actually have scripts in the background that take all my daily pcap files and convert them to Argus format so we can archive them all and then I don't have to do that later. It's quick, I have them all ready to go. So I just have the script running in the background, say a cron job and have it just run the Argus and on the name of the pcap file and have it all automated. I got some of my scripts in the scripts directory also in the TRAP workshop that I use. So here we go, we have Argus and we can also pass the filters. It has its own filtering language. You specify a, let's do ra -nr and let's, this zoo stuff looks like, looks like it uses, let's see here, I'm missing on the side of the screen, okay, so this is port 80 right here, we see that the destination, this is the flow going this way. Argus does bidirectional flows, by the way, there's also flows that show you both directions. We can do that file that we just created, the Zeus botnet file sample, excuse me, Zeus.argus, specify this dash, it indicates that a filter's coming next, and then we can just do your normal tcpdump port filtering and there you go. So I suppose if you want, I don't know what other type of information's in this file, so there's that. See port 443 was not there, so this is the way you can do filtering just like BPF type filtering in Argus, excuse me, with RA. The Argus tools, RA stands for Read Argus just in case you needed to know and there's a bunch of them, I mean a bunch. Most of these are Argus tools. Not the Rarion stuff, but you have, let's see here, all these, ra-sort, ra-split, ra-stream, ra-strip, ra-top, top-like program for network monitoring, a number of them, there's quite a few more. ra-graph is especially cool, you can actually make graphs of your traffic, so let's try this real quick.

ra-graph, I don't know if I have to, let's see here, Hold on, let me go back to my notes, make sure I got everything right here.

Let's do a few more first. If you want to specify with ra the -z option and -b, it'll actually print out the bit set in the 13th byte of the TCP header, which is your code field, so your SYN, ACK, PUSH, FIN, URGE, stuff like that. They're all there, so we can do ra -nnr Let's grab that Zeus file again, Argus -z -b, and let's see here, start the terminal.

Should be able to ed.

These over here indicate Ethernet. One thing I'll have to do, I'll come back in just a second, RA.

I think it's just FLGS flags. Okay, so I want the flags here, FLGS capital, hold on.

There is a, I wish I remembered the parameter, but they have all of them in here. It will indicate, these are all things you can search for. You can detect packet loss in your network as well. There's an option for that. You can find how many packets were lost over a single stream.

I thought that was it, but let's give it just a second. Oh, that's a bummer. Okay, so, man, let's try Argus. It's in one of these, unless I, uh, I They don't have that anymore. Yeah, okay, never mind.

Well, anyways, you can look through the man, there's just so many options here.

Let's go back to— let's try this again. Set of specifies over here.

Okay, here we go. Sorry, I guess you have to specify before So if you put the option -zB before it prints them. So here's the actual flags that were set, a SYN, a PUSH, and ACK, and on the receive side over here on the other side it has a SYN, ACK from the client, and then the FIN ACK from the server, so you can get both sides of the connection.

Bill, you can kill me anytime, by the way.

I'm going way over, I think. Yeah, if you guys are ready to move on, there's a lot yet. Okay, just let me know. Not a big deal. Okay, so I recommend playing with all these, especially with the RGraph. They can be really useful, especially if you want, like for just regular networking, if you wanted to make a graph of a pcap that looks for packet loss retransmissions, you can do that and you can find out which hosts may have flaky network cables or which switch or which host may have bad NICs and you can graph that, which is really neat. Something I'm gonna try to implement and have it all automated at one point. But let me go ahead and kill out of these. I'm gonna show you some scripts real quick that I've been working on.

Let's do, I hear this user agent script here.

If you use the Bro IDS, I got some Bro examples in the file. I grabbed yesterday's Bro logs, which is an awesome IDS, it's great. And I use awk and stuff to grab ugly user agent strings and remove the ones that are common like Mozilla and ClamWin or software update from Apple server or something like that. You can use this for quickly detecting malware or spyware. I recommend making a file with a list of bad user agent strings. You can find a list on the internet if you just Google for it. I found one that had 1,000 entries in it. You can script that in there and and tell it to exclude those entries. So there's a number of things you can do. You can play with this a little bit.

I got— okay, save scripts.

IFPPS, here's how I write things, those IFPPS logs that this earlier I was showing you how you can You can output to CSV. Here's where I use that --csv and I do intervals depending on how much traffic a specific interface takes in. So here I got a number of different interfaces and I have a script that runs in the background that pulls these and looks for gaps in time where packets were not received that may indicate that an interface went down or a link went down. Then I can see that when my IDS Hey, I stopped receiving packets at 7:30 at night when I'm at home, and it comes and emails me so I can see if there's going to be any link problems with an IDS system. I got a few other things. Remember these you can look through.

Let's see what this is. FPPS.

Yeah, here's that same script. This does the emailing. You can use this at work if you want or for your own time. You can send an email and it does all that. NetSniffNG, this is how I'm using, running 5 instances of NetSniffNG. Took one out, which is my management interface, but you can bind it to a specific CPU, get better performance. I write logs to the files, or logs to specific NetSniffNG files that I create, 'cause they don't have a logging mechanism right now. Here's the one I really wanna show you, this pcap-postscript. This, you can suit this to your needs. It actually takes PCAP files, I run them daily and then I go through them and I cut off the link, I change the names to something that is not a Unix timestamp, which is ugly to read. So it puts like the date and then it puts the, if it's a Tuesday or Wednesday, the day and then it runs it through a bunch of utilities like Argus. You can see here's where I do my Argus conversions. I specify time, I program the write, how long it takes because I'm I'm trying to get performance and whether I should run them in parallel in different subshells. I run the tcpdstat output on these, tcpprof, all the capinfos like I mentioned. So all that stuff right there, right there, right there, right there. And then come back to it and I set permissions, immutable bits in the ext4 file systems and stuff like that. And this just runs in the background and does this daily. Keep an archive of it offsite. I have it all ready to go. That's quite a bit here, so if you ever want to look around. I think I'm going to wrap it up now. Should be plenty to play with. If you guys want to have any questions, you come see me. I'm more than willing to talk you through it. You can ask me more detailed questions on things I didn't explain very well and all that, so.

Alright, thank you.