Being able to quickly visualize Source IP Addresses over time and port and IP range is significant. The following utilities help:
- mergecap
- ipsumdump
- pcregrep
- gnuplot
Mergecap is part of the Wireshark distribution. It merges pcap files quickly and with little fanfare. Ipsumdump is a brilliant piece of software by UCLA prof Eddie Kohler. It is based on his "Click" router development which provides functional replacement for pcap code. Gnuplot is indispensable as part of the *Nix toolkit.What I want to do here is:
(1) merge two weeks of tcpdump captures into one pcap file
(2) filter out some common ports (e.g. noise)
(3) meaningfully analyze SIP behavior
The examples below are simple and straightforward. I expect to explore this software more.
[Here I filter out some common 'noisy' internal traffic:]
more no_search.txt
514
520
137
138
67
[Now I merge a couple weeks of pcap files and then columnize them with ipsumdump:]
mergecap -w May22-Jun4.cap May*2009 Jun012009
ipsumdump -r --no-headers -qtsSdDpO May22-Jun4.cap | pcregrep -v -f no_search.txt | sort -n -k 2 | more
....
1243564232.633833 110.8.212.14 3232 192.168.0.12 12712 U -
1243819790.146836 113.12.190.38 41300 192.168.0.12 1434 U -
1243962105.530513 113.12.190.38 40074 192.168.0.12 1434 U -
1243948162.113607 114.44.118.145 2522 192.168.0.12 25 T mss1440;sackok
1243948162.891020 114.44.118.145 2522 192.168.0.12 25 T mss1440;sackok
1243948163.661370 114.44.118.145 2522 192.168.0.12 25 T mss1440;sackok
1242915720.575869 114.45.61.61 4121 192.168.0.12 25 T mss1440;sackok
1242915727.208449 114.45.61.61 4121 192.168.0.12 25 T mss1440;sackok
1243948165.160091 115.150.202.176 1358 192.168.0.12 12712 U -
1243580800.176250 115.30.142.186 46453 192.168.0.12 1434 U -
.....
[Now I re-ordered one SIP I want to explore more closely:]
grep 121.15.245.215 out.dat 121.15.245.215.dat
sort -nr 121.15.245.215.dat > 121.15.245.215.graph.dat
1243935815.497855 121.15.245.215 12200 192.168.0.12 8000 T .
1243896403.852720 121.15.245.215 12200 192.168.0.12 3128 T .
1243786852.873342 121.15.245.215 12200 192.168.0.12 8000 T .
1243786749.219621 121.15.245.215 12200 192.168.0.12 3128 T .
1243751923.943017 121.15.245.215 12200 192.168.0.12 8000 T .
1243751811.136522 121.15.245.215 12200 192.168.0.12 3128 T .
1243702801.387269 121.15.245.215 12200 192.168.0.12 8000 T .
1243702687.231474 121.15.245.215 12200 192.168.0.12 3128 T .
1243678638.723457 121.15.245.215 12200 192.168.0.12 7212 T .
....
[Then I plot that SIP's activity over time:]
gnuplot> set terminal dumb
Terminal type set to 'dumb'
Options are 'feed 79 24'
gnuplot> plot "121.15.245.215.graph.dat" using 1 with lines
1.244e+09 ++-------+-------+--------+--------+--------+-------+-------++
** + + "121.15.245.215.graph.dat" using 1 ****** +
| * |
1.2438e+09 ++ * ++
| ******* |
| ******* |
| ********* |
1.2436e+09 ++ **** ++
| ******* |
| * |
1.2434e+09 ++ * ++
| * |
| * |
1.2432e+09 ++ * ++
| * |
| * |
| ** |
1.243e+09 ++ ******* ++
| ** |
+ + + + + + ********** +
1.2428e+09 ++-------+-------+--------+--------+--------+-------+-------++
0 5 10 15 20 25 30 35
[Here, the SIPs behaviour makes me more interested in plotting per port...]
grep 218.103.62.150 out.dat > 218.103.62.150.dat
more 218.103.62.150.dat
1242901282.013137 218.103.62.150 55248 192.168.0.12 19899 T mss1394;sackok
1242901282.670295 218.103.62.150 55248 192.168.0.12 19899 T mss1394;sackok
1242901283.342359 218.103.62.150 55248 192.168.0.12 19899 T mss1394;sackok
1242901284.902925 218.103.62.150 55254 192.168.0.12 17337 T mss1394;sackok
1242901285.542566 218.103.62.150 55254 192.168.0.12 17337 T mss1394;sackok
1242901286.151354 218.103.62.150 55254 192.168.0.12 17337 T mss1394;sackok
1242901287.088508 218.103.62.150 55257 192.168.0.12 17681 T mss1394;sackok
1242901287.664895 218.103.62.150 55257 192.168.0.12 17681 T mss1394;sackok
1242901288.291307 218.103.62.150 55257 192.168.0.12 17681 T mss1394;sackok
...
gnuplot
gnuplot> set terminal dumb
gnuplot> plot "218.103.62.150.dat" using 5:1 with points
1.2429e+09 ++------+------+-------+-------+------+-------+------+------++
+ + + "218.103.62.150.dat" using 5:1+ A +
A |
1.2429e+09 ++ ++
| |
| |
| |
1.2429e+09 ++ ++
| A |
| A |
1.2429e+09 ++ AA ++
A A A |
| A AA A |
1.2429e+09 ++A A++
| A A A A |
| |
| A |
1.2429e+09 A+ ++
| |
+ + + + AA A+ + + + +
1.2429e+09 ++------+------+-------+------A+------+-------+------+------++
0 5000 10000 15000 20000 25000 30000 35000 40000
No comments:
Post a Comment