One of the problems that people have is logging the origin of the attack streams and tracing packet paths through the networks. Here is a small bit of code that may help you inexpensively deploy some packet loggers at key network ingress/egress points. The real solution is to get Dragon or NFR or some other really kick ass IDS sensor stuff. But for those ISPs on a budget, that just want to build a quick and dirty forensic logger to track down or follow the path to the origin of attacks, here is a Linux kernel patch that turns any Linux system into an ethernet logger that records mac address, ip address, ports and protocols with a timestamp in the system log. It can be activated and deactivated at the system console with two keystrokes, see build instructions below. It's from a tool set of an article I was working on, but it seemed relevant so I'll release it in advance. It started life as a project to build a sniffer small enough to type from memory. It's simple enough that you should be able to tweak the output format to suit your own tastes. It is intended to be small and light so as to lose as few packets as possible. One nice application is to build a very stripped down Linux system and turn it on to log packets using a simple low cost pc or rack server. Depending on your traffic rate and your disk size you may be able to store a pretty good time window of traffic. If it's not enough... time for a commercial product with fancy data structures and compression. :-) We'll be covering stuff like this during our training at CanSecWest (plug, plug :-). P.S. I have a message for all the silly bad ass ddos bozos: If this is for fun... you'll probably have less fun in the long run by being detrimental to others. comments, feedback, enhancements welcome... --dr kyx.net Learn Kanga-Foo - www.dursec.com this is a patch for /usr/src/linux/net/ethernet/eth.c: --kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx-- *************** *** 182,196 **** --- 184,295 ---- unsigned char *rawp; skb->mac.raw=skb->data; + + /*Linux Kernel Forensic Logger --dr@dursec.com*/ + eth = skb->mac.ethernet; + if( *((u16*)((u8*)skb->data+12)) == 0x0608 ) + { + printk(">>ARP<< "); + if(*((u16*)((u8*)skb->data+20)) == 0x0100) + printk("req "); + else if(*((u16*)((u8*)skb->data+20)) == 0x0200) + printk("REP"); + printk("T:%03d.%03d.%03d.%03d:%02x%02x%02x%02x%02x%02x S:%03d.%03d.%03d.%03d:%02x%02x%02x%02x%02x%02x\n", + *((u8*)skb->data+38), *((u8*)skb->data+39), *((u8*)skb->data+40), + *((u8*)skb->data+41), *((u8*)skb->data+32), *((u8*)skb->data+33), + *((u8*)skb->data+34), *((u8*)skb->data+35), *((u8*)skb->data+36), + *((u8*)skb->data+37), *((u8*)skb->data+28), *((u8*)skb->data+29), + *((u8*)skb->data+30), *((u8*)skb->data+31), *((u8*)skb->data+22), + *((u8*)skb->data+23), *((u8*)skb->data+24), *((u8*)skb->data+25), + *((u8*)skb->data+26), *((u8*)skb->data+27)); + } + else if( *((u16*)((u8*)skb->data+12)) == 0x0008 ) + { + printk(">>IP<< "); + switch(*((u8*)skb->data+23)) + { + case 1: printk("ICMP%d ", ((u8*)skb->data+34)); + break; + case 2: printk("IGMP "); + break; + case 0x11: printk("UDP "); + } + if (*((u16*)((u8*)skb->data+34)) == 0x4300 || + *((u16*)((u8*)skb->data+36)) == 0x4400) + { + printk("DHCP "); + if(*((u8*)skb->data+42) == 1) + printk("req "); + else if(*((u8*)skb->data+42) == 2) + printk("REP "); + else printk("invalid "); + } + else if(*((u16*)((u8*)skb->data+34)) == 0x3500 || + *((u16*)((u8*)skb->data+36)) == 0x3500) + printk("DNS "); + printk("s:%03d.%03d.%03d.%03d:%d d:%03d.%03d.%03d.%03d:%d %d bytes hl:%02x iplen:%04x ttl:%u\n", + *((u8*)skb->data+30), *((u8*)skb->data+31), *((u8*)skb->data+32), + *((u8*)skb->data+33), *((u8*)skb->data+37) + (*((u8*)skb->data+36) << 8), + *((u8*)skb->data+26), *((u8*)skb->data+27), *((u8*)skb->data+28), + *((u8*)skb->data+29), *((u8*)skb->data+35) + (*((u8*)skb->data+34) << 8), + skb->len, *((u8*)skb->data+14), *((u8*)skb->data+17) + (*((u8*)skb->data+16) << 8), + *((u8*)skb->data+22)); + } + if(*eth->h_dest&1) + printk("BCAST-ETH "); + if (*(unsigned short *)((u8*)skb->data+12) == 0xFFFF) + printk("IPX "); + printk("-- MAC:"); + for(rawp = skb->mac.raw; rawp - skb->mac.raw < 12; rawp++) + { + printk("%02x",((u8*)eth->h_source)[rawp - skb->mac.raw]); + if (rawp - skb->mac.raw == 5) printk(":"); + } + printk("\n"); + /*eoklog --dr*/ skb_pull(skb,dev->hard_header_len); eth= skb->mac.ethernet; --kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx-- Klog INSTRUCTIONS: To use this logger, patch /usr/src/linux/net/ethernet/eth.c, and rebuild your kernel. (It's recommended that you enable the Magic SysRq key code.) It's been used under lots of different kernel versions with success.... How to use it: -This patch makes the kernel log all ethernet packets to syslog. -The logging happens at the default level. I.e. normally on. -You can turn logging on and off at the console by using the Magic SysRq key and a number to change the logging level. -Put the interface into promiscuous mode: ifconfig eth0 promisc Notes: -It makes a neat hotkey sniffer when using the text console too. -It seems to run pretty fast. Any benchmark data welcome(-->dr@dursec.com). -try a tail -f /var/log/messages for real time display cheers, --dr -- dursec.com / kyx.net - we're from the future http://www.dursec.com learn kanga-foo from security experts: CanSecWest - April 19-21 Vancouver Speakers: Ron Gula/NSW, Ken Williams/E&Y, Marty Roesch/Hiverworld, Fyodor/insecure.org, RainForestPuppy/wiretrip.net, Theo de Raadt/OpenBSD, Max Vision/whitehats.com