exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

linux.klog.txt

linux.klog.txt
Posted Feb 16, 2000
Authored by DR | Site dursec.com

Patch for the linux kernel which may help you inexpensively deploy some packet loggers at key network ingress/egress points. Turns any Linux system into an ethernet logger that records mac address, ip address, ports and protocols with a timestamp in the system log. It can be activated and deactivated at the system console with two keystrokes.

tags | kernel, protocol
systems | linux
SHA-256 | 941e0430d31390218454a4478623add922e76b9be7480ef8469d052c6ade5af6

linux.klog.txt

Change Mirror Download
One of the problems that people have is logging the origin of the attack
streams and tracing packet paths through the networks. Here is a small bit of
code that may help you inexpensively deploy some packet loggers at key
network ingress/egress points. The real solution is to get Dragon or NFR or some
other really kick ass IDS sensor stuff. But for those ISPs on a budget, that
just want to build a quick and dirty forensic logger to track down or follow the
path to the origin of attacks, here is a Linux kernel patch that turns any Linux
system into an ethernet logger that records mac address, ip address, ports and
protocols with a timestamp in the system log.

It can be activated and deactivated at the system console with
two keystrokes, see build instructions below. It's from a tool set of an
article I was working on, but it seemed relevant so I'll release it in
advance. It started life as a project to build a sniffer small enough to
type from memory. It's simple enough that you should be able to tweak
the output format to suit your own tastes. It is intended to be small
and light so as to lose as few packets as possible.

One nice application is to build a very stripped down Linux system
and turn it on to log packets using a simple low cost pc or rack server.
Depending on your traffic rate and your disk size you may be able to store a
pretty good time window of traffic. If it's not enough... time for a commercial
product with fancy data structures and compression. :-) We'll be covering
stuff like this during our training at CanSecWest (plug, plug :-).

P.S. I have a message for all the silly bad ass ddos bozos:
If this is for fun... you'll probably have less fun in the
long run by being detrimental to others.

comments, feedback, enhancements welcome...
--dr
kyx.net

Learn Kanga-Foo - www.dursec.com

this is a patch for /usr/src/linux/net/ethernet/eth.c:
--kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx--

***************
*** 182,196 ****
--- 184,295 ----
unsigned char *rawp;

skb->mac.raw=skb->data;
+
+ /*Linux Kernel Forensic Logger --dr@dursec.com*/
+ eth = skb->mac.ethernet;
+ if( *((u16*)((u8*)skb->data+12)) == 0x0608 )
+ {
+ printk(">>ARP<< ");
+ if(*((u16*)((u8*)skb->data+20)) == 0x0100)
+ printk("req ");
+ else if(*((u16*)((u8*)skb->data+20)) == 0x0200)
+ printk("REP");
+ printk("T:%03d.%03d.%03d.%03d:%02x%02x%02x%02x%02x%02x S:%03d.%03d.%03d.%03d:%02x%02x%02x%02x%02x%02x\n",
+ *((u8*)skb->data+38), *((u8*)skb->data+39), *((u8*)skb->data+40),
+ *((u8*)skb->data+41), *((u8*)skb->data+32), *((u8*)skb->data+33),
+ *((u8*)skb->data+34), *((u8*)skb->data+35), *((u8*)skb->data+36),
+ *((u8*)skb->data+37), *((u8*)skb->data+28), *((u8*)skb->data+29),
+ *((u8*)skb->data+30), *((u8*)skb->data+31), *((u8*)skb->data+22),
+ *((u8*)skb->data+23), *((u8*)skb->data+24), *((u8*)skb->data+25),
+ *((u8*)skb->data+26), *((u8*)skb->data+27));
+ }
+ else if( *((u16*)((u8*)skb->data+12)) == 0x0008 )
+ {
+ printk(">>IP<< ");
+ switch(*((u8*)skb->data+23))
+ {
+ case 1: printk("ICMP%d ", ((u8*)skb->data+34));
+ break;
+ case 2: printk("IGMP ");
+ break;
+ case 0x11: printk("UDP ");
+ }
+ if (*((u16*)((u8*)skb->data+34)) == 0x4300 ||
+ *((u16*)((u8*)skb->data+36)) == 0x4400)
+ {
+ printk("DHCP ");
+ if(*((u8*)skb->data+42) == 1)
+ printk("req ");
+ else if(*((u8*)skb->data+42) == 2)
+ printk("REP ");
+ else printk("invalid ");
+ }
+ else if(*((u16*)((u8*)skb->data+34)) == 0x3500 ||
+ *((u16*)((u8*)skb->data+36)) == 0x3500)
+ printk("DNS ");
+ printk("s:%03d.%03d.%03d.%03d:%d d:%03d.%03d.%03d.%03d:%d %d bytes hl:%02x iplen:%04x ttl:%u\n",
+ *((u8*)skb->data+30), *((u8*)skb->data+31), *((u8*)skb->data+32),
+ *((u8*)skb->data+33), *((u8*)skb->data+37) + (*((u8*)skb->data+36) << 8),
+ *((u8*)skb->data+26), *((u8*)skb->data+27), *((u8*)skb->data+28),
+ *((u8*)skb->data+29), *((u8*)skb->data+35) + (*((u8*)skb->data+34) << 8),
+ skb->len, *((u8*)skb->data+14), *((u8*)skb->data+17) + (*((u8*)skb->data+16) << 8),
+ *((u8*)skb->data+22));
+ }
+ if(*eth->h_dest&1)
+ printk("BCAST-ETH ");
+ if (*(unsigned short *)((u8*)skb->data+12) == 0xFFFF)
+ printk("IPX ");
+ printk("-- MAC:");
+ for(rawp = skb->mac.raw; rawp - skb->mac.raw < 12; rawp++)
+ {
+ printk("%02x",((u8*)eth->h_source)[rawp - skb->mac.raw]);
+ if (rawp - skb->mac.raw == 5) printk(":");
+ }
+ printk("\n");
+ /*eoklog --dr*/
skb_pull(skb,dev->hard_header_len);
eth= skb->mac.ethernet;
--kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx--

Klog INSTRUCTIONS:

To use this logger, patch /usr/src/linux/net/ethernet/eth.c, and rebuild your
kernel. (It's recommended that you enable the Magic SysRq key code.)
It's been used under lots of different kernel versions with success....

How to use it:
-This patch makes the kernel log all ethernet packets to syslog.
-The logging happens at the default level. I.e. normally on.
-You can turn logging on and off at the console by using the Magic SysRq key
and a number to change the logging level.
-Put the interface into promiscuous mode: ifconfig eth0 promisc

Notes:
-It makes a neat hotkey sniffer when using the text console too.
-It seems to run pretty fast. Any benchmark data welcome(-->dr@dursec.com).
-try a tail -f /var/log/messages for real time display

cheers,
--dr

--
dursec.com / kyx.net - we're from the future http://www.dursec.com
learn kanga-foo from security experts: CanSecWest - April 19-21 Vancouver

Speakers: Ron Gula/NSW, Ken Williams/E&Y, Marty Roesch/Hiverworld, Fyodor/insecure.org,
RainForestPuppy/wiretrip.net, Theo de Raadt/OpenBSD, Max Vision/whitehats.com


Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    16 Files
  • 10
    Sep 10th
    38 Files
  • 11
    Sep 11th
    21 Files
  • 12
    Sep 12th
    40 Files
  • 13
    Sep 13th
    18 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close