I had a question about the SSH analyzer and how it determines a successful connection. I have a bro notification for a successful SSH login to a system on my network for a connection originating from outside US. Log entry:
The log entry is dated on the 1st and my client side logs have rolled over, so I can’t valid this with syslog on the client.
I wanted to check if there’s a chance this could be a false positive. Also, the switch providing the feed itself is dropping packets and I see alerts for CaptureLoss::Too_Much_Loss and PacketFilter::Dropped_Packets.
Would this loss cause Bro to misinterpret a brute forcing/scan attempt to a successful login?
I’m running Bro 2.0.
For the first part, that "5725" is the number of response bytes. The
I don't know about your second part off the top of my head.
-Sam
Right, if the ssh connection’s response bytes are above this threshold it’ll log the session as having a successful login. If you have a large pre-auth login banner (usually for compliance reasons) it will very likely report as a false positive.
Hey all,
Topic says it...it's very strange..new install on a different box..I see the below:
[12:08:56 gateway:~/current$] ls -l
I even see:
2013-09-13T12:05:46-0600 8GxbB0zXe0g x.x.x.x 53547 74.125.129.99 80 tcp - - - - OTH F 0 C 0 0 0 0 (empty)
2013-09-13T12:05:46-0600 HQym3XmcURj x.x.x.x 36086 205.171.2.25 53 udp 59556 www.google.com 1 C_INTERNET 1 A 0 NOERROR F F T T 0 74.125.129.99,74.125.129.104,74.125.129.105,74.125.129.147,74.125.129.103,74.125.129.106 297.000000,297.000000,297.000000,297.000000,297.000000,297.000000
loaded_scripts.log shows:
[12:10:26 gateway:~/current$] grep http loaded_scripts.log
But http.log is still not created. Anything I'm missing here or something I can do to troubleshoot on this end? This is running on ppp0. Thank you.
James
Well...it IS being created...however, certain things don't seem to be logged. Example:
[12:27:34 gateway:~$] wget www.amazon.com http://www.amazon.com/ www.amazon.com (www.amazon.com )... 72.21.194.212www.amazon.com (www.amazon.com )|72.21.194.212|:80... connected.
[ <=> ] 233,456 271K/s in 0.8s
And bro shows the below:
2013-09-13T12:30:59-0600 51V4hVkz1le x.x.x.x 36471 72.21.194.212 80 tcp - - - - OTH F 0 C 0 0 0 0 (empty)www.amazon.com 1 C_INTERNET 1 A 0 NOERROR F F T T 0 72.21.194.212 34.000000
Not sure why it's telling me it's an active connection reuse instead of logging the http traffic.
James
Let’s enable your capture loss and see what happens:
Add the following to your local.bro; on security onion it will be located at /opt/bro/share/bro/site/
@load misc/capture-loss.bro
redef CaptureLoss::watch_interval = 1 min;
Give it a couple of minutes and see what the log says under:
/nsm/bro/logs/capture_loss.log
You will see per worker statistics written every minute.
Let us know.
Thanks,
Liam Randall
Thanks Liam...here's what I got:#fields ts ts_delta peer gaps acks percent_lost#types time interval string count count string
Bro entries:www.duckduckgo.com 1 C_INTERNET 1 A 0 NOERROR F F T T 0 duckduckgo.com ,50.18.192.250,50.18.192.251 900.000000,25.000000,25.000000duckduckgo.com 1 C_INTERNET 1 A 0 NOERROR F F T T 0 50.18.192.251,50.18.192.250 24.000000,24.000000
Wget info:www.duckduckgo.com http://www.duckduckgo.com/ www.duckduckgo.com (www.duckduckgo.com )... 50.18.192.250, 50.18.192.251www.duckduckgo.com (www.duckduckgo.com )|50.18.192.250|:80... connected.https://duckduckgo.com/ [following]https://duckduckgo.com/ duckduckgo.com (duckduckgo.com )... 50.18.192.251, 50.18.192.250duckduckgo.com (duckduckgo.com )|50.18.192.251|:443... connected.
100%[=========================>] 8,646 --.-K/s in 0s
2013-09-13 13:45:34 (86.8 MB/s) - `index.html' saved [8646/8646]
Tshark info:
Not sure what to think...it's very strange. Thanks again.
James
How is the data getting to bro? Span port? Tap?
KB1
September 13, 2013, 9:27pm
10
In line with Doug's suggestion, can you try a known good source of traffic? For example a packet trace from Bro Workshop:http://www.bro.org/bro-workshop-2011/exercises/logs/index.html
Here is the direct link:http://www.bro.org/bro-workshop-2011/exercises/logs/http.pcap
Try running:
and see what happens?
-kb
Liam,
The I have a DSL modem in dummy mode connecting direct to the machine running bro. That wget is seen running on that machine. Thank you.
James
Hi Keith,
Just ran that http.pcap…looked great in my http.log:
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string filewww.reddit.com / - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1 0 109978 200 OK - - - (empty) - - - text/html - -e.thumbs.redditmedia.com /E-pbDbmiBclPkDaX.jpg http://www.reddit.com/ Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1 0 2300 200 OK - - - (empty) - - - image/jpeg - -
Thank you.
James
I'd point out that the conn.log file lines included in his email indicate that the received and sent bytes are 0, and the connection state is borked -- I believe this would prevent it from being detected as http traffic, and therefore not create an http.log file.
-- KS
WELLL this is gonna hurt my head. So…here's my setup:
DSL modem (dummy mode) < -- > eth1/ppp0(Linuxbox)eth0 < -- > switch with everything else
For giggles I decided to see if there was any difference with requests originating from the linuxbox, compared to originating behind it. I tsharked at ppp0, here's what I have
Curl from a Mac
Wget from the linuxbox
Macwww.spamcop.net / - curl/7.24.0 (x86_64-apple-darwin12.0) libcurl/7.24.0 OpenSSL/0.9.8y zlib/1.2.5 0 5455 200 OK - - - (empty) - - - text/html - -
Linuxbox
When coming from the linuxbox, I get active_connection_reuse and no http logged. When routing(natting) internal traffic, it logs http and no active_connection_reuse. A puzzle to be sure.
James
KB1
September 14, 2013, 9:04am
15
Maybe tell Bro to ignore checksums?
http://www.bro.org/documentation/faq.html#why-isn-t-bro-producing-the-logs-i-expect-a-note-about-checksums
Option 1 would probably entail:
If you are using broctl, in your broctl.cfg file add the line (then install and restart in broctl)?
Hey hey! I think that was just the ticket. Thanks so much Keith!
James
I want to chime in here quickly. Generally if you are running in BroControl it means that you are sniffing live traffic and probably in an environment where you want things to run correctly in which case you would *never* want to configure this option. If packet have bad checksums, they generally should be dropped.
.Seth
I completely agree. In my case however, I believe it's a "feature" of PPPoE…those same packets captured on the physical eth1 NIC are flawless with zero issues. I tried having Bro listen to eth1, but I don't think it plays with the PPPoE. Thanks for the input Seth.
James
Hm, I think I have a patch around somewhere that adds PPPoE support to Bro… yep, found it.
I also went ahead and updated that branch to be only diffs against the current master branch. Let me know if you need any help if you decide to give it a try.
.Seth
Oh sweet thanks Seth...I'll give that a go today and report my results.
James