@RISK Online - The Security Blog

Web Hosting by Netfirms | Free Domain Names by Netfirms

Introduction

Thursday, April 14, 2005

iptraffic is an attempt to learn more about network protocols, PERL, and MySQL database by integrating the three components into a useful tool. My goal is to develop a sniffer written entirely in PERL and capture the network traffic into a MySQL database. This will be used to develop network statistics such as protocol distributions and bandwidth utilization. Once that goal has been realized, this tool will be used as a foundation for a statistical anomaly detection engine. I have a phased approach to this overall project

• Phase 1: Write a PERL sniffer that can identify and decode as many network protocols as I can put together. PERL has packages to decode Ethernet, IP, TCP, UDP, ARP, and STP. Phase I will incorporate those protocols.
• Phase 2: Take resulting traffic as its sniffed and parse it into a normalized database schema. I've come up with a schema based on the field information provided for each protocol. This is being enhanced as I write more decodes and figure out how to link the various tables together for tracking purposes. Options will exist to send output to Screen, File, and Database.
• Phase 3: Perform analysis of traffic to produce a table of hosts with their provided services. As the table is developed, hosts would be manually verified, and the host/service pairs would then be flagged as "validated". This is a precursor step to developing an Anomaly Detection database. New host/service pairs would be flagged as "anomalies" to be validated. This could provide some level of protection against 0-day exploits.
• Phase 4: Perform analysis of traffic to determine traffic flow across subnets. The goal is to be able to get a high level understanding of traffic patterns to aid the development of network ACLs.
• Phase 5: To Be Determined...

Following pages include instrutions for your initial setup as well as a basic database schema, and a historical change log.

Please bear in mind, this is a learning project. The code is VERY basic. I'm certain there are better, and more efficient ways of accomplishing the work I'm doing. For that reason, I welcome your comments and feedback. If you have a way to improve the performance; if you see a mistake or flaw in my logic or coding, please contact me and let me know. My goal here is to learn.

Navigation:

My Blogroll:

Security Advisories:

Defacements Archive:

Security News:

Security Tools: