Tài liệu IP Behavior pptx

4 - 1 1 IP Behavior – SANS ©2001 IP Behavior Security Essentials The SANS Institute In this module, IP Behavior, we are going to take a look at how to analyze TCP/IP information and how one would actually go about pulling it off the wire and looking for patterns. The key point when it comes to security is, “Knowledge is power and ignorance is deadly.” Not understanding what is occurring on your network can be very dangerous from a security standpoint because if you do not understand what is occurring, then how can you determine whether it is good or bad? The answer is that you cannot. Therefore, being able to understand and interpret data on your network will enable you to determine what action you need to take to possibly protect against any malicious behavior. 4 - 2 2 IP Behavior – SANS ©2001 Objectives • What is a sniffer? • Introduction to TCPdump and TCPdump output •TCP concepts •Fragmentation • Stimulus and normal response In order to analyze and interpret TCP/IP traffic you need a way to be able to pull the traffic off of the network. In order to do this we need to use a sniffer. There are a variety of sniffers available but most of this chapter will concentrate on TCPdump and how to analyze TCPdump output. We will then cover TCP concepts that are the foundation of how TCP communicates. We will look at fragmentation in IP datagrams to see what is happening at the datagram level. Finally, we will examine stimulus and response. How does a host respond to certain traffic under varying circumstances? This will assist you in understanding what normal responses look like. 4 - 3 3 IP Behavior – SANS ©2001 Hub Blah, blah, blah Blah, blah, blah Blah, blah, blah Blah, blah, blah Broadcast Ethernet Broadcast Ethernet Switch Blah, blah, blah Blah, blah, blah Switched Ethernet Switched Ethernet What is a Sniffer? • Sniffers gather all information transmitted across a line – For broadcast media (ethernet), allows an attacker to gather passwords, etc. – For ethernet, all data is broadcast on the LAN segment • Switched ethernet limits data to a specific source and destination port on a switch Sniffers are among the most common of hacker tools. They gather traffic off of the network, which an attacker can read in real time, or squirrel away in a file, but not only can they be used by attackers but they can also be used by the good guys to analyze network traffic and to figure out what is occurring on the network. When an ethernet interface is gathering all traffic, it is said to be in “promiscuous mode” and a sniffer is basically a device or piece of hardware that listens on the cable and records all traffic as it passes the network. In order to be able to sniff the traffic you have to be able to see it and this depends on the type of device you are using to connect your systems together. Traditional ethernet, usually implemented in a hub, is a broadcast medium, which broadcasts all data to all systems connected to the LAN segment. Therefore, traditional ethernet is inherently sniffable. Switched ethernet does not broadcast all information to all links of the LAN segment. Instead, the switch is more intelligent than the hub, and by looking at the destination MAC address, will only send the data to the required port on the switch. Switched ethernet is only sniffable in limited ways. 4 - 4 4 IP Behavior – SANS ©2001 Examples of Sniffers • There are countless examples of sniffers out there – es - freeware (ships with SunOS, Solaris RootKits) – Linsniff - freeware (ships with Linux Rootkits) – Websniff - freeware – TCPdump - freeware – snoop - distributed with Solaris – Network Associates - commercial – Shomiti Surveyor - commercial – Ethereal - freeware – Windump - freeware – Snort - freeware – Sniffit - freeware – Dsniff - a free suite of tools built around a sniffer There are lots of sniffers our there… some much more useful than others. Depending on your needs, your interest, and your budget, there should be a sniffer out there that does what you want. In this module we are going to concentrate and look at TCPdump which runs primarily on Unix systems but also has a port to Windows, called windump. 4 - 5 5 IP Behavior – SANS ©2001 TCPdump TCPdump is a program that will dump traffic on a network. It is available from http://ee.lbl.gov or from www.tcpdump.org. You will also need to download the libpcap packet capture library. TCPdump has also been ported to Windows as windump. Windump and winpcap can be downloaded from http://netgroup-serv.polito.it/netgroup/tools.html . In section 1, we will explore TCPdump. 4 - 6 6 IP Behavior – SANS ©2001 0101001110 111010010011000 00100011011 Network packets TCPdump running on a host “sniffing” network packets TCPdump output TCPdump 07:00:48.036746 ping.net > myhost.com: icmp: echo request (DF) 07:00:48.036776 myhost.com > ping.net: icmp: echo reply (DF) 07:02:12.622460 log.net.3155 > syslog.com.514: udp 101 07:03:01.132414 send.net.32938 > mail.com.25: S 248631:248631(0) win 8760 On the slide “TCPdump”, we mean that TCPdump is a program that will read traffic off of the network. By default, it will collect and print, in a standard format, all the traffic passing on the network. There are command line options for TCPdump that will alter the default behavior. We can specify that we want to collect only certain types of packets, print the records of these packets in verbose mode (-v), print the packets in hexadecimal (-x), or actually write the records to a file as “raw packets”(-w) instead of printing them as standard output. TCPdump filters can be used to specify records to be collected. Rather than gather all traffic passing on the network on which the host resides, TCPdump can be instructed to record packets with a specific trait. Examples of filters would be to record only TCP packets, or record packets to a given port, say telnet, port 23, for instance. You can limit the purview of what is collected to a specific IP or host. Combinations of traits can be used to get more restrictive in what is collected. Just about any field in an IP datagram, including the actual data payload, can be used to select the records that are collected. On this slide, we see a host running TCPdump and gathering records from the network interface. We see the records that TCPdump has collected at the bottom of the slide. TCPdump has a default standard output based on the protocol (tcp, udp, icmp) of the record that is displayed. While each of the various protocols has a similar format to the other, they are also distinct in what is displayed. 4 - 7 7 IP Behavior – SANS ©2001 timestamp source.port dest.port : udp bytes timestamp: hour:minutes:seconds.fractions of seconds source.port: source IP/hostname.source port dest.port: destination IP/host.destination port udp: may or may not expressly label the udp protocol bytes: number of bytes of udp data (payload) 09:39:19.470000 nmap.edu.728 > dns.net.111: udp 56 Sample TCPdump UDP Output If we examine a line of TCPdump UDP output on the slide “Sample TCPdump UDP output”, we first see a timestamp or the record of the time when the TCPdump host read the packet. The timestamp is in the format of hour, colon, minutes, colon, seconds, period, followed by fractions of a second. As you can see, TCPdump allows for 6 fractional digits or millionths of a second. The record we see with the value 470000 has a precision of hundredths of a second. This is a limitation of the Linux operating system on which this TCPdump record was collected, but this was corrected in a later RedHat release. Next, we see the source information for the TCPdump record. This includes the source host name, nmap.edu, or IP number depending upon whether the IP can be resolved. If you do not want names resolved, TCPdump can be run with the -n parameter. At the end of the source host name, we see a period and the source port, in this case 728. Immediately following the greater than sign, you see the destination host or IP address, “dns.net”, followed by a period, followed by the destination port, in this case port 111 or what is more commonly known as the portmapper or sunrpc port. In this record, you see the word “udp” to help identify this protocol. Not all UDP records will be labeled expressly “udp”. DNS, or port 53, is a notable exception. The final field is the number of bytes found of the UDP data. Recall that UDP data is wrapped in a UDP header first and encapsulated in an IP header before it is sent out on the network. 4 - 8 8 IP Behavior – SANS ©2001 Sample TCPdump TCP Output timestamp source.port dest.port flags beginning: ending bytes options seq # seq # 09:32:43.910000 nmap.edu.1173 > dns.net.21: S 62697789:62697789(0) win 512 flags: tcp flags ( P SH, RST, SYN, FIN) beginning seq #: for the initial connection, this is the initial sequence number (ISN) from the source IP ending seq #: this is the beginning sequence number + data bytes bytes: data bytes (payload) in the tcp packet options: options that the source host advertises to the destination host The TCPdump TCP record is identical to the UDP record as far as timestamp, source, and destination host and port. What distinguishes the TCP format from the others are the TCP flags, sequence numbers, acknowledgements, acknowledgement numbers, and TCP options. In this record, we see the flag of SYN or S set following the destination port of 21 which, by the way, is the port for ftp. The SYN flag indicates a request to begin a TCP session. Other possible flag values are P for PUSH that sends data, R for RESET that aborts a connection, and F for FIN, which terminates a connection more gracefully. While not an actual flag bit like the others, if you see a period in the flag field, it simply means that none of the PUSH, RESET, SYN, or FIN flags are set. In a way, this is an informative placeholder. Next is the beginning sequence number. One of the mechanisms that TCP uses to guarantee reliable packet delivery is keeping track of the data it has received. This is partially done by using sequence numbers. In this case, since this is an initial connection, it is known as the Initial Sequence Number or ISN. The ending sequence number is the sum of the initial sequence number plus the number of TCP data bytes sent in this TCP segment. A SYN connection sends no data bytes, as represented by the zero in parentheses. Data should not be sent until the client and server actually establish the connection. Finally, there is a TCP options field. In this record, we see nmap.edu advertising a window size of 512 bytes. It is informing dns.net that it has an incoming buffer size of 512 bytes. If dns.net is a larger faster host, it will have to slow itself and pace the data sent so it doesn’t overwhelm the buffer size of nmap.edu. 4 - 9 9 IP Behavior – SANS ©2001 Absolute and Relative Sequence client.com.38060 > telnet.com.telnet: S 3774957990:3774957990(0) win 8760 <mss 1460> (DF) telnet.com.telnet > client.com.38060: S 2009600000:2009600000(0) ack 3774957991 win 1024 <mss 1460> client.com.38060 > telnet.com.telnet: .ack 1 win 8760 (DF) client.com.38060 > telnet.com.telnet: P 1:28(27) ack 1 win 8760 (DF) On the next slide, we show a handy feature of TCPdump. Notice the top line, we have the number 3774957990 in bold. That is an absolute sequence number. The absolute sequence number keeps track of how much data has been sent by a connection. However, these numbers get pretty ugly. So TCPdump can provide the information as relative sequence numbers as well. On the third line of your slide, after the ack, you see a 1 in bold. That means one byte has been transferred. When we look more closely at tcp, we will see our friends absolute and relative sequence again. 4 - 10 10 IP Behavior – SANS ©2001 Sample TCPdump ICMP Output icmp format 1 timestamp source dest icmp: icmp message 14:59:30.220000 ping.net > hosta.mysite.com: icmp: echo request 14:59:38.140000 hosta.mysite.com > ping.net: icmp: echo reply icmp format 2 timestamp router source icmp: dest icmp message 02:09:47.600000 foreign.router > tryinghost.com: icmp: host desired.com unreachable In the slide “Sample TCPdump ICMP Output,” we see ICMP output generated by TCPdump. ICMP is the protocol used for error control and message handling. There are many different types of ICMP records that have different messages. We display two of the basic formats on this slide. The first two ICMP records have a similar format. In the first ICMP record, we have a timestamp followed by a source host – ping.net in the first record. Following the greater than sign, we see the destination host – in this record hosta.mysite.com. Remember, ICMP doesn’t use ports to communicate like TCP and UDP do. The ICMP message type follows the destination host. In the first record we see an ICMP echo request which is generated by a commonly used program known as ping. The second record is a response from the ping from hosta.mysite.com to ping.net. This is known as an ICMP echo reply. The third record shows a slightly different format. Often times a router will be involved when some kind of error is detected. In this record, foreign.router delivers a message to tryinghost.com that host desired.com is not reachable. This implies that tryinghost.com first attempted to send some kind of traffic to desired.com and foreign.router intervened to inform tryinghost.com when it discovered a problem. [...]... this combination of source IP and source port connected to this destination IP and destination port There may be another user connection from another source IP to this same destination IP and destination port, but that user will have a different source IP and most likely different source port There may even be someone from the same source IP connected to the same destination IP and port But, this user... best sources for this and understanding TCP /IP in general, is TCP /IP Illustrated, Volume 1 by Richard Stevens 4 - 12 Finding the Protocol in the IP Header BYTE 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 45 00 00 28 b5 cb 40 00 fe 01 b2 29 01 02 03 04 16 17 18 19 IP protocol field icmp = 01 tcp = 06 udp = 17 = 11 hexadecimal 161 x 1 + 160 x 1 = 17 c0 a8 05 05 IP Behavior – SANS ©2001 13 We get a feel for... pieces of information First, the IP protocol field is 9 bytes into the IP header Counting begins with 0 so if we look at the slide, the byte that has the gray background represents the IP protocol The current value that we see is 01 or the value for icmp Other values that you may see are 06 which is tcp, and 17 which is udp Seventeen is the decimal value of the number, but the IP header is in hexadecimal... hexadecimal • Hexadecimal output is more difficult to read and decrypt, however it will show you the entire IP datagram, even fields that TCPdump doesn’t display in its standard output • The “entire” packet is shown only if you’ve told TCPdump to dump the entire packet via the -s (snaplen) calling parameter IP Behavior – SANS ©2001 11 This slide reiterates what we discussed earlier TCPdump output can be displayed... kind of tampering 4 - 11 Sample Hexadecimal Output 04:19:31.800000 1.2.3.4 > 192.168.5.5: icmp: echo reply (DF) 4500 0028 b5cb 4000 fe01 b229 0102 0304 IP Header ICMP message c0a8 0505 0000 bc9c bf3c 51ff 0018 f81b 000d d5f0 000d 63e8 0000 0000 0000 IP Behavior – SANS ©2001 12 We see the output of a datagram displayed in hexadecimal The record is first displayed as you would see it in normal TCPdump... depending on protocol • UDP packets may or may not have “udp” in the output • TCP packets are distinguishable because of flags • ICMP packets will have the ICMP message description • TCPdump can display records in hexadecimal format IP Behavior – SANS ©2001 14 Slide “TCPdump review” wraps up what we have learned in section 1 about TCPdump TCPdump can sniff packets off of the network It dumps the packets... distinguishable because of flags, and other fields such as the sequence and acknowledgement numbers, to name a few ICMP messages will have the ICMP message description contained in them 4 - 14 TCP Concepts TCP is a connection-oriented reliable protocol IP Behavior – SANS ©2001 15 In section 2, we will examine some TCP concepts Remember TCP is a connection-oriented reliable protocol 4 - 15 Establishing a TCP... 07:09:43.370355 download.net.39904 > ftp.com.21: ack 1 win 8760 (DF) Server SYN/ACK IP Behavior – SANS ©2001 Client ACK 17 The TCPdump output on the slide “TCPdump output of TCP connection establishment” shows the connection establishment There are three TCP segments shown A TCP segment contains the information sent by TCP to IP In the first segment, you see the client, download.net attempt a connection... 4 bit values with no intervening spaces represent a byte The IP header in this datagram has 20 bytes The IP header is displayed between the first and second arrows This is followed by an ICMP message that is found between the second and third arrows What do these hex values represent? Well, you’ll have to get a standard layout of what an IP header looks like and similarly, you’ll need to acquire a... tcp = 06 udp = 17 = 11 hexadecimal 161 x 1 + 160 x 1 = 17 c0 a8 05 05 IP Behavior – SANS ©2001 13 We get a feel for how this works by turning to the slide “Finding the protocol in the IP header.” Here we have displayed the IP header One of the hardest things to master when you first begin to look at TCPdump output is exactly what protocol is being displayed We saw where ICMP is pretty obvious about announcing . 4 - 1 1 IP Behavior – SANS ©2001 IP Behavior Security Essentials The SANS Institute In this module, IP Behavior, we are going to take. understanding TCP /IP in general, is TCP /IP Illustrated, Volume 1 by Richard Stevens. 4 - 13 13 IP Behavior – SANS ©2001 Finding the Protocol in the IP Header 45