1062 lines
28 KiB
Perl
1062 lines
28 KiB
Perl
#!/usr/bin/perl -wT
|
|
#
|
|
# Author: Jefferson Ogata (JO317) <jogata@pobox.com>
|
|
# Date: 2000/04/22
|
|
# Version: 0.10
|
|
#
|
|
# Please feel free to use or redistribute this program if you find it useful.
|
|
# If you have suggestions, or even better, bits of new code, send them to me
|
|
# and I will add them when I have time. The current version of this script
|
|
# can always be found at the URL:
|
|
#
|
|
# http://www.antibozo.net/ogata/webtools/plog.pl
|
|
# http://pobox.com/~ogata/webtools/plog.txt
|
|
#
|
|
# Parse ipmon output into a coherent form. This program only handles the
|
|
# lines regarding filter actions. It does not parse nat and state lines.
|
|
#
|
|
# Present lines from ipmon to this program on standard input.
|
|
#
|
|
# EXAMPLES
|
|
#
|
|
# plog -AF block,log < /var/log/ipf
|
|
#
|
|
# Generate source and destination reports of all packets logged with
|
|
# block or log actions, and report TCP flags and keep state actions.
|
|
#
|
|
# plog -S -s ./services www.example.com < /var/log/ipf
|
|
#
|
|
# Generate a source report of traffic to or from www.example.com using
|
|
# the additional services defined in ./services.
|
|
#
|
|
# plog -nSA block < /var/log/ipf
|
|
#
|
|
# Generate a source report of all blocked packets with no hostname
|
|
# lookups. This is handy for an initial pass to identify portscans or
|
|
# other aggressive traffic.
|
|
#
|
|
# plog -SFp 192.168.0.0/24 www.example.com/24 < /var/log/ipf
|
|
#
|
|
# Generate a source report of all packets whose source or destination
|
|
# address is either in 192.168.0.0/24 or an address associated with
|
|
# the host www.example.com, report packet flags and perform paranoid
|
|
# hostname lookups. This is a handy usage for examining traffic more
|
|
# closely after identifying a potential attack.
|
|
#
|
|
# TODO
|
|
#
|
|
# - Handle output from ipmon -v.
|
|
# - Handle timestamps from other locales. Anyone with a timestamp problem
|
|
# please email me the format of your timestamps.
|
|
# - It looks as though short TCP or UDP packets will break things, but I
|
|
# haven't seen any yet.
|
|
#
|
|
# CHANGES
|
|
#
|
|
# 2000/04/22 (0.10):
|
|
# - Restructured host name and address caches. Hosts are now cached using
|
|
# packed addresses as keys. Conversion to IPv6 should be simple now.
|
|
# - Added paranoid hostname lookups.
|
|
# - Added netmask qualifications for address arguments.
|
|
# - Tweaked usage info.
|
|
# 2000/04/20:
|
|
# - Added parsing and tracking of TCP and state flags.
|
|
# 2000/04/12 (0.9):
|
|
# - Wasn't handling underscore in hostname,servicename fields; these may be
|
|
# logged using ipmon -n. Observation by <ark@eltex.ru>.
|
|
# - Hadn't properly attributed observation and fix for repetition counter in
|
|
# 0.8 change log. Added John Ladwig to attribution. Thanks, John.
|
|
#
|
|
# 2000/04/10 (0.8):
|
|
# - Service names can also have hyphens, dummy. I wasn't allowing these
|
|
# either. Observation and fix thanks to Taso N. Devetzis
|
|
# <devetzis@snet.net>.
|
|
# - IP Filter now logs a repetition counter. Observation and fixes (changed
|
|
# slightly) from Andy Kreiling <Andy@ntcs-inc.com> and John Ladwig
|
|
# <jladwig@nts.umn.edu>.
|
|
# - Added fix to handle new Solaris log format, e.g.:
|
|
# Nov 30 04:49:37 raoul ipmon[121]: [ID 702911 local0.warning] 04:49:36.420541 hme0 @0:34 b 205.152.16.6,58596 -> 204.60.220.24,113 PR tcp len 20 44
|
|
# Fix thanks to Taso N. Devetzis <devetzis@SNET.Net>.
|
|
# - Added services map option.
|
|
# - Added options for generating only source/destination tables.
|
|
# - Added verbosity option.
|
|
# - Added option for reporting traffic for specific hosts.
|
|
# - Added some more ICMP unreachable codes, and made code and type names
|
|
# match the ones in IP Filter parse.c.
|
|
# - Condensed output format somewhat.
|
|
# - Various minor improvements, perhaps slight speed improvements.
|
|
# - Documented new options in usage() and tried to improve wording.
|
|
#
|
|
# 1999/08/02 (0.7):
|
|
# - Hostnames can have hyphens, dummy. I wasn't allowing them in the syslog
|
|
# line. Fix from Antoine Verheijen <antoine.verheijen@ualberta.ca>.
|
|
#
|
|
# 1999/05/05 (0.6):
|
|
# - IRIX syslog prefixes the hostname with a severity code. Handle it. Fix
|
|
# from John Ladwig <jladwig@nts.umn.edu>.
|
|
#
|
|
# 1999/05/05 (0.5):
|
|
# - Protocols other than TCP, UDP, or ICMP have packet lengths reported in
|
|
# parentheses for some reason. The script now handles this. Thanks to
|
|
# Dispatcher <dispatch@blackhelicopters.org>.
|
|
# - I had mixed up info-request and info-reply ICMP codes, and omitted the
|
|
# traceroute code. Sorted this out. I had also missed code 0 for type 6
|
|
# (alternate address for host). Thanks to John Ladwig <jladwig@nts.umn.edu>.
|
|
#
|
|
# 1999/05/03:
|
|
# - Now accepts hostnames in the source and destination address fields, as
|
|
# well as port names in the port fields. This allows the people who are
|
|
# using ipmon -n to still use plog. Note that if you are logging
|
|
# hostnames, you are vulnerable to forgery of DNS information, modified
|
|
# DNS information, and your log files will be larger also. If you are
|
|
# using this program you can have it look up the names for you (still
|
|
# vulnerable to forgery) and keep your logged addresses all in numeric
|
|
# format, so that packets from the same source will always show the same
|
|
# source address regardless of what's up with DNS. Obviously, I don't
|
|
# favor using ipmon -n. Nevertheless, some people wanted this, so here it
|
|
# is.
|
|
# - Added S and n flags to %acts hash. Thanks to Stephen J. Roznowski
|
|
# <sjr@home.net>.
|
|
# - Stopped reporting host IPs twice when numeric output was requested.
|
|
# Thanks, yet again, to Stephen J. Roznowski <sjr@home.net>.
|
|
# - Number of minor tweaks that might speed it up a bit, and some comments.
|
|
# - Put the script back up on the web site. I had moved the site and
|
|
# forgotten to move the tool.
|
|
#
|
|
# 1999/02/04:
|
|
# - Changed log line parser to accept fully-qualified name in the logging
|
|
# host field. Thanks to Stephen J. Roznowski <sjr@home.net>.
|
|
#
|
|
# 1999/01/22:
|
|
# - Changed high port strategy to use 65536 for unknown high ports so that
|
|
# they are sorted last.
|
|
#
|
|
# 1999/01/21:
|
|
# - Moved icmp parsing to output loop.
|
|
# - Added parsing of icmp codes, and more types.
|
|
# - Changed packet sort routine to sort by port number rather than service
|
|
# name.
|
|
#
|
|
# 1999/01/20:
|
|
# - Fixed problem matching ipmon log lines. Sometimes they have "/ipmon" in
|
|
# them, sometimes just "ipmon".
|
|
# - Added numeric parse option to turn off hostname lookups.
|
|
# - Moved summary to usage() sub.
|
|
|
|
use strict;
|
|
use Socket;
|
|
use IO::File;
|
|
|
|
select STDOUT; $| = 1;
|
|
|
|
my %hosts;
|
|
|
|
my $me = $0;
|
|
$me =~ s/^.*\///;
|
|
|
|
# Map of log codes for various actions. Not all of these can occur, but
|
|
# I've included everything in print_ipflog() from ipmon.c.
|
|
my %acts = (
|
|
'p' => 'pass',
|
|
'P' => 'pass',
|
|
'b' => 'block',
|
|
'B' => 'block',
|
|
'L' => 'log',
|
|
'S' => 'short',
|
|
'n' => 'nomatch',
|
|
);
|
|
|
|
# Map of ICMP types and their relevant codes.
|
|
my %icmpTypeMap = (
|
|
0 => +{
|
|
name => 'echorep',
|
|
codes => +{0 => undef},
|
|
},
|
|
3 => +{
|
|
name => 'unreach',
|
|
codes => +{
|
|
0 => 'net-unr',
|
|
1 => 'host-unr',
|
|
2 => 'proto-unr',
|
|
3 => 'port-unr',
|
|
4 => 'needfrag',
|
|
5 => 'srcfail',
|
|
6 => 'net-unk',
|
|
7 => 'host-unk',
|
|
8 => 'isolate',
|
|
9 => 'net-prohib',
|
|
10 => 'host-prohib',
|
|
11 => 'net-tos',
|
|
12 => 'host-tos',
|
|
13 => 'filter-prohib',
|
|
14 => 'host-preced',
|
|
15 => 'preced-cutoff',
|
|
},
|
|
},
|
|
4 => +{
|
|
name => 'squench',
|
|
codes => +{0 => undef},
|
|
},
|
|
5 => +{
|
|
name => 'redir',
|
|
codes => +{
|
|
0 => 'net',
|
|
1 => 'host',
|
|
2 => 'tos',
|
|
3 => 'tos-host',
|
|
},
|
|
},
|
|
6 => +{
|
|
name => 'alt-host-addr',
|
|
codes => +{
|
|
0 => 'alt-addr'
|
|
},
|
|
},
|
|
8 => +{
|
|
name => 'echo',
|
|
codes => +{0 => undef},
|
|
},
|
|
9 => +{
|
|
name => 'routerad',
|
|
codes => +{0 => undef},
|
|
},
|
|
10 => +{
|
|
name => 'routersol',
|
|
codes => +{0 => undef},
|
|
},
|
|
11 => +{
|
|
name => 'timex',
|
|
codes => +{
|
|
0 => 'in-transit',
|
|
1 => 'frag-assy',
|
|
},
|
|
},
|
|
12 => +{
|
|
name => 'paramprob',
|
|
codes => +{
|
|
0 => 'ptr-err',
|
|
1 => 'miss-opt',
|
|
2 => 'bad-len',
|
|
},
|
|
},
|
|
13 => +{
|
|
name => 'timest',
|
|
codes => +{0 => undef},
|
|
},
|
|
14 => +{
|
|
name => 'timestrep',
|
|
codes => +{0 => undef},
|
|
},
|
|
15 => +{
|
|
name => 'inforeq',
|
|
codes => +{0 => undef},
|
|
},
|
|
16 => +{
|
|
name => 'inforep',
|
|
codes => +{0 => undef},
|
|
},
|
|
17 => +{
|
|
name => 'maskreq',
|
|
codes => +{0 => undef},
|
|
},
|
|
18 => +{
|
|
name => 'maskrep',
|
|
codes => +{0 => undef},
|
|
},
|
|
30 => +{
|
|
name => 'tracert',
|
|
codes => +{ },
|
|
},
|
|
31 => +{
|
|
name => 'dgram-conv-err',
|
|
codes => +{ },
|
|
},
|
|
32 => +{
|
|
name => 'mbl-host-redir',
|
|
codes => +{ },
|
|
},
|
|
33 => +{
|
|
name => 'ipv6-whereru?',
|
|
codes => +{ },
|
|
},
|
|
34 => +{
|
|
name => 'ipv6-iamhere',
|
|
codes => +{ },
|
|
},
|
|
35 => +{
|
|
name => 'mbl-reg-req',
|
|
codes => +{ },
|
|
},
|
|
36 => +{
|
|
name => 'mbl-reg-rep',
|
|
codes => +{ },
|
|
},
|
|
);
|
|
|
|
# Arguments we will parse from argument list.
|
|
my $numeric = 0; # Don't lookup hostnames.
|
|
my $paranoid = 0; # Do paranoid hostname lookups.
|
|
my $verbosity = 0; # Bla' bla' bla'.
|
|
my $sTable = 0; # Generate source table.
|
|
my $dTable = 0; # Generate destination table.
|
|
my @services = (); # Preload services tables.
|
|
my $showFlags = 0; # Show TCP flag combinations.
|
|
my %selectAddrs; # Limit report to these hosts.
|
|
my %selectActs; # Limit report to these actions.
|
|
|
|
# Parse argument list.
|
|
while (defined ($_ = shift))
|
|
{
|
|
if (s/^-//)
|
|
{
|
|
while (s/^([vnpSD\?hsAF])//)
|
|
{
|
|
my $flag = $1;
|
|
if ($flag eq 'v')
|
|
{
|
|
++$verbosity;
|
|
}
|
|
elsif ($flag eq 'n')
|
|
{
|
|
$numeric = 1;
|
|
}
|
|
elsif ($flag eq 'p')
|
|
{
|
|
$paranoid = 1;
|
|
}
|
|
elsif ($flag eq 'S')
|
|
{
|
|
$sTable = 1;
|
|
}
|
|
elsif ($flag eq 'D')
|
|
{
|
|
$dTable = 1;
|
|
}
|
|
elsif ($flag eq 'F')
|
|
{
|
|
$showFlags = 1;
|
|
}
|
|
elsif (($flag eq '?') || ($flag eq 'h'))
|
|
{
|
|
&usage (0);
|
|
}
|
|
else
|
|
{
|
|
my $arg = shift;
|
|
defined ($arg) || &usage (1, qq{-$flag requires an argument});
|
|
if ($flag eq 's')
|
|
{
|
|
push (@services, $arg);
|
|
}
|
|
elsif ($flag eq 'A')
|
|
{
|
|
my @acts = split (/,/, $arg);
|
|
my $a;
|
|
foreach $a (@acts)
|
|
{
|
|
my $aa;
|
|
my $match = 0;
|
|
foreach $aa (keys (%acts))
|
|
{
|
|
if ($acts{$aa} eq $a)
|
|
{
|
|
++$match;
|
|
$selectActs{$aa} = $a;
|
|
}
|
|
}
|
|
$match || &usage (1, qq{unknown action $a});
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
&usage (1, qq{unknown option: -$_}) if (length);
|
|
|
|
next;
|
|
}
|
|
|
|
# Add host to hash of hosts we're interested in.
|
|
(/^(.+)\/([\d+\.]+)$/) || (/^(.+)$/) || &usage (1, qq{invalid CIDR address $_});
|
|
my ($addr, $mask) = ($1, $2);
|
|
my @addr = &hostAddrs ($addr);
|
|
(scalar (@addr)) || &usage (1, qq{cannot resolve hostname $_});
|
|
if (!defined ($mask))
|
|
{
|
|
$mask = (2 ** 32) - 1;
|
|
}
|
|
elsif (($mask =~ /^\d+$/) && ($mask <= 32))
|
|
{
|
|
$mask = (2 ** 32) - 1 - ((2 ** (32 - $mask)) - 1);
|
|
}
|
|
elsif (defined ($mask = &isDottedAddr ($mask)))
|
|
{
|
|
$mask = &integerAddr ($mask);
|
|
}
|
|
else
|
|
{
|
|
&usage (1, qq{invalid CIDR address $_});
|
|
}
|
|
foreach $addr (@addr)
|
|
{
|
|
# Save mask unless we already have a less specific one for this address.
|
|
my $a = &integerAddr ($addr) & $mask;
|
|
$selectAddrs{$a} = $mask unless (exists ($selectAddrs{$a}) && ($selectAddrs{$a} < $mask));
|
|
}
|
|
}
|
|
|
|
# Which tables will we generate?
|
|
$dTable = $sTable = 1 unless ($dTable || $sTable);
|
|
my @dirs;
|
|
push (@dirs, 'd') if ($dTable);
|
|
push (@dirs, 's') if ($sTable);
|
|
|
|
# Are we interested in specific hosts?
|
|
my $selectAddrs = scalar (keys (%selectAddrs));
|
|
|
|
# Are we interested in specific actions?
|
|
if (scalar (keys (%selectActs)) == 0)
|
|
{
|
|
%selectActs = %acts;
|
|
}
|
|
|
|
# We use this hash to cache port name -> number and number -> name mappings.
|
|
# Isn't it cool that we can use the same hash for both?
|
|
my %pn;
|
|
|
|
# Preload any services maps.
|
|
my $sm;
|
|
foreach $sm (@services)
|
|
{
|
|
my $sf = new IO::File ($sm, "r");
|
|
defined ($sf) || &quit (1, qq{cannot open services file $sm});
|
|
|
|
while (defined ($_ = $sf->getline ()))
|
|
{
|
|
my $text = $_;
|
|
chomp;
|
|
s/#.*$//;
|
|
s/\s+$//;
|
|
next unless (length);
|
|
my ($name, $spec, @aliases) = split (/\s+/);
|
|
($spec =~ /^([\w\-]+)\/([\w\-]+)$/)
|
|
|| &quit (1, qq{$sm:$.: invalid definition: $text});
|
|
my ($pnum, $proto) = ($1, $2);
|
|
|
|
# Enter service definition in pn hash both forwards and backwards.
|
|
my $port;
|
|
my $pname;
|
|
foreach $port ($name, @aliases)
|
|
{
|
|
$pname = "$pnum/$proto";
|
|
$pn{$pname} = $port;
|
|
}
|
|
$pname = "$name/$proto";
|
|
$pn{$pname} = $pnum;
|
|
}
|
|
|
|
$sf->close ();
|
|
}
|
|
|
|
# Cache for host name -> addr mappings.
|
|
my %ipAddr;
|
|
|
|
# Cache for host addr -> name mappings.
|
|
my %ipName;
|
|
|
|
# Hash for protocol number <--> name mappings.
|
|
my %pr;
|
|
|
|
# Under IPv4 port numbers are unsigned shorts. The value below is higher
|
|
# than the maximum value of an unsigned short, and is used in place of
|
|
# high port numbers that don't correspond to known services. This makes
|
|
# high ports get sorted behind all others.
|
|
my $highPort = 0x10000;
|
|
|
|
while (<STDIN>)
|
|
{
|
|
chomp;
|
|
|
|
# For ipmon output that came through syslog, we'll have an asctime
|
|
# timestamp, an optional severity code (IRIX), the hostname,
|
|
# "ipmon"[process id]: prefixed to the line. For output that was
|
|
# written directly to a file by ipmon, we'll have a date prefix as
|
|
# dd/mm/yyyy (no y2k problem here!). Both formats then have a packet
|
|
# timestamp and the log info.
|
|
my ($log);
|
|
if (s/^\w+\s+\d+\s+\d+:\d+:\d+\s+(?:\d\w:)?[\w\.\-]+\s+\S*ipmon\[\d+\]:\s+(?:\[ID\s+\d+\s+[\w\.]+\]\s+)?\d+:\d+:\d+\.\d+\s+//)
|
|
{
|
|
$log = $_;
|
|
}
|
|
elsif (s/^(?:\d+\/\d+\/\d+)\s+(?:\d+:\d+:\d+\.\d+)\s+//)
|
|
{
|
|
$log = $_;
|
|
}
|
|
else
|
|
{
|
|
# It don't look like no ipmon output to me, baby.
|
|
next;
|
|
}
|
|
next unless (defined ($log));
|
|
|
|
print STDERR "$log\n" if ($verbosity);
|
|
|
|
# Parse the log line. We're expecting interface name, rule group and
|
|
# number, an action code, a source host name or IP with possible port
|
|
# name or number, a destination host name or IP with possible port
|
|
# number, "PR", a protocol name or number, "len", a header length, a
|
|
# packet length (which will be in parentheses for protocols other than
|
|
# TCP, UDP, or ICMP), and maybe some additional info.
|
|
my @fields = ($log =~ /^(?:(\d+)x)?\s*(\w+)\s+@(\d+):(\d+)\s+(\w)\s+([\w\-\.,]+)\s+->\s+([\w\-\.,]+)\s+PR\s+(\w+)\s+len\s+(\d+)\s+\(?(\d+)\)?\s*(.*)$/ox);
|
|
unless (scalar (@fields))
|
|
{
|
|
print STDERR "$me:$.: cannot parse: $_\n";
|
|
next;
|
|
}
|
|
my ($count, $if, $group, $rule, $act, $src, $dest, $proto, $hlen, $len, $more) = @fields;
|
|
|
|
# Skip actions we're not interested in.
|
|
next unless (exists ($selectActs{$act}));
|
|
|
|
# Packet count defaults to 1.
|
|
$count = 1 unless (defined ($count));
|
|
|
|
my ($sport, $dport, @flags);
|
|
|
|
if ($proto eq 'icmp')
|
|
{
|
|
if ($more =~ s/^icmp (\d+)\/(\d+)\s*//)
|
|
{
|
|
# We save icmp type and code in both sport and dport. This
|
|
# allows us to sort icmp packets using the normal port-sorting
|
|
# code.
|
|
$dport = $sport = "$1.$2";
|
|
}
|
|
else
|
|
{
|
|
$sport = '';
|
|
$dport = '';
|
|
}
|
|
}
|
|
else
|
|
{
|
|
if ($showFlags)
|
|
{
|
|
if (($proto eq 'tcp') && ($more =~ s/^\-([A-Z]+)\s*//))
|
|
{
|
|
push (@flags, $1);
|
|
}
|
|
if ($more =~ s/^K\-S\s*//)
|
|
{
|
|
push (@flags, 'state');
|
|
}
|
|
}
|
|
if ($src =~ s/,([\-\w]+)$//)
|
|
{
|
|
$sport = &portSimplify ($1, $proto);
|
|
}
|
|
else
|
|
{
|
|
$sport = '';
|
|
}
|
|
if ($dest =~ s/,([\-\w]+)$//)
|
|
{
|
|
$dport = &portSimplify ($1, $proto);
|
|
}
|
|
else
|
|
{
|
|
$dport = '';
|
|
}
|
|
}
|
|
|
|
# Make sure addresses are numeric at this point. We want to sort by
|
|
# IP address later. If the hostname doesn't resolve, punt. If you
|
|
# must use ipmon -n, be ready for weirdness. Use only the first
|
|
# address returned.
|
|
my $x;
|
|
$x = (&hostAddrs ($src))[0];
|
|
unless (defined ($x))
|
|
{
|
|
print STDERR "$me:$.: cannot resolve hostname $src\n";
|
|
next;
|
|
}
|
|
$src = $x;
|
|
$x = (&hostAddrs ($dest))[0];
|
|
unless (defined ($x))
|
|
{
|
|
print STDERR "$me:$.: cannot resolve hostname $dest\n";
|
|
next;
|
|
}
|
|
$dest = $x;
|
|
|
|
# Skip hosts we're not interested in.
|
|
if ($selectAddrs)
|
|
{
|
|
my ($a, $m);
|
|
my $s = &integerAddr ($src);
|
|
my $d = &integerAddr ($dest);
|
|
my $cute = 0;
|
|
while (($a, $m) = each (%selectAddrs))
|
|
{
|
|
if ((($s & $m) == $a) || (($d & $m) == $a))
|
|
{
|
|
$cute = 1;
|
|
last;
|
|
}
|
|
}
|
|
next unless ($cute);
|
|
}
|
|
|
|
# Convert proto to proto number.
|
|
$proto = &protoNumber ($proto);
|
|
|
|
sub countPacket
|
|
{
|
|
my ($host, $dir, $peer, $proto, $count, $packet, @flags) = @_;
|
|
|
|
# Make sure host is in the hosts hash.
|
|
$hosts{$host} =
|
|
+{
|
|
'd' => +{ },
|
|
's' => +{ },
|
|
} unless (exists ($hosts{$host}));
|
|
|
|
# Get the source/destination traffic hash for the host in question.
|
|
my $trafficHash = $hosts{$host}->{$dir};
|
|
|
|
# Make sure there's a hash for the peer.
|
|
$trafficHash->{$peer} = +{ } unless (exists ($trafficHash->{$peer}));
|
|
|
|
# Make sure the peer hash has a hash for the protocol number.
|
|
my $peerHash = $trafficHash->{$peer};
|
|
$peerHash->{$proto} = +{ } unless (exists ($peerHash->{$proto}));
|
|
|
|
# Make sure there's a counter for this packet type in the proto hash.
|
|
my $protoHash = $peerHash->{$proto};
|
|
$protoHash->{$packet} = +{ '' => 0 } unless (exists ($protoHash->{$packet}));
|
|
|
|
# Increment the counter and mark flags.
|
|
my $packetHash = $protoHash->{$packet};
|
|
$packetHash->{''} += $count;
|
|
map { $packetHash->{$_} = undef; } (@flags);
|
|
}
|
|
|
|
# Count the packet as outgoing traffic from the source address.
|
|
&countPacket ($src, 's', $dest, $proto, $count, "$sport:$dport:$if:$act", @flags) if ($sTable);
|
|
|
|
# Count the packet as incoming traffic to the destination address.
|
|
&countPacket ($dest, 'd', $src, $proto, $count, "$dport:$sport:$if:$act", @flags) if ($dTable);
|
|
}
|
|
|
|
my $dir;
|
|
foreach $dir (@dirs)
|
|
{
|
|
my $order = ($dir eq 's' ? 'source' : 'destination');
|
|
my $arrow = ($dir eq 's' ? '->' : '<-');
|
|
|
|
print "###\n";
|
|
print "### Traffic by $order address:\n";
|
|
print "###\n";
|
|
|
|
sub ipSort
|
|
{
|
|
&integerAddr ($a) <=> &integerAddr ($b);
|
|
}
|
|
|
|
sub packetSort
|
|
{
|
|
my ($asport, $adport, $aif, $aact) = split (/:/, $a);
|
|
my ($bsport, $bdport, $bif, $bact) = split (/:/, $b);
|
|
$bact cmp $aact || $aif cmp $bif || $asport <=> $bsport || $adport <=> $bdport;
|
|
}
|
|
|
|
my $host;
|
|
foreach $host (sort ipSort (keys %hosts))
|
|
{
|
|
my $traffic = $hosts{$host}->{$dir};
|
|
|
|
# Skip hosts with no traffic.
|
|
next unless (scalar (keys (%{$traffic})));
|
|
|
|
if ($numeric)
|
|
{
|
|
print &dottedAddr ($host), "\n";
|
|
}
|
|
else
|
|
{
|
|
print &hostName ($host), " \[", &dottedAddr ($host), "\]\n";
|
|
}
|
|
|
|
my $peer;
|
|
foreach $peer (sort ipSort (keys %{$traffic}))
|
|
{
|
|
my $peerHash = $traffic->{$peer};
|
|
my $peerName = ($numeric ? &dottedAddr ($peer) : &hostName ($peer));
|
|
my $proto;
|
|
foreach $proto (sort (keys (%{$peerHash})))
|
|
{
|
|
my $protoHash = $peerHash->{$proto};
|
|
my $protoName = &protoName ($proto);
|
|
|
|
my $packet;
|
|
foreach $packet (sort packetSort (keys %{$protoHash}))
|
|
{
|
|
my ($sport, $dport, $if, $act) = split (/:/, $packet);
|
|
my $packetHash = $protoHash->{$packet};
|
|
my $count = $packetHash->{''};
|
|
$act = '?' unless (defined ($act = $acts{$act}));
|
|
if (($protoName eq 'tcp') || ($protoName eq 'udp'))
|
|
{
|
|
printf (" %-6s %7s %4d %4s %16s %2s %s.%s", $if, $act, $count, $protoName, &portName ($sport, $protoName), $arrow, $peerName, &portName ($dport, $protoName));
|
|
}
|
|
elsif ($protoName eq 'icmp')
|
|
{
|
|
printf (" %-6s %7s %4d %4s %16s %2s %s", $if, $act, $count, $protoName, &icmpType ($sport), $arrow, $peerName);
|
|
}
|
|
else
|
|
{
|
|
printf (" %-6s %7s %4d %4s %16s %2s %s", $if, $act, $count, $protoName, '', $arrow, $peerName);
|
|
}
|
|
if ($showFlags)
|
|
{
|
|
my @flags = sort (keys (%{$packetHash}));
|
|
if (scalar (@flags))
|
|
{
|
|
shift (@flags);
|
|
print ' (', join (',', @flags), ')' if (scalar (@flags));
|
|
}
|
|
}
|
|
print "\n";
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
print "\n";
|
|
}
|
|
|
|
exit (0);
|
|
|
|
# Translates a numeric port/named protocol to a port name. Reserved ports
|
|
# that do not have an entry in the services database are left numeric. High
|
|
# ports that do not have an entry in the services database are mapped
|
|
# to '<high>'.
|
|
sub portName
|
|
{
|
|
my $port = shift;
|
|
my $proto = shift;
|
|
my $pname = "$port/$proto";
|
|
unless (exists ($pn{$pname}))
|
|
{
|
|
my $name = getservbyport ($port, $proto);
|
|
$pn{$pname} = (defined ($name) ? $name : ($port <= 1023 ? $port : '<high>'));
|
|
}
|
|
return $pn{$pname};
|
|
}
|
|
|
|
# Translates a named port/protocol to a port number.
|
|
sub portNumber
|
|
{
|
|
my $port = shift;
|
|
my $proto = shift;
|
|
my $pname = "$port/$proto";
|
|
unless (exists ($pn{$pname}))
|
|
{
|
|
my $number = getservbyname ($port, $proto);
|
|
unless (defined ($number))
|
|
{
|
|
# I don't think we need to recover from this. How did the port
|
|
# name get into the log file if we can't find it? Log file from
|
|
# a different machine? Fix /etc/services on this one if that's
|
|
# your problem.
|
|
die ("Unrecognized port name \"$port\" at $.");
|
|
}
|
|
$pn{$pname} = $number;
|
|
}
|
|
return $pn{$pname};
|
|
}
|
|
|
|
# Convert all unrecognized high ports to the same value so they are treated
|
|
# identically. The protocol should be by name.
|
|
sub portSimplify
|
|
{
|
|
my $port = shift;
|
|
my $proto = shift;
|
|
|
|
# Make sure port is numeric.
|
|
$port = &portNumber ($port, $proto)
|
|
unless ($port =~ /^\d+$/);
|
|
|
|
# Look up port name.
|
|
my $portName = &portName ($port, $proto);
|
|
|
|
# Port is an unknown high port. Return a value that is too high for a
|
|
# port number, so that high ports get sorted last.
|
|
return $highPort if ($portName eq '<high>');
|
|
|
|
# Return original port number.
|
|
return $port;
|
|
}
|
|
|
|
# Translates a numeric address into a hostname. Pass only packed numeric
|
|
# addresses to this routine.
|
|
sub hostName
|
|
{
|
|
my $ip = shift;
|
|
return $ipName{$ip} if (exists ($ipName{$ip}));
|
|
|
|
# Do an inverse lookup on the address.
|
|
my $name = gethostbyaddr ($ip, AF_INET);
|
|
unless (defined ($name))
|
|
{
|
|
# Inverse lookup failed, so map the IP address to its dotted
|
|
# representation and cache that.
|
|
$ipName{$ip} = &dottedAddr ($ip);
|
|
return $ipName{$ip};
|
|
}
|
|
|
|
# For paranoid hostname lookups.
|
|
if ($paranoid)
|
|
{
|
|
# If this address already matches, we're happy.
|
|
unless (exists ($ipName{$ip}) && (lc ($ipName{$ip}) eq lc ($name)))
|
|
{
|
|
# Do a forward lookup on the resulting name.
|
|
my @addr = &hostAddrs ($name);
|
|
my $match = 0;
|
|
|
|
# Cache the forward lookup results for future inverse lookups,
|
|
# but don't stomp on inverses we've already cached, even if they
|
|
# are questionable. We want to generate consistent output, and
|
|
# the cache is growing incrementally.
|
|
foreach (@addr)
|
|
{
|
|
$ipName{$_} = $name unless (exists ($ipName{$_}));
|
|
$match = 1 if ($_ eq $ip);
|
|
}
|
|
|
|
# Was this one of the addresses? If not, tack on a ?.
|
|
$name .= '?' unless ($match);
|
|
}
|
|
}
|
|
else
|
|
{
|
|
# Just believe it and cache it.
|
|
$ipName{$ip} = $name;
|
|
}
|
|
|
|
return $name;
|
|
}
|
|
|
|
# Translates a hostname or dotted address into a list of packed numeric
|
|
# addresses.
|
|
sub hostAddrs
|
|
{
|
|
my $name = shift;
|
|
my $ip;
|
|
|
|
# Check if it's a dotted representation.
|
|
return ($ip) if (defined ($ip = &isDottedAddr ($name)));
|
|
|
|
# Return result from cache.
|
|
$name = lc ($name);
|
|
return @{$ipAddr{$name}} if (exists ($ipAddr{$name}));
|
|
|
|
# Look up the addresses.
|
|
my @addr = gethostbyname ($name);
|
|
splice (@addr, 0, 4);
|
|
|
|
unless (scalar (@addr))
|
|
{
|
|
# Again, I don't think we need to recover from this gracefully.
|
|
# If we can't resolve a hostname that ended up in the log file,
|
|
# punt. We want to be able to sort hosts by IP address later,
|
|
# and letting hostnames through will snarl up that code. Users
|
|
# of ipmon -n will have to grin and bear it for now. The
|
|
# functions that get undef back should treat it as an error or
|
|
# as some default address, e.g. 0 just to make things work.
|
|
return ();
|
|
}
|
|
|
|
$ipAddr{$name} = [ @addr ];
|
|
return @{$ipAddr{$name}};
|
|
}
|
|
|
|
# If the argument is a valid dotted address, returns the corresponding
|
|
# packed numeric address, otherwise returns undef.
|
|
sub isDottedAddr
|
|
{
|
|
my $addr = shift;
|
|
if ($addr =~ /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/)
|
|
{
|
|
my @a = (int ($1), int ($2), int ($3), int ($4));
|
|
foreach (@a)
|
|
{
|
|
return undef if ($_ >= 256);
|
|
}
|
|
return pack ('C*', @a);
|
|
}
|
|
return undef;
|
|
}
|
|
|
|
# Unpacks a packed numeric address and returns an integer representation.
|
|
sub integerAddr
|
|
{
|
|
my $addr = shift;
|
|
return unpack ('N', $addr);
|
|
|
|
# The following is for generalized IPv4/IPv6 stuff. For now, it's a
|
|
# lot faster to assume IPv4.
|
|
my @a = unpack ('C*', $addr);
|
|
my $a = 0;
|
|
while (scalar (@a))
|
|
{
|
|
$a = ($a << 8) | shift (@a);
|
|
}
|
|
return $a;
|
|
}
|
|
|
|
# Unpacks a packed numeric address into a dotted representation.
|
|
sub dottedAddr
|
|
{
|
|
my $addr = shift;
|
|
my @a = unpack ('C*', $addr);
|
|
return join ('.', @a);
|
|
}
|
|
|
|
# Translates a protocol number into a protocol name, or a number if no name
|
|
# is found in the protocol database.
|
|
sub protoName
|
|
{
|
|
my $code = shift;
|
|
return $code if ($code !~ /^\d+$/);
|
|
unless (exists ($pr{$code}))
|
|
{
|
|
my $name = scalar (getprotobynumber ($code));
|
|
if (defined ($name))
|
|
{
|
|
$pr{$code} = $name;
|
|
}
|
|
else
|
|
{
|
|
$pr{$code} = $code;
|
|
}
|
|
}
|
|
return $pr{$code};
|
|
}
|
|
|
|
# Translates a protocol name or number into a protocol number.
|
|
sub protoNumber
|
|
{
|
|
my $name = shift;
|
|
return $name if ($name =~ /^\d+$/);
|
|
unless (exists ($pr{$name}))
|
|
{
|
|
my $code = scalar (getprotobyname ($name));
|
|
if (defined ($code))
|
|
{
|
|
$pr{$name} = $code;
|
|
}
|
|
else
|
|
{
|
|
$pr{$name} = $name;
|
|
}
|
|
}
|
|
return $pr{$name};
|
|
}
|
|
|
|
sub icmpType
|
|
{
|
|
my $typeCode = shift;
|
|
my ($type, $code) = split ('\.', $typeCode);
|
|
|
|
return "?" unless (defined ($code));
|
|
|
|
my $info = $icmpTypeMap{$type};
|
|
|
|
return "\(type=$type/$code?\)" unless (defined ($info));
|
|
|
|
my $typeName = $info->{name};
|
|
my $codeName;
|
|
if (exists ($info->{codes}->{$code}))
|
|
{
|
|
$codeName = $info->{codes}->{$code};
|
|
$codeName = (defined ($codeName) ? "/$codeName" : '');
|
|
}
|
|
else
|
|
{
|
|
$codeName = "/$code";
|
|
}
|
|
return "$typeName$codeName";
|
|
}
|
|
|
|
sub quit
|
|
{
|
|
my $ec = shift;
|
|
my $msg = shift;
|
|
|
|
print STDERR "$me: $msg\n";
|
|
exit ($ec);
|
|
}
|
|
|
|
sub usage
|
|
{
|
|
my $ec = shift;
|
|
my @msg = @_;
|
|
|
|
if (scalar (@msg))
|
|
{
|
|
print STDERR "$me: ", join ("\n", @msg), "\n\n";
|
|
}
|
|
|
|
print <<EOT;
|
|
usage: $me [-nSDF] [-s servicemap] [-A act1,...] [address...]
|
|
|
|
Parses logging from ipmon and presents it in a comprehensible format. This
|
|
program generates two reports: one organized by source address and another
|
|
organized by destination address. For the first report, source addresses are
|
|
sorted by IP address. For each address, all packets originating at the address
|
|
are presented in a tabular form, where all packets with the same source and
|
|
destination address and port are counted as a single entry. Any port number
|
|
greater than 1023 that does not match an entry in the services table is treated
|
|
as a "high" port; all high ports are coalesced into the same entry. The fields
|
|
for the source address report are:
|
|
iface action packet-count proto src-port dest-host.dest-port \[\(flags\)\]
|
|
The fields for the destination address report are:
|
|
iface action packet-count proto dest-port src-host.src-port \[\(flags\)\]
|
|
|
|
Options are:
|
|
-n Disable hostname lookups, and report only IP addresses.
|
|
-p Perform paranoid hostname lookups.
|
|
-S Generate a source address report.
|
|
-D Generate a destination address report.
|
|
-F Show all flag combinations associated with packets.
|
|
-s map Supply an alternate services map to be preloaded. The map should
|
|
be in the same format as /etc/services. Any service name not found
|
|
in the map will be looked for in the system services file.
|
|
-A act1,... Limit the report to the specified actions. The possible actions
|
|
are pass, block, log, short, and nomatch.
|
|
|
|
If any addresses are supplied on the command line, the report is limited to
|
|
these hosts. Addresses may be given as dotted IP addresses or hostnames, and
|
|
may be qualified with netmasks in CIDR \(/24\) or dotted \(/255.255.255.0\) format.
|
|
If a hostname resolves to multiple addresses, all addresses are used.
|
|
|
|
If neither -S nor -D is given, both reports are generated.
|
|
|
|
Note: if you are logging traffic with ipmon -n, ipmon will already have looked
|
|
up and logged addresses as hostnames where possible. This has an important side
|
|
effect: this program will translate the hostnames back into IP addresses which
|
|
may not match the original addresses of the logged packets because of numerous
|
|
DNS issues. If you care about where packets are really coming from, you simply
|
|
cannot rely on ipmon -n. An attacker with control of his reverse DNS can map
|
|
the reverse lookup to anything he likes. If you haven't logged the numeric IP
|
|
address, there's no way to discover the source of an attack reliably. For this
|
|
reason, I strongly recommend that you run ipmon without the -n option, and use
|
|
this or a similar script to do reverse lookups during analysis, rather than
|
|
during logging.
|
|
EOT
|
|
|
|
exit ($ec);
|
|
}
|
|
|