Suricata, the Terminator of IDS/IPS world ric Leblond OISF July 9, - - PowerPoint PPT Presentation

▶
suricata the terminator of ids ips world
SMART_READER_LITE
LIVE PREVIEW

Suricata, the Terminator of IDS/IPS world ric Leblond OISF July 9, - - PowerPoint PPT Presentation

May 12, 2023 2.07k likes •2.73k views

Suricata, the Terminator of IDS/IPS world ric Leblond OISF July 9, 2013 ric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 1 / 40 Some word about me Eric Leblond French Previously, co-founder and CTO of EdenWall

slide-1
SLIDE 1

Suricata, the Terminator of IDS/IPS world

Éric Leblond

OISF

July 9, 2013

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 1 / 40

slide-2
SLIDE 2

Some word about me

Eric Leblond

French Previously, co-founder and CTO of EdenWall (RIP) Now, Contractor Suricata IDS/IPS developer @Regiteric on Twitter

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 2 / 40

slide-3
SLIDE 3

Some word about me

Eric Leblond

French Previously, co-founder and CTO of EdenWall (RIP) Now, Contractor Suricata IDS/IPS developer @Regiteric on Twitter

regit@netfilter.org

Netfilter Coreteam Member Working on:

some kernel stuff libnetfilter_queue and userspace library ulogd2 maintainer

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 2 / 40

slide-4
SLIDE 4

1

Suricata Ecosystem Goals of the project Features Advanced functionalities

2

IPS IPS basics WTF

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 3 / 40

slide-5
SLIDE 5

IDS? IPS?

System to uncover malicious/unwanted activity on your network by inspecting the network traffic.

IDS

(Network) Intrusion Detection System Passive, it only looks and alerts the admin Compare to security camera

IPS

(Network) Intrusion Prevention System Active, tries to prevent badness from happening Compare to security checkpoint

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 4 / 40

slide-6
SLIDE 6

Suricata reconstruction and normalization

https://home.regit.org/~regit/decomp-en.svg

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 5 / 40

slide-7
SLIDE 7

Similar projects

Bro

Different technology (capture oriented) Statistical study Scripting Complementary

Snort

Equivalent Compatible Competing project

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 6 / 40

slide-8
SLIDE 8

Suricata vs Snort

Suricata

Driven by a foundation Multi-threaded Native IPS Advanced functions (flowint, libHTP , LuaJIT scripting) PF_RING support, CUDA support Modern and modular code Young but dynamic

Snort

Developed by Sourcefire Multi-process IPS support SO ruleset (advanced logic + perf but closed) No hardware acceleration Old code 10 years of experience

Independant study: http://www.aldeid.com/index.php/Suricata-vs-snort

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 7 / 40

slide-9
SLIDE 9

Suricata with Snort ruleset

Not optimised Don’t use any advanced features

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 8 / 40

slide-10
SLIDE 10

Suricata with dedicated ruleset

Uses Suricata optimised detection Uses Suricata advanced keywords Can get one for free from http://www.emergingthreats.net/

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 9 / 40

slide-11
SLIDE 11

About OISF

Open Information Security Foundation http://www.openinfosecfoundation.org Non-profit foundation organized to build a next generation IDS/IPS engine Funded by US Governement (DHS, Navy) Development of an Open Source IDS/IPS:

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 10 / 40

slide-12
SLIDE 12

About OISF

Open Information Security Foundation http://www.openinfosecfoundation.org Non-profit foundation organized to build a next generation IDS/IPS engine Funded by US Governement (DHS, Navy) Development of an Open Source IDS/IPS:

Paying Developers

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 10 / 40

slide-13
SLIDE 13

About OISF

Open Information Security Foundation http://www.openinfosecfoundation.org Non-profit foundation organized to build a next generation IDS/IPS engine Funded by US Governement (DHS, Navy) Development of an Open Source IDS/IPS:

Paying Developers Financial support of related projects (barnyard2)

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 10 / 40

slide-14
SLIDE 14

About OISF

Open Information Security Foundation http://www.openinfosecfoundation.org Non-profit foundation organized to build a next generation IDS/IPS engine Funded by US Governement (DHS, Navy) Development of an Open Source IDS/IPS:

Paying Developers Financial support of related projects (barnyard2) Board which oversees foundation management

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 10 / 40

slide-15
SLIDE 15

About OISF

Open Information Security Foundation http://www.openinfosecfoundation.org Non-profit foundation organized to build a next generation IDS/IPS engine Funded by US Governement (DHS, Navy) Development of an Open Source IDS/IPS:

Paying Developers Financial support of related projects (barnyard2) Board which oversees foundation management Roadmap is defined in public brainstorm sessions

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 10 / 40

slide-16
SLIDE 16

About OISF

Consortium members

HOST program: Homeland Open Security Technology Platinium level: BAE Systems, nPulse Gold level: Tilera, Endace, Emerging Threats Bronze level: SRC, Everis, NitroSecurity, Myricom, Emulex Technology partner: Napatech, Nvidia

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 11 / 40

slide-17
SLIDE 17

About OISF

Consortium members

HOST program: Homeland Open Security Technology Platinium level: BAE Systems, nPulse Gold level: Tilera, Endace, Emerging Threats Bronze level: SRC, Everis, NitroSecurity, Myricom, Emulex Technology partner: Napatech, Nvidia

Developers

Lead: Victor Julien Core Developers: Anoop Saldanha, Eric Leblond Developers: serveral from consortium members, community. Suricata has been created by about 35 developers so far.

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 11 / 40

slide-18
SLIDE 18

About OISF

Consortium members

HOST program: Homeland Open Security Technology Platinium level: BAE Systems, nPulse Gold level: Tilera, Endace, Emerging Threats Bronze level: SRC, Everis, NitroSecurity, Myricom, Emulex Technology partner: Napatech, Nvidia

Developers

Lead: Victor Julien Core Developers: Anoop Saldanha, Eric Leblond Developers: serveral from consortium members, community. Suricata has been created by about 35 developers so far.

Board

Project leader: Matt Jonkman Richard Bejtlich, Dr. Jose Nazario, Joel Ebrahimi, Marc Norton, Stuart Wilson

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 11 / 40

slide-19
SLIDE 19

Goals

Bring new technologies to IDS Performance: Multi-Threading, Hardware acceleration Open source: community driven (GPLv2) Support of Linux / *BSD / Mac OSX / Windows

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 12 / 40

slide-20
SLIDE 20

Features

IPv6 native support

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 13 / 40

slide-21
SLIDE 21

Features

IPv6 native support Multi-threaded

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 13 / 40

slide-22
SLIDE 22

Features

IPv6 native support Multi-threaded Native hardware acceleration (PF_RING, Napatech, Endace, Myricom)

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 13 / 40

slide-23
SLIDE 23

Features

IPv6 native support Multi-threaded Native hardware acceleration (PF_RING, Napatech, Endace, Myricom) Numerous options for performance optimisation

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 13 / 40

slide-24
SLIDE 24

Features

IPv6 native support Multi-threaded Native hardware acceleration (PF_RING, Napatech, Endace, Myricom) Numerous options for performance optimisation Optimized support of IP only tests

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 13 / 40

slide-25
SLIDE 25

Features

IPv6 native support Multi-threaded Native hardware acceleration (PF_RING, Napatech, Endace, Myricom) Numerous options for performance optimisation Optimized support of IP only tests IPS is native (inline mode)

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 13 / 40

slide-26
SLIDE 26

Features

IPv6 native support Multi-threaded Native hardware acceleration (PF_RING, Napatech, Endace, Myricom) Numerous options for performance optimisation Optimized support of IP only tests IPS is native (inline mode) Protocol detection

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 13 / 40

slide-27
SLIDE 27

Features

IPv6 native support Multi-threaded Native hardware acceleration (PF_RING, Napatech, Endace, Myricom) Numerous options for performance optimisation Optimized support of IP only tests IPS is native (inline mode) Protocol detection Advanced HTTP and TLS support

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 13 / 40

slide-28
SLIDE 28

Features

IPv6 native support Multi-threaded Native hardware acceleration (PF_RING, Napatech, Endace, Myricom) Numerous options for performance optimisation Optimized support of IP only tests IPS is native (inline mode) Protocol detection Advanced HTTP and TLS support File extraction

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 13 / 40

slide-29
SLIDE 29

Features

IPv6 native support Multi-threaded Native hardware acceleration (PF_RING, Napatech, Endace, Myricom) Numerous options for performance optimisation Optimized support of IP only tests IPS is native (inline mode) Protocol detection Advanced HTTP and TLS support File extraction LuaJIT scripting (experimental)

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 13 / 40

slide-30
SLIDE 30

Features

IPv6 native support Multi-threaded Native hardware acceleration (PF_RING, Napatech, Endace, Myricom) Numerous options for performance optimisation Optimized support of IP only tests IPS is native (inline mode) Protocol detection Advanced HTTP and TLS support File extraction LuaJIT scripting (experimental) IP Reputation and GeoIP

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 13 / 40

slide-31
SLIDE 31

Suricata Ecosystem

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 14 / 40

slide-32
SLIDE 32

Example of high performance Suricata setup

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 15 / 40

slide-33
SLIDE 33

Entry modules

IDS

PCAP

live, multi interface

  • ffline support

AF_PACKET PF_RING: kernel level, http://www.ntop.org/PF_RING.html Capture card support: Napatech, Myricom, Endace

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 16 / 40

slide-34
SLIDE 34

Entry modules

IDS

PCAP

live, multi interface

  • ffline support

AF_PACKET PF_RING: kernel level, http://www.ntop.org/PF_RING.html Capture card support: Napatech, Myricom, Endace

IPS

NFQueue:

Linux: multi-queue, advanced support

AF_PACKET:

Linux: bridge

ipfw :

FreeBSD, NetBSD, Mac OSX

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 16 / 40

slide-35
SLIDE 35

Output modules

Fastlog (simple alerts) Unified2 log (full alerts, Barnyard2) HTTP log (log in apache-style format) TLS log (log certs) Pcap log (full packet capture to disk) Prelude (IDMEF) File log (files transfered over HTTP)

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 17 / 40

slide-36
SLIDE 36

libhtp

Security oriented HTTP parser Written by Ivan Risti´ c (ModSecurity, IronBee) Support of several keywords

http_method http_uri & http_raw_uri http_client_body & http_server_body http_header & http_raw_header http_cookie serveral more. . .

Able to decode gzip compressed flows

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 18 / 40

slide-37
SLIDE 37

Using HTTP features in signature

Signature example: Chat facebook

a l e r t http $HOME_NET any −> $EXTERNAL_NET $HTTP_PORTS \ ( msg: "ET CHAT Facebook Chat ( send message ) " ; \ flow : established , to_server ; content : "POST" ; http_method ; \ content : " / ajax / chat / send . php " ; h t t p _ u r i ; content : " facebook .com" ; http_header ; \ classtype : policy−v i o l a t i o n ; reference : url , doc . emergingthreats . net /2010784; \ reference : url ,www. emergingthreats . net / cgi−bin / cvsweb . cgi / sigs / POLICY / POLICY_Facebook_Chat ; \ sid :2010784; rev : 4 ; \ )

This signature tests: The HTTP method: POST The page: /ajax/chat/send.php The domain: facebook.com

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 19 / 40

slide-38
SLIDE 38

Extraction and inspection of files

Get files from HTTP downloads and uploads Detect information about the file using libmagic

Type of file Other details Author (if available)

A dedicated extension of signature language SMTP support coming soon

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 20 / 40

slide-39
SLIDE 39

Dedicated keywords

filemagic : description of content

a l e r t http any any −> any any (msg: " windows exec " ; \ filemagic : " executable f o r MS Windows" ; sid : 1 ; rev : 1 ; )

filestore : store file for inspection

a l e r t http any any −> any any (msg: " windows exec " ; filemagic : " executable f o r MS Windows" ; \ f i l e s t o r e ; sid : 1 ; rev : 1 ; )

fileext : file extension

a l e r t http any any −> any any (msg: " jpg claimed , but not jpg f i l e " ; \ f i l e e x t : " jpg " ; \ filemagic : ! "JPEG image data " ; sid : 1 ; rev : 1 ; )

filename : file name

a l e r t http any any −> any any (msg: " s e n s i t i v e f i l e leak " ; filename : " secret " ; sid : 1 ; rev : 1 ; ) Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 21 / 40

slide-40
SLIDE 40

Examples

Files sending on a server only accepting PDF

a l e r t http $EXTERNAL_NET −> $WEBSERVER any (msg: " suspicious upload " ; \ flow : established , to_server ; content : "POST" http_method ; \ content : " / upload . php " ; h t t p _ u r i ; \ filemagic : ! "PDF document " ; \ f i l e s t o r e ; sid : 1 ; rev : 1 ; )

Private keys in the wild

a l e r t http $HOME_NET any −> $EXTERNAL_NET any (msg: " outgoing p ri v a t e key " ; \ filemagic : "RSA p ri v a t e key " ; sid : 1 ; rev : 1 ; ) Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 22 / 40

slide-41
SLIDE 41

Disk storage

Every file can be stored to disk with a metadata file Disk usage limit can be set Scripts for looking up files / file md5’s at Virus Total and others

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 23 / 40

slide-42
SLIDE 42

1

Suricata Ecosystem Goals of the project Features Advanced functionalities

2

IPS IPS basics WTF

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 24 / 40

slide-43
SLIDE 43

3 major modes

Netfilter

Use libnetfilter_queue and NFQUEUE Verdict packet redirected by iptables rules Up-to-date support Maximum around 5Gb/s

ipfw

Use divert socket Dedicated filtering rules must be added

AF_PACKET

Use Linux capture Ethernet transparent mode Experimental

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 25 / 40

slide-44
SLIDE 44

Rules management

The transformation

Make some rules start with drop instead of alert A selection must be made

Tool usage

Rules are updated A tool is needed to have modifications resist to update Pulledpork: http://code.google.com/p/pulledpork/

  • inkmaster: http://oinkmaster.sourceforge.net/

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 26 / 40

slide-45
SLIDE 45

WTF: Word Termination Feature

Objective

Fight against Word file transfer Because it is Office is heavy like hell And you even have to pay for it

Method

Mark packet when a Word file is transferred Limit bandwith with Linux QoS

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 27 / 40

slide-46
SLIDE 46

WTF: Waiting Transfer to Finish

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 28 / 40

slide-47
SLIDE 47

Suricata configuration

The rule

a l e r t http any any −> any any ( \ msg: " Microsoft Word upload " ; \ nfq_set_mark :0 x1 /0 x1 ; \ filemagic : " Composite Document F i l e V2 Document" ; \ sid :666 ; rev : 1 ; )

Running suricata

suricata −q 0 −S word . rules

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 29 / 40

slide-48
SLIDE 48

Netfilter configuration (1/2)

Queueing packets

ip t a b l e s −I FORWARD −p tcp − −dport 80 −j NFQUEUE ip t a b l e s −I FORWARD −p tcp − −sport 80 −j NFQUEUE # ip t a b le s −I OUTPUT −p tcp − −dport 80 −j NFQUEUE # ip t a b le s −I INPUT −p tcp − −sport 80 −j NFQUEUE

Analysing packets

Suricata needs to get all packets Get all packets in both way NFQUEUE is a terminal target

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 30 / 40

slide-49
SLIDE 49

Netfilter configuration (2/2)

Propagating the mark

Mark is set on packet We want to mark all packet of a connection We need to propagate the mark CONNMARK target is made for that

Using CONNMARK

ip t a b l e s −A PREROUTING −t mangle −j CONNMARK − −restore−mark ip t a b l e s −A POSTROUTING −t mangle −j CONNMARK − −save−mark # ip t a b le s −A OUTPUT −t mangle −j CONNMARK − −restore−mark

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 31 / 40

slide-50
SLIDE 50

One slide of QoS

A diffserv implementation

Controlling how packets are sent

Reordering the queue Introducing delay Dropping packets

Different algorithm available

Queueless: fifo, prio With queue: cbq, htb, . . .

HTB example

Split bandwith in different part Assign to part

Minimum guarantee bandwith Maximum bandwith Priority

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 32 / 40

slide-51
SLIDE 51

Linux QoS configuration

Setting up QoS tree

tc qdisc add dev eth0 root \ handle 1: htb d e f au l t 0 tc class add dev eth0 parent 1: \ classid 1:1 htb \ rate 1kbps c e i l 1kbps

Sending marked packets to their fate

tc f i l t e r add dev eth0 parent 1: \ protocol ip prio 1 \ handle 1 fw flowi d 1:1

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 33 / 40

slide-52
SLIDE 52

Evasion technique

What would you test to avoid this

Change file extension Send compressed file

Filename extension change

Most likely to happen Easy to spot in the IDS

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 34 / 40

slide-53
SLIDE 53

Detecting evasion technique

Detecting the evasion

a l e r t http any any −> any any ( \ msg: " Tricky Microsoft Word upload " ; \ nfq_set_mark :0 x2 /0 x2 ; \ f i l e e x t : ! " doc " ; \ filemagic : " Composite Document F i l e V2 Document" ; \ f i l e s t o r e ; \ sid :667; rev : 1 ; )

Being nice with clever people

tc class add dev eth0 parent 1: classid 1:2 htb \ rate 10kbps c e i l 10kbps tc f i l t e r add dev eth0 parent 1: protocol ip \ prio 1 handle 2 fw flowid 1:2

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 35 / 40

slide-54
SLIDE 54

Watching the clever ones (1/2)

Watching the clever one from behind a PRISM

Getting the most information possible about the clevers Storing in a pcap file all their trafic for a certain amount of time

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 36 / 40

slide-55
SLIDE 55

Watching the clever ones (1/2)

Watching the clever one from behind a PRISM

Getting the most information possible about the clevers Storing in a pcap file all their trafic for a certain amount of time

Difficulty

We’ve got a mark on the connection and we want to keep all trafic We need a method to pass from connection to IP

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 36 / 40

slide-56
SLIDE 56

Watching the clever ones (1/2)

Watching the clever one from behind a PRISM

Getting the most information possible about the clevers Storing in a pcap file all their trafic for a certain amount of time

Difficulty

We’ve got a mark on the connection and we want to keep all trafic We need a method to pass from connection to IP

A possible method: ipset + ulogd

ipset allows set handling set can be list of IPs with timeout it is possible to update a set from an iptables rules we can populate a set log all packets from the set to a pcap file with ulogd

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 36 / 40

slide-57
SLIDE 57

One slide of Ipset

Efficient set handling

Allow fast and efficient update of ruleset Define set that can match and be update fast Different type of set

bitmap:ip hash:net hash:ip,port,ip . . .

Component

ipset: command line utility to maintain the set set match: do matching on the set SET target: update set if rule match

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 37 / 40

slide-58
SLIDE 58

Watching the clever ones (2/2)

Using ipset to mark packets

ipset create cheaters hash : ip timeout 3600 i p t a b l e s −A POSTROUTING −t mangle − m mark \ −−mark 0x2 /0 x2 \ −j SET −−add−set cheaters src −−exis ts

Logging marked packets

i p t a b l e s −A PREROUTING −t raw \ − m set −−match−set cheaters src , dst \ −j NFLOG −−nflog−group 1

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 38 / 40

slide-59
SLIDE 59

Ulogd to keep the trace

Ulogd2

Netfilter logging daemon Inputs: NFLOG, NFCT, NFACCT, . . . Outputs: syslog, file, DB, pcap, . . .

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 39 / 40

slide-60
SLIDE 60

Ulogd to keep the trace

Ulogd2

Netfilter logging daemon Inputs: NFLOG, NFCT, NFACCT, . . . Outputs: syslog, file, DB, pcap, . . .

Configuring ulogd

Ulogd will log packets to a pcap file We need to activate a stack in ulogd.conf:

plugin="/usr/local/lib/ulogd/ulogd_output_PCAP.so" stack=log2:NFLOG,base1:BASE,pcap1:PCAP

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 39 / 40

slide-61
SLIDE 61

Ulogd to keep the trace

Ulogd2

Netfilter logging daemon Inputs: NFLOG, NFCT, NFACCT, . . . Outputs: syslog, file, DB, pcap, . . .

Configuring ulogd

Ulogd will log packets to a pcap file We need to activate a stack in ulogd.conf:

plugin="/usr/local/lib/ulogd/ulogd_output_PCAP.so" stack=log2:NFLOG,base1:BASE,pcap1:PCAP

Starting ulogd

ulogd −c ulogd . conf

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 39 / 40

slide-62
SLIDE 62

Questions

Do you have any questions?

Thanks to

RMLL team for accepting this conference All Netfilter developers for their cool work

More information

Suricata website: http://www.suricata-ids.org/ Netfilter: http://www.netfilter.org/ Ipset: http://ipset.netfilter.org/ Regit’s blog : https://home.regit.org

Contact us

Eric Leblond: eric@regit.org, @Regiteric on twitter OISF-users and OISF-devel mailing lists

Éric Leblond (OISF) Suricata, the Terminator of IDS/IPS world July 9, 2013 40 / 40