Catching online virus activity with Netflow

In this topic I will tell you how to establish a simple collection of statistics on anomalous activity in the network in a couple of scripts.



Abnormal for us will be at the time of removal of statistics:



1. More than 20 outgoing connections on port 25 with 1 IP.

2. More than 100 outgoing connections on port 80 with 1 IP.

3. More than 100 outgoing connections on port 53 with 1 IP.

4. Think of yourself, everything is flexible.

')

Statistics will be removed from the cache netflow routers. Whether it will be Cisco or FreeBSD is not important. I talked about setting up netflow on FreeBSD in my previous articles.



Since we are going to process statistics of outgoing connections, outflow of outgoing traffic from your network is a must in netflow.



In cisco, this will be the hanging of the “ip flow egress” parameter to the interface from which we want to analyze the outgoing traffic.

About FreeBSD, read Netgraph ipfw and flexible traffic accounting via netflow .

Principle of operation

Cisco command "sh ip cache flow"



7206#sh ip cache flow

IP packet size distribution (50885M total packets):

1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480

.000 .367 .018 .009 .005 .004 .019 .005 .004 .002 .015 .001 .002 .003 .002



512 544 576 1024 1536 2048 2560 3072 3584 4096 4608

.002 .003 .012 .030 .486 .000 .000 .000 .000 .000 .000



IP Flow Switching Cache, 4456704 bytes

14372 active, 51164 inactive, 1424895745 added

595073185 ager polls, 0 flow alloc failures

Active flows timeout in 30 minutes

Inactive flows timeout in 15 seconds

IP Sub Flow Cache, 1057544 bytes

14372 active, 18396 inactive, 1424881570 added, 1424881570 added to flow

0 alloc failures, 0 force free

2 chunks, 63 chunks added

last clearing of statistics never

Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)

-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow

TCP-Telnet 2394420 0.5 2 59 1.2 1.6 17.3

TCP-FTP 693781 0.1 12 67 1.9 4.1 7.6

TCP-FTPD 16673 0.0 4116 815 15.9 29.6 10.9

TCP-WWW 705969510 164.3 46 843 7698.6 4.6 11.0

TCP-SMTP 4790885 1.1 16 593 18.5 4.8 8.6

TCP-X 586390 0.1 3 176 0.5 1.0 17.5

TCP-BGP 377369 0.0 3 490 0.3 11.7 17.2

TCP-NNTP 492 0.0 6 270 0.0 4.5 10.8

TCP-Frag 1878 0.0 27 194 0.0 12.3 17.2

TCP-other 283995180 66.1 37 715 2505.0 5.9 12.1

UDP-DNS 42291343 9.8 1 73 10.1 0.0 19.3

UDP-NTP 1781711 0.4 1 76 0.6 7.4 17.9

UDP-TFTP 49776 0.0 5 52 0.0 21.6 17.3

UDP-Frag 293665 0.0 352 106 24.0 15.7 18.1

UDP-other 347985517 81.0 18 618 1503.7 4.4 18.7

ICMP 33442833 7.7 2 80 21.9 5.0 18.4

IGMP 2 0.0 2 28 0.0 0.9 26.5

IPv6INIP 178 0.0 4 68 0.0 13.4 18.1

GRE 60567 0.0 2878 162 40.5 185.4 15.4

IP-other 150016 0.0 89 614 3.1 69.2 17.0

Total: 1424882186 331.7 35 781 11846.6 4.7 13.5



SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts

Gi0/1 80.75.131.2 Null 123.456.123.14 06 40A0 0050 29

Gi0/1 82.116.35.44 Null 123.456.123.23 06 D52A 0050 5

Gi0/2.105 123.456.789.54 Null 195.151.255.253 06 0050 F9F0 3

Gi0/1 217.172.29.5 Null 123.456.123.33 06 E469 0050 279

Gi0/1 217.172.29.5 Null 123.456.123.43 06 E46B 0050 25

Gi0/1 217.172.29.5 Null 123.456.123.53 06 E46D 0050 51

Gi0/1 82.116.35.44 Null 123.456.123.64 06 D531 0050 5

Gi0/1 217.172.29.5 Null 123.456.123.73 06 E46E 0050 55

Gi0/1 217.172.29.5 Null 123.456.123.13 06 E46F 0050 23

Gi0/1 217.172.29.5 Null 123.456.123.23 06 E464 0050 39

Gi0/2.105 123.456.789.54 Null 67.195.111.40 06 0050 E9FC 5

Gi0/2.105 123.456.789.53 Null 83.167.97.145 06 0050 CF77 7

Gi0/2.105 123.456.789.56 Null 213.180.199.34 11 C479 0035 1

Gi0/2.103 123.456.789.30 Null 123.456.123.56 11 BB7D 0035 1

Gi0/2.105 123.456.789.56 Null 123.456.123.30 11 0035 BB7D 1



[--cut--] - [--cut--]



here comes such a conclusion, its upper part is not interesting to us, there are general statistics.



A similar conclusion, but without general statistics, under FreeBSD is given by the command “flowctl netflow show” , where netflow is the name of your ng_netflow node.



[root@border] /root/> /usr/sbin/flowctl netflow show

SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts

lo0 123.456.161.48 vlan3 212.119.237.214 6 0f93 0050 6

lo0 123.456.153.8 vlan2 154.153.8.109 17 6df4 f45f 20

lo0 123.456.164.126 vlan2 154.164.126.104 17 68eb eb5f 16

lo0 123.456.134.168 vlan2 154.134.168.139 17 8b2c 2c5f 40

lo0 123.456.169.132 vlan2 154.169.132.219 17 db31 315f 28

lo0 123.456.153.13 vlan2 154.153.13.62 17 3e3a 3a5f 28

lo0 123.456.147.214 vlan2 154.147.214.54 17 3658 585f 4

lo0 123.456.161.167 vlan2 154.161.167.102 17 66f5 f55f 4

lo0 123.456.144.147 vlan2 154.144.147.248 17 f88b 8b5f 4

lo0 123.456.162.220 vlan2 154.162.220.42 17 2adc dc5f 27

lo0 123.456.170.119 vlan2 154.170.119.198 17 c60a 0a5f 64



[--cut--] - [--cut--]





In this output, we are interested in the “DstP” column. This is the port number in Hex.

Port 25 will look like 0019, 80 - 0050, 53 - 0035.

Job

Analyzing the output of this statistic:



We take statistics and allocate port 25:

flowctl netflow show | grep 0019

We select only the source IP from the second column “SrcIPaddress” and sort the output.

awk '{print $ 2}' | sort

We consider unique IP addresses, and display only those that are repeated more than 20 times.

uniq -c | awk '{if ($ 1> 20) print $ 2}'



We get for port 25:

[root@border] /root/>flowctl netflow show | grep 0019 | awk '{print $2}' | sort | uniq -c | awk '{ if( $1 > 20 ) print $2 }'

123.456.123.10

123.456.123.17

123.456.123.140

123.456.123.220





For port 80:

[root@border] /root/>flowctl netflow show | grep 0050 | awk '{print $2}' | sort | uniq -c | awk '{ if( $1 > 100 ) print $2 }'

123.456.123.10

123.456.123.17

123.456.123.165





For port 53:

[root@border] /root/>flowctl netflow show | grep 0035 | awk '{print $2}' | sort | uniq -c | awk '{ if( $1 > 100 ) print $2 }'

123.456.123.17

123.456.123.19





To get this statistics from cisco to the server, rsh is used, and google will tell how to configure it. In the final command, only the source of statistics will change from “flowctl netflow show” to “rsh -l login ip_cisco 'sh ip cache flow'”

Why all this?

What to do with these addresses decide for yourself.

For example, I have a crown every 5 minutes, the addresses are added to the database with which the radius server works.

The client is thrown out of the Internet, and with the next authorization, it is blocked completely. Also, when accessing via port 80, a message about violation of the network regulations due to virus activity on his computer is issued.



Thanks for attention. Net you networks!