docker:pcap_analysis
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
docker:pcap_analysis [2018/02/26 18:48] – [How to analyze large PCAP dumps using the free TrisulNSM Docker] vivek | docker:pcap_analysis [2018/03/02 17:27] (current) – [Instructions : How to run the Docker image over PCAPs] veera | ||
---|---|---|---|
Line 1: | Line 1: | ||
- | ====== How to analyze large PCAP dumps using the free TrisulNSM Docker ====== | + | ====== How to analyze large PCAP files using TrisulNSM Docker ====== |
- | While live traffic capture is the predominant mode of Network Security Monitoring, it is also crucial to be able to load packet capture (PCAP) dumps. | + | While live traffic capture is the predominant mode of Network Security Monitoring, it is also crucial to be able to load packet capture (PCAP) dumps. |
- | - adjlkas | + | - The results should be **as if** the analysis was done as a live traffic capture |
- | - adasda | + | - **Timestamps** must reflect the PCAP time and not the import time |
- | - | + | - **Clock** - The import process should be clocked off the packet timestamps. This means that if a PCAP file contained 10 hours of traffic, the import process should not require 10 hours. This means a tcpreplay based rig , even if the timestamp issues are solved, will not be optimal for large timeframes. |
+ | - **Encrichment and intel** feeds such as Geo-IP, Blacklists, Domain Databases, may reflect current time, rather than PCAP time. This is for practical reasons. | ||
+ | - **Search vs Streaming** import PCAP is a bit harder for streaming pipelines like Trisul compared to Elastic Search backends. This is due to the possibility of the streaming window closing before all the events come in. | ||
+ | ===== Tools ===== | ||
- | * Wireshark : Just keep the PCAP dumps around, | + | Here are some of the tools in the NSM ecosystem that generate various types of data that need to be orchestrated. |
- | * Argus or SiLK : Try to index them from a flow perspective. Argus or SiLK can do this. | + | |
- | * Bro : turn the PCAPs into bro logs, which record | + | |
- | * Suricata / Snort : Run an IDS ruleset over the PCAPs. | + | |
- | * Security Onion : Play the PCAPs using TCP Replay and get all of the above. | + | |
- | * Moloch : Index the packets for fast recall | + | |
- | * TrisulNSM : Traffic metrics tool at its core, but does flows, index packets, extracts metadata, and other NSM tasks | + | |
+ | * **Argus or SiLK** : Try to index them from a flow perspective. Argus or SiLK can do this. | ||
+ | * **Bro** : turn the PCAPs into bro logs, which record | ||
+ | * **Suricata / Snort** : Run an IDS ruleset over the PCAPs. | ||
+ | * **Security Onion** : The NSM distro that packages everything you need. The latest version of Security Onion includes a script to automate this process.The backend storage and reporting is now Elastic Search. | ||
+ | * **Moloch** : Index raw packets for fast recall. Also stores into Elastic Search. | ||
+ | * **NTOP** : Traffic monitoring | ||
+ | * **Wireshark/ | ||
+ | * **TrisulNSM** : Traffic metrics at its core, but also does flows, packet indexiing, metadata extraction, and other NSM functions. Trisul uses Stream Processing instead of Search as its backend. The free license allows you to import any number of PCAPs as long each PCAP isnt longer than 3 days. | ||
- | We just released a free [[https:// | + | This article explains how the new [[https:// |
===== Instructions : How to run the Docker image over PCAPs ===== | ===== Instructions : How to run the Docker image over PCAPs ===== | ||
- | < | + | Put the PCAP dump into the shared docker |
- | We are assuming here that you have a Linux system with Docker installed. | + | |
- | </ | + | |
- | + | ||
- | First you need to create a //root volume//, say ''/ | + | |
< | < | ||
- | mkdir /opt/trisul6_root | + | mkdir /opt/trisulroot |
- | cp myhugeCapture.pcap /opt/trisul6_root | + | cp myhugeCapture.pcap /opt/trisulroot |
</ | </ | ||
- | + | Run the trisul6 docker image on the PCAP | |
- | Run the free trisul6 docker image on the PCAP like so | + | |
<code bash> | <code bash> | ||
+ | |||
docker run --privileged=true \ | docker run --privileged=true \ | ||
| | ||
- | --net=host | + | |
- | | + | -v /opt/ |
- | | + | |
- | | + | --fine-resolution \ |
- | | + | --pcap myhugeCapture.pcap |
</ | </ | ||
- | Now wait for the import to complete. | + | Now wait for the import to complete. |
- | To check on progress | + | To check on progress , tail the log and wait for confirmation |
< | < | ||
Line 67: | Line 68: | ||
<code bash> | <code bash> | ||
docker run --name trisul1a --net=host \ | docker run --name trisul1a --net=host \ | ||
- | -v /opt/trisul6_root:/ | + | -v /opt/trisulroot:/ |
-d trisulnsm/ | -d trisulnsm/ | ||
--pcap BSidesDE2017_PvJCTF.pcap \ | --pcap BSidesDE2017_PvJCTF.pcap \ | ||
--no-ids | --no-ids | ||
</ | </ | ||
+ | |||
+ | |||
+ | ==== Analysis ==== | ||
+ | |||
+ | Once loaded you need to point your browser to ip:3000 and select the newly created context for the run. | ||
+ | |||
+ | {{: | ||
+ | |||
+ | After you login here are some suggested steps | ||
+ | |||
+ | - Go to Retro Counters to get details metrics and toppers across 40+ counter groups | ||
+ | - Use the "PCAP Totals" | ||
+ | - Tools > Explore to query flows. | ||
+ | |||
+ | {{: | ||
docker/pcap_analysis.1519651088.txt.gz · Last modified: 2018/02/26 18:48 by vivek