[prev in list] [next in list] [prev in thread] [next in thread]
List: dragonidsuser
Subject: RE: [Dragonidsuser] Add destination port to TCP/UDP SWEEP events?
From: "Patrick L. Knight" <patrick.knight () enterasys ! com>
Date: 2004-09-23 12:57:55
Message-ID: 1095944275.1357.1.camel () localhost ! localdomain
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
There's been no decision on that as we are focusing on the 7.0 release.
However if there is another 6.x, this change will be included.
Patrick
On Thu, 2004-09-23 at 07:21, Tom.Vincent@verizonwireless.com wrote:
> Does that mean they'll be a 6.3.2?
>
> > -----Original Message-----
> > From: dragonidsuser-admin@enterasys.com
> > [mailto:dragonidsuser-admin@enterasys.com] On Behalf Of
> > Patrick L. Knight
> > Sent: Wednesday, September 22, 2004 5:15 PM
> > To: dragonidsuser@enterasys.com
> > Subject: Re: [Dragonidsuser] Add destination port to TCP/UDP
> > SWEEP events?
> >
> > O.K. Now you can see the destination port on the realtime
> > console for TCP-/UDP-SWEEP events in the format of:
> >
> > 10.10.10.10:0 0.0.0.0:80
> >
> > This change is being made for all dragon sensor binaries
> > released after 6.3.1.
> >
> > Patrick
> >
> > On Tue, 2004-09-21 at 11:47, Hank Leininger wrote:
> >
> > *** PGP SIGNATURE VERIFICATION ***
> > *** Status: Unknown Signature
> > *** Signer: Unknown Key (0x861AA6F1)
> > *** Signed: 9/21/2004 11:47:52 AM
> > *** Verified: 9/23/2004 7:20:56 AM
> > *** BEGIN PGP VERIFIED MESSAGE ***
> >
> > Hash: SHA1
> >
> > On Thu, 6 May 2004 kurt@cyberanderson.com wrote:
> >
> > > I third Hank's comment.
> >
> > I fourth my own comment :-P
> >
> > This is really rising as a point-of-pain for us. I really wish
> >
> > TCP-SWEEP and UDP-SWEEP events put the swept-for port in the dport of
> >
> > the event (so it'd be 0.0.0.0:135 or whatever). Is there any
> > chance of
> >
> > this being included in Dragon 7.0? Or even 6.3.2 if there is such a
> >
> > thing? It would seem like such a tiny change.
> >
> > Alternately/in the meantime, has anybody tried modifying
> > rtu-mysql.pl to
> >
> > parse the port= out of the event metadata, and stuff it in as
> > the dport
> >
> > for SWEEP database records?
> >
> > For anybody using Dragon to monitor lots of mostly-uncontrolled
> >
> > clients, like a University or ISP environment, I'd think this would be
> >
> > very useful for figuring out what the "painful port of the day" is,
> >
> > because you can't play whack-a-mole with infected hosts, but you may
> >
> > have a chance at throwing up filters for the
> > top-ten-abused-ports on all
> >
> > your perimeter / access devices.
> >
> > As it is, knowing that 80%-90% of all events in environments like that
> >
> > are TCP-SWEEPs, but not knowing what ports are being scanned,
> > etc helps
> >
> > only in the very long term; in the near-term it's not
> > meaningful at all.
> >
> > So more and more often I hit dead-ends with the built in reporting
> >
> > capabilities, and have to toss them aside to write custom ones. Which
> >
> > gets old :(
> >
> > Can I get an Amen? Uh, I mean, a "me too"?
> >
> > Thanks,
> >
> > Hank
> >
> > > If a director happens to ask a lower level analyst to
> >
> > > report on how many TCP-SWEEP are to port 445, for
> >
> > > example, their skill set may not include doing command
> >
> > > line queries. Custom queries from the browser should
> >
> > > be sufficient to gather this type of request and this
> >
> > > is not currently possible.
> >
> > >
> >
> > >
> >
> > >
> >
> > > On Thu, 6 May 2004 14:14:39 -0400 (EDT), Clarke
> >
> > > Morledge wrote:
> >
> > >
> >
> > > >
> >
> > > > Yes, I second Hank's motion regarding the output for
> >
> > > > the TCP-SWEEP and
> >
> > > > UDP-SWEEP events.
> >
> > > >
> >
> > > > Also, you can probably do something like this on the
> >
> > > > ICMP sweeps, but this
> >
> > > > would be a little tricky since I'd be most interested
> >
> > > > in two particular
> >
> > > > pieces of info: ICMP type and code, instead of TCP or
> >
> > > > UDP port. But even
> >
> > > > if I just got one of those, type or code, would be
> >
> > > > better than nothing.
> >
> > > >
> >
> > > > However, this is all assuming your ICMP-SWEEP is
> >
> > > paying
> >
> > > > attention to ICMP
> >
> > > > type/code as part of the unique event.
> >
> > > >
> >
> > > >
> >
> > > > Clarke Morledge
> >
> > > > College of William and Mary
> >
> > > > Information Technology - Network Engineering
> >
> > > > Jones Hall (Room 18)
> >
> > > > Williamsburg VA 23187
> >
> > > >
> >
> > > > On Thu, 6 May 2004, Hank Leininger wrote:
> >
> > > >
> >
> > > > > For TCP-SWEEP and UDP-SWEEP events, the destination
> >
> > > > host is 0.0.0.0
> >
> > > > > (with more details in the supplemental data). This
> >
> > > > makes sense; when
> >
> > > > > there are multiple targets, there's no one dest IP
> >
> > > > that should be filled
> >
> > > > > in.
> >
> > > > >
> >
> > > > > But... the destination port is not filled in
> >
> > > either.
> >
> > > > It would be really
> >
> > > > > helpful for quick overviews, and/or various data
> >
> > > > mining, if SWEEP events
> >
> > > > > recorded the destination as 0.0.0.0:445,
> >
> > > > 0.0.0.0:1434, etc. Right now I
> >
> > > > > typically use various awk foo on the .log files to
> >
> > > > aggregate sweeps by
> >
> > > > > target port (and therefore, categorize by likely
> >
> > > worm
> >
> > > > / broken
> >
> > > > > applications, etc). But if sweep events included
> >
> > > the
> >
> > > > destination-port
> >
> > > > > in the regular event data, it would be possible to
> >
> > > do
> >
> > > > useful things with
> >
> > > > > them in rts's custom query, etc. Possible for 7.0?
> >
> > > > >
> >
> > > > > Thanks,
> >
> > > > >
> >
> > > > > Hank Leininger <hlein@progressive-comp.com>
> >
> > > >
> >
> > > > _______________________________________________
> >
> > > > Dragonidsuser mailing list
> >
> > > >
> >
> > > > For help please follow the below instructions.
> >
> > > > You can make subsciption adjustments via email by
> >
> > > > sending a message to:
> >
> > > >
> >
> > > > Dragonidsuser-request@enterasys.com
> >
> > > >
> >
> > > > with the word `help' in the subject or body (don't
> >
> > > > include the quotes), and you will get back a message
> >
> > > > with instructions.
> >
> > > >
> >
> > > > You must know your password to change your options
> >
> > > > (including changing the password, itself) or to
> >
> > > > unsubscribe.
> >
> > > > If you forget your password, don't worry, you will
> >
> > > > receive a monthly reminder telling you what all your
> >
> > > > enterasys.com mailing list passwords are, and how to
> >
> > > > unsubscribe or change your options.
> >
> > >
> >
> > > Kurt C Anderson
> >
> > > 763-744-1949 (w)
> >
> > > 763-537-8924 (h)
> >
> > > _______________________________________________
> >
> > > Dragonidsuser mailing list
> >
> > >
> >
> > > For help please follow the below instructions.
> >
> > > You can make subsciption adjustments via email by sending a
> > message to:
> >
> > >
> >
> > > Dragonidsuser-request@enterasys.com
> >
> > >
> >
> > > with the word `help' in the subject or body (don't include
> > the quotes), and you will get back a message with instructions.
> >
> > >
> >
> > > You must know your password to change your options
> > (including changing the password, itself) or to unsubscribe.
> >
> > > If you forget your password, don't worry, you will receive
> > a monthly reminder telling you what all your enterasys.com
> > mailing list passwords are, and how to unsubscribe or change
> > your options.
> >
> > >
> >
> > Hank Leininger <hlein@progressive-comp.com>
> >
> > E407 AEF4 761E D39C D401 D4F4 22F8 EF11 861A A6F1
> >
> >
> > *** END PGP VERIFIED MESSAGE ***
> >
> > _______________________________________________
> >
> > Dragonidsuser mailing list
> >
> > For help please follow the below instructions.
> >
> > You can make subsciption adjustments via email by sending a
> > message to:
> >
> > Dragonidsuser-request@enterasys.com
> >
> > with the word `help' in the subject or body (don't include
> > the quotes), and you will get back a message with instructions.
> >
> > You must know your password to change your options (including
> > changing the password, itself) or to unsubscribe.
> >
> > If you forget your password, don't worry, you will receive a
> > monthly reminder telling you what all your enterasys.com
> > mailing list passwords are, and how to unsubscribe or change
> > your options.
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> > Patrick L. Knight
> >
> >
> > Security Engineer
> >
> >
> > Dragon Network Sensor
> >
> >
> >
> >
> >
> > Enterasys Networks
> >
> >
> > 7160 Columbia Gateway Drive
> >
> >
> > Suite 201
> >
> >
> > Columbia, MD 21046
> >
> >
> >
> >
> >
> > Phone: 410-423-3611
> >
> >
> > Fax: 410-312-4840
> >
> >
> >
> >
> >
> > http://dragon.enterasys.com
> >
> >
> >
> >
> >
> _______________________________________________
> Dragonidsuser mailing list
>
> For help please follow the below instructions.
> You can make subsciption adjustments via email by sending a message to:
>
> Dragonidsuser-request@enterasys.com
>
> with the word `help' in the subject or body (don't include the quotes), and you \
> will get back a message with instructions.
> You must know your password to change your options (including changing the \
> password, itself) or to unsubscribe. If you forget your password, don't worry, \
> you will receive a monthly reminder telling you what all your enterasys.com mailing \
> list passwords are, and how to unsubscribe or change your options.
Patrick L. Knight
Security Engineer
Dragon Network Sensor
Enterasys Networks
7160 Columbia Gateway Drive
Suite 201
Columbia, MD 21046
Phone: 410-423-3611
Fax: 410-312-4840
http://dragon.enterasys.com
[Attachment #5 (text/html)]
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.0.10">
</HEAD>
<BODY>
There's been no decision on that as we are focusing on the 7.0 release. However if \
there is another 6.x, this change will be included.<BR> <BR>
Patrick<BR>
<BR>
On Thu, 2004-09-23 at 07:21, Tom.Vincent@verizonwireless.com wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE><FONT COLOR="#0c0c0c"><I>Does that mean they'll be a 6.3.2?
> -----Original Message-----
> From: dragonidsuser-admin@enterasys.com
> [mailto:dragonidsuser-admin@enterasys.com] On Behalf Of
> Patrick L. Knight
> Sent: Wednesday, September 22, 2004 5:15 PM
> To: dragonidsuser@enterasys.com
> Subject: Re: [Dragonidsuser] Add destination port to TCP/UDP
> SWEEP events?
>
> O.K. Now you can see the destination port on the realtime
> console for TCP-/UDP-SWEEP events in the format of:
>
> 10.10.10.10:0 0.0.0.0:80
>
> This change is being made for all dragon sensor binaries
> released after 6.3.1.
>
> Patrick
>
> On Tue, 2004-09-21 at 11:47, Hank Leininger wrote:
>
> *** PGP SIGNATURE VERIFICATION ***
> *** Status: Unknown Signature
> *** Signer: Unknown Key (0x861AA6F1)
> *** Signed: 9/21/2004 11:47:52 AM
> *** Verified: 9/23/2004 7:20:56 AM
> *** BEGIN PGP VERIFIED MESSAGE ***
>
> Hash: SHA1
>
> On Thu, 6 May 2004 kurt@cyberanderson.com wrote:
>
> > I third Hank's comment.
>
> I fourth my own comment :-P
>
> This is really rising as a point-of-pain for us. I really wish
>
> TCP-SWEEP and UDP-SWEEP events put the swept-for port in the dport of
>
> the event (so it'd be 0.0.0.0:135 or whatever). Is there any
> chance of
>
> this being included in Dragon 7.0? Or even 6.3.2 if there is such a
>
> thing? It would seem like such a tiny change.
>
> Alternately/in the meantime, has anybody tried modifying
> rtu-mysql.pl to
>
> parse the port= out of the event metadata, and stuff it in as
> the dport
>
> for SWEEP database records?
>
> For anybody using Dragon to monitor lots of mostly-uncontrolled
>
> clients, like a University or ISP environment, I'd think this would be
>
> very useful for figuring out what the "painful port of the day" is,
>
> because you can't play whack-a-mole with infected hosts, but you may
>
> have a chance at throwing up filters for the
> top-ten-abused-ports on all
>
> your perimeter / access devices.
>
> As it is, knowing that 80%-90% of all events in environments like that
>
> are TCP-SWEEPs, but not knowing what ports are being scanned,
> etc helps
>
> only in the very long term; in the near-term it's not
> meaningful at all.
>
> So more and more often I hit dead-ends with the built in reporting
>
> capabilities, and have to toss them aside to write custom ones. Which
>
> gets old :(
>
> Can I get an Amen? Uh, I mean, a "me too"?
>
> Thanks,
>
> Hank
>
> > If a director happens to ask a lower level analyst to
>
> > report on how many TCP-SWEEP are to port 445, for
>
> > example, their skill set may not include doing command
>
> > line queries. Custom queries from the browser should
>
> > be sufficient to gather this type of request and this
>
> > is not currently possible.
>
> >
>
> >
>
> >
>
> > On Thu, 6 May 2004 14:14:39 -0400 (EDT), Clarke
>
> > Morledge wrote:
>
> >
>
> > >
>
> > > Yes, I second Hank's motion regarding the output for
>
> > > the TCP-SWEEP and
>
> > > UDP-SWEEP events.
>
> > >
>
> > > Also, you can probably do something like this on the
>
> > > ICMP sweeps, but this
>
> > > would be a little tricky since I'd be most interested
>
> > > in two particular
>
> > > pieces of info: ICMP type and code, instead of TCP or
>
> > > UDP port. But even
>
> > > if I just got one of those, type or code, would be
>
> > > better than nothing.
>
> > >
>
> > > However, this is all assuming your ICMP-SWEEP is
>
> > paying
>
> > > attention to ICMP
>
> > > type/code as part of the unique event.
>
> > >
>
> > >
>
> > > Clarke Morledge
>
> > > College of William and Mary
>
> > > Information Technology - Network Engineering
>
> > > Jones Hall (Room 18)
>
> > > Williamsburg VA 23187
>
> > >
>
> > > On Thu, 6 May 2004, Hank Leininger wrote:
>
> > >
>
> > > > For TCP-SWEEP and UDP-SWEEP events, the destination
>
> > > host is 0.0.0.0
>
> > > > (with more details in the supplemental data). This
>
> > > makes sense; when
>
> > > > there are multiple targets, there's no one dest IP
>
> > > that should be filled
>
> > > > in.
>
> > > >
>
> > > > But... the destination port is not filled in
>
> > either.
>
> > > It would be really
>
> > > > helpful for quick overviews, and/or various data
>
> > > mining, if SWEEP events
>
> > > > recorded the destination as 0.0.0.0:445,
>
> > > 0.0.0.0:1434, etc. Right now I
>
> > > > typically use various awk foo on the .log files to
>
> > > aggregate sweeps by
>
> > > > target port (and therefore, categorize by likely
>
> > worm
>
> > > / broken
>
> > > > applications, etc). But if sweep events included
>
> > the
>
> > > destination-port
>
> > > > in the regular event data, it would be possible to
>
> > do
>
> > > useful things with
>
> > > > them in rts's custom query, etc. Possible for 7.0?
>
> > > >
>
> > > > Thanks,
>
> > > >
>
> > > > Hank Leininger <hlein@progressive-comp.com>
>
> > >
>
> > > _______________________________________________
>
> > > Dragonidsuser mailing list
>
> > >
>
> > > For help please follow the below instructions.
>
> > > You can make subsciption adjustments via email by
>
> > > sending a message to:
>
> > >
>
> > > Dragonidsuser-request@enterasys.com
>
> > >
>
> > > with the word `help' in the subject or body (don't
>
> > > include the quotes), and you will get back a message
>
> > > with instructions.
>
> > >
>
> > > You must know your password to change your options
>
> > > (including changing the password, itself) or to
>
> > > unsubscribe.
>
> > > If you forget your password, don't worry, you will
>
> > > receive a monthly reminder telling you what all your
>
> > > enterasys.com mailing list passwords are, and how to
>
> > > unsubscribe or change your options.
>
> >
>
> > Kurt C Anderson
>
> > 763-744-1949 (w)
>
> > 763-537-8924 (h)
>
> > _______________________________________________
>
> > Dragonidsuser mailing list
>
> >
>
> > For help please follow the below instructions.
>
> > You can make subsciption adjustments via email by sending a
> message to:
>
> >
>
> > Dragonidsuser-request@enterasys.com
>
> >
>
> > with the word `help' in the subject or body (don't include
> the quotes), and you will get back a message with instructions.
>
> >
>
> > You must know your password to change your options
> (including changing the password, itself) or to unsubscribe.
>
> > If you forget your password, don't worry, you will receive
> a monthly reminder telling you what all your enterasys.com
> mailing list passwords are, and how to unsubscribe or change
> your options.
>
> >
>
> Hank Leininger <hlein@progressive-comp.com>
>
> E407 AEF4 761E D39C D401 D4F4 22F8 EF11 861A A6F1
>
>
> *** END PGP VERIFIED MESSAGE ***
>
> _______________________________________________
>
> Dragonidsuser mailing list
>
> For help please follow the below instructions.
>
> You can make subsciption adjustments via email by sending a
> message to:
>
> Dragonidsuser-request@enterasys.com
>
> with the word `help' in the subject or body (don't include
> the quotes), and you will get back a message with instructions.
>
> You must know your password to change your options (including
> changing the password, itself) or to unsubscribe.
>
> If you forget your password, don't worry, you will receive a
> monthly reminder telling you what all your enterasys.com
> mailing list passwords are, and how to unsubscribe or change
> your options.
>
>
>
>
>
>
>
>
>
>
> Patrick L. Knight
>
>
> Security Engineer
>
>
> Dragon Network Sensor
>
>
>
>
>
> Enterasys Networks
>
>
> 7160 Columbia Gateway Drive
>
>
> Suite 201
>
>
> Columbia, MD 21046
>
>
>
>
>
> Phone: 410-423-3611
>
>
> Fax: 410-312-4840
>
>
>
>
>
> </FONT><A HREF="http://dragon.enterasys.com"><U>http://dragon.enterasys.com</U></A>
<FONT COLOR="#0c0c0c">>
>
>
>
>
_______________________________________________
Dragonidsuser mailing list
For help please follow the below instructions.
You can make subsciption adjustments via email by sending a message to:
Dragonidsuser-request@enterasys.com
with the word `help' in the subject or body (don't include the quotes), and you will \
get back a message with instructions.
You must know your password to change your options (including changing the password, \
itself) or to unsubscribe. If you forget your password, don't worry, you will \
receive a monthly reminder telling you what all your enterasys.com mailing list \
passwords are, and how to unsubscribe or change your options. </I></FONT></PRE> \
</BLOCKQUOTE> <PRE><TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
<BR>
<B>Patrick L. Knight</B><BR>
<I>Security Engineer<BR>
Dragon Network Sensor</I><BR>
<BR>
Enterasys Networks<BR>
7160 Columbia Gateway Drive<BR>
Suite 201<BR>
Columbia, MD 21046<BR>
<BR>
Phone: 410-423-3611<BR>
Fax: 410-312-4840<BR>
<BR>
http://dragon.enterasys.com
</TD>
</TR>
</TABLE>
</PRE>
</BODY>
</HTML>
["signature.asc" (application/pgp-signature)]
_______________________________________________
Dragonidsuser mailing list
For help please follow the below instructions.
You can make subsciption adjustments via email by sending a message to:
Dragonidsuser-request@enterasys.com
with the word `help' in the subject or body (don't include the quotes), and you will \
get back a message with instructions.
You must know your password to change your options (including changing the password, \
itself) or to unsubscribe. If you forget your password, don't worry, you will \
receive a monthly reminder telling you what all your enterasys.com mailing list \
passwords are, and how to unsubscribe or change your options.
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic