1/3/2024 0 Comments Filedrop linuxĭeploying a script to process files on arrival And remember, this solution will only process files with a. Therefore the user which we will call pcap must be set up in the following way which will allow us to sftp files files remotely to the /home/pcap/filedrop directory: groupadd sftpsecureįor Wireshark packet captures, make sure you save the file type as a ‘Modified tcpdump’ for Snort to understand it. This means that the user can only write or upload to a subfolder of their own home folder. One thing you will need to know about this setup is that the root user requires to own the users home folder. The above tells sshd to lock down all members of the group ‘ sftpsecure’ such that the users cannot redirect ports upon connection and are chrooted to their home directories. All I have done is added the following configuration right at the end of /etc/ssh/sshd_config as follows: Subsystem sftp internal-sftp This is relatively straight forward and is here for optional added security. This way all I have to do is remember to sftp my pcaps to the dropoff location, which I can do via any sftp client location. So I came up with the idea of setting up a secure FTP file drop off point on the snort box, and using a script which automatically checks to see if a PCAP file has arrived every 10 seconds, and then processes the file if the script is not already busy processing another PCAP you sent it previously. After all, what average system administrator is going to spend all this time transferring pcap files around and manually running snort commands on them? The function is still great however. Fantastic functionality right? But I needed a way to make this functionality easy to use. The above command will read the file traffic.pcap and process it though all of your snort rules according to your snort_nf file. An example of the snort syntax used to process PCAP files is as follows: # snort -c snort_nf –r traffic.pcap For this I would recommend creating a new nf file specifically for PCAP file reads. One of the features of the Snort command line has is its ability to not only sniff from the wire, but you can also tell it to read a pcap file and process it according to the rules in your nf file. Recently I have gotten heavily involved in a project where we are testing the capabilities of several different IDS sensors and methods of packet capture. Wireshark does not have the ability to identify suspicious traffic patterns by cross referencing traffic to an anomaly signature database such as Snort. Wireshark is great for looking at source and destination traffic, ports, and handshake information. After the traffic has been captured to a pcap, I usually transfer it across to my workstation, and load it straight into Wireshark for analysis. The above command will dump all traffic from eth0 to a file in pcap format called traffic.pcap by using the –w switch. Within linux I usually always use the following basic command syntax to execute a packet dump whilst the traffic in question traverses the interface: # tcpdump –i eth0 –w traffic.pcap I can’t remember the amount of times I have been involved in troubleshooting a connection from A to B and performed a packet capture to see what is happening with the traffic. Both will do complete packet captures with the ability to save to. Wireshark and TCPdump are tools which are used widely for a variety of different purposes.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |