Seguimos avanzando en la serie dedicada a Bro-IDS. En el anterior artículo vimos como instalar el nuevo Bro 2.0, vimos alguans novedades y avanzamos en el uso de Bro 2.0 con herramientas como awk, bro-cut, y vimos distintas formas de extraer información de los logs.
En esta ocasión seguimos avanzando y veremos también como redefinir variables de scripts, gráficas de tráfico de red desde los logs de Bro-IDS, estádisticas, objetos HTTP, uso de Bro Control, Capstats, etc. Vamos a ello…
Redefiniendo local_nets.
En el anterior artículo vimos que para un uso correcto de Bro, teníamos que definir las direcciones de nuestra red interna o la red interna involucrada en un .pcap. Lo hacíamos mediante línea de comandos de esta manera:
sudo /usr/local/bro/bin/bro -r /home/preludeids/pcap1/ids_4.pcap local “Site::local_nets += {192.168.1.0/24, 192.168.101.0/24, 192.168.100.0/24 }”
Pues bien, podemos definir las direcciones de red local directamente en local.bro que se encuentra en:
/usr/local/bro/share/bro/site/local.bro
Para ello añadimos las direcciones redefiniendo variables de la forma siguiente para añadir los siguientes tres rangos de direcciones privadas :
redef Site::local_nets = {
10.0.0.0/8, # Red privada.
192.168.0.0/16, # Red privada.
172.16.0.0/12, # Red privada.
};
Visualización gráfica de logs Bro 2.0 con AfterGlow.
Vamos a graficar los logs de bro. En este caso usaremos el log conn.log que conteniene información sobre las conecciones realizadas. Vamos a extraer, por ejemplo:
- IPs conexiones externas a la red
- puertos
- estado de la conexión.
Para ellos usaremos:
awk ‘{print $5 «,» $6 «,» $12}’ conn.log | sort | uniq | head -n100 > ejemplo.csv
Observad que lo que hemos hecho es extraer los campos que nos interesan y crear un archivo en formato .csv delimitados por comas {print $5 «,» $6 «,» $12}.
De esta forma extremos los valores de estos campos, ordenados sin repetición, solo 100 registros listo para ser usado por AfterGlow.
Obtendremos líneas de registro como:
xxx.xx.6.68,6549,SF xxx.xx.3.6,22541,RSTO xxx.xx.3.26,443,RSTO xxx.xx.23.7,80,SF xxx.xx.5.63,50983,S0 xxx.xx.5.63,50983,SF
Vamos a usar un archivo de propiedades como este:
color.source="green" color.event="yellow" if ($fields[1]<1024) color.event="red" if ($fields[1]>1024) label.target="Intento conex. sin respuesta" if ($fields[2] =~/S0/); color.target="salmon" if ($fields[2] =~/S0/); label.target="Conex. establec. y cerrada correcto" if ($fields[2] =~/SF/); color.target="orange" if ($fields[2] =~/SF/); label.target="Conex. establ. y abortada" if ($fields[2] =~/RSTR/); color.target="red" if ($fields[2] =~/RSTR/); shape.event="box"; color.target="blue"
Le llamamos color.bro.
Ahora parseamos con AfterGlow (type para windows o cat para linux):
>type ejemplo.csv | perl afterglow.pl -c color.bro -p2 > ejemplo.dot
Ahora creamos la gráfica:
neato -Tpng -oejemplo.png ejemplo.dot
El resultado:
Un zoom para ver mejor una de las etiquetas:
Otro ejemplo. Ahora vamos a usar el log http.log ya vamos a extraer IP origen de conexión, método HTTP y URI si en los registros aparece la palabra google. Para ello extraemos la información de la forma:
awk ‘$9 ~/google/ {print $3 «,» $8 «,» $9}’ http.log | sort | uniq > ejemplo1.csv
Obtenemos:
192.168.1.29,GET,www.google.es 192.168.1.29,POST,safebrowsing.clients.google.com 192.168.1.36,GET,id.google.es 192.168.1.36,GET,news.google.es 192.168.1.36,GET,safebrowsing-cache.google.com 192.168.1.36,GET,www.googleadservices.com 192.168.1.36,GET,www.google-analytics.com 192.168.1.36,GET,www.google.com 192.168.1.36,GET,www.google.es 192.168.1.36,POST,safebrowsing.clients.google.com 192.168.1.5,GET,id.google.es
El fichero de propiedades es muy simple y diferenciarmeos si se trata de un GET o un POST. Lo llamamamos http.bro:
color.source=»green»
color.event=»yellow» if ($fields[1]=~/GET/)
color.event=»red» if ($fields[1]=~/POST/)
color.target=»orange»
Parseamos y obtenemos la imagen:
type ejemplo1.csv | perl afterglow.pl -c http.bro -p2 > ejemplo1.dot
neato -Tpng -oejemplo1.png ejemplo1.dot
El resultado:
Sobre AfterGlow tenéis mucha información en un artículo que publiqué en también en Daboweb.com: Herramientas para la interpretación de capturas de red. (9/10) Parte 1
Objetos pdf HTTP.
En el aetículo anterior os mostré una captura donde se veían una serie de ficheros .dat. Se trata de extración de ficheros HTTP en este caso que corresponden a .pdf:
Pues bien, se puede abrir directamente en un visor para pdf adobe reader.
La extracción de ficheros del tipo .pdf lo hemos definido en local.bro de la siguiente forma:
redef HTTP::extract_file_types = /application\/pdf/;
Si quisiéramos hace lo mismo peor con ficheros ejecutables para un sistema Windows por ejemplo, haríamos:
redef HTTP::extract_file_types = /application\/x-dosexec/;
Que, además, lo podríamos redefinir desde la línea de comandos con (-e).
Bro Control.
Ya lo he comentado en artículos anteriores, Bro Control (broctl) es una shell para el control y gestión de sensores Bro, ya sean para un único sistema (por defecto que sería el modo standalone) o varios en cluster (esto último lo veremos en otros artículos) . Con Bro control podemos iniciar parar, configurar redefinir variables, gestión de nodos remotos, etc. Antes de usarlo, debemos configurar:
- Archivo de configuración: /usr/local/bro/etc/broctl.cfg
- Configuramos la interface en /usr/local/bro/etc/node.cfg
- Configuramos nuestra red usando notación CIDR en /usr/local/bro/etc/networks.cfg
Veréis que es muy sencillo adaptar la configuración a vustra red, nodos, etc.
Lo vimos aquí: Bro – IDS. Un sistema de detección de intrusiones basado en políticas especializadas.
Vamos a iniciar broctl:
$ sudo /usr/local/bro/bin/broctl
$ sudo /usr/local/bro/bin/broctl Welcome to BroControl 1.0 Type "help" for help. [BroControl] > install removing old policies in /usr/local/bro/spool/policy/site ... done. removing old policies in /usr/local/bro/spool/policy/auto ... done. creating policy directories ... done. installing site policies ... done. generating standalone-layout.bro ... done. generating local-networks.bro ... done. generating broctl-config.bro ... done. updating nodes ... done. [BroControl] > start starting bro ... [BroControl] > status Name Type Host Status Pid Peers Started bro standalone localhost running 15233 0 20 Jan 12:23:18 [BroControl] >
Voy a ver la lista de scripts que ha cargado broctl:
[BroControl] > scripts bro is ok. #separator \x09 #set_separator , #empty_field (empty) #unset_field - #path loaded_scripts #fields name #types string /usr/local/bro/share/bro/base/init-bare.bro /usr/local/bro/share/bro/base/const.bif.bro /usr/local/bro/share/bro/base/types.bif.bro /usr/local/bro/share/bro/base/strings.bif.bro /usr/local/bro/share/bro/base/bro.bif.bro /usr/local/bro/share/bro/base/reporter.bif.bro /usr/local/bro/share/bro/base/event.bif.bro /usr/local/bro/share/bro/base/frameworks/logging/__load__.bro /usr/local/bro/share/bro/base/frameworks/logging/./main.bro /usr/local/bro/share/bro/base/logging.bif.bro /usr/local/bro/share/bro/base/frameworks/logging/./postprocessors/__load__.bro /usr/local/bro/share/bro/base/frameworks/logging/./postprocessors/./scp.bro /usr/local/bro/share/bro/base/frameworks/logging/./postprocessors/./sftp.bro /usr/local/bro/share/bro/base/frameworks/logging/./writers/ascii.bro /usr/local/bro/share/bro/base/init-default.bro /usr/local/bro/share/bro/base/utils/site.bro /usr/local/bro/share/bro/base/utils/./patterns.bro /usr/local/bro/share/bro/base/utils/addrs.bro /usr/local/bro/share/bro/base/utils/conn-ids.bro /usr/local/bro/share/bro/base/utils/directions-and-hosts.bro /usr/local/bro/share/bro/base/utils/files.bro /usr/local/bro/share/bro/base/utils/numbers.bro /usr/local/bro/share/bro/base/utils/paths.bro /usr/local/bro/share/bro/base/utils/strings.bro /usr/local/bro/share/bro/base/utils/thresholds.bro /usr/local/bro/share/bro/base/frameworks/notice/__load__.bro /usr/local/bro/share/bro/base/frameworks/notice/./main.bro /usr/local/bro/share/bro/base/frameworks/notice/./weird.bro /usr/local/bro/share/bro/base/frameworks/notice/./actions/drop.bro /usr/local/bro/share/bro/base/frameworks/notice/./actions/email_admin.bro /usr/local/bro/share/bro/base/frameworks/notice/./actions/page.bro /usr/local/bro/share/bro/base/frameworks/notice/./actions/add-geodata.bro /usr/local/bro/share/bro/base/frameworks/notice/./extend-email/hostnames.bro /usr/local/bro/share/bro/base/frameworks/cluster/__load__.bro /usr/local/bro/share/bro/base/frameworks/cluster/./main.bro /usr/local/bro/share/bro/base/frameworks/control/__load__.bro /usr/local/bro/share/bro/base/frameworks/control/./main.bro /usr/local/bro/share/bro/base/frameworks/notice/./actions/pp-alarms.bro /usr/local/bro/share/bro/base/frameworks/dpd/__load__.bro /usr/local/bro/share/bro/base/frameworks/dpd/./main.bro /usr/local/bro/share/bro/base/frameworks/signatures/__load__.bro /usr/local/bro/share/bro/base/frameworks/signatures/./main.bro /usr/local/bro/share/bro/base/frameworks/packet-filter/__load__.bro /usr/local/bro/share/bro/base/frameworks/packet-filter/./main.bro /usr/local/bro/share/bro/base/frameworks/packet-filter/./netstats.bro /usr/local/bro/share/bro/base/frameworks/software/__load__.bro /usr/local/bro/share/bro/base/frameworks/software/./main.bro /usr/local/bro/share/bro/base/frameworks/communication/__load__.bro /usr/local/bro/share/bro/base/frameworks/communication/./main.bro /usr/local/bro/share/bro/base/frameworks/metrics/__load__.bro /usr/local/bro/share/bro/base/frameworks/metrics/./main.bro /usr/local/bro/share/bro/base/frameworks/metrics/./non-cluster.bro /usr/local/bro/share/bro/base/frameworks/intel/__load__.bro /usr/local/bro/share/bro/base/frameworks/intel/./main.bro /usr/local/bro/share/bro/base/frameworks/reporter/__load__.bro /usr/local/bro/share/bro/base/frameworks/reporter/./main.bro /usr/local/bro/share/bro/base/protocols/conn/__load__.bro /usr/local/bro/share/bro/base/protocols/conn/./main.bro /usr/local/bro/share/bro/base/protocols/conn/./contents.bro /usr/local/bro/share/bro/base/protocols/conn/./inactivity.bro /usr/local/bro/share/bro/base/protocols/dns/__load__.bro /usr/local/bro/share/bro/base/protocols/dns/./consts.bro /usr/local/bro/share/bro/base/protocols/dns/./main.bro /usr/local/bro/share/bro/base/protocols/ftp/__load__.bro /usr/local/bro/share/bro/base/protocols/ftp/./utils-commands.bro /usr/local/bro/share/bro/base/protocols/ftp/./main.bro /usr/local/bro/share/bro/base/protocols/ftp/./file-extract.bro /usr/local/bro/share/bro/base/protocols/http/__load__.bro /usr/local/bro/share/bro/base/protocols/http/./main.bro /usr/local/bro/share/bro/base/protocols/http/./utils.bro /usr/local/bro/share/bro/base/protocols/http/./file-ident.bro /usr/local/bro/share/bro/base/protocols/http/./file-hash.bro /usr/local/bro/share/bro/base/protocols/http/./file-extract.bro /usr/local/bro/share/bro/base/protocols/irc/__load__.bro /usr/local/bro/share/bro/base/protocols/irc/./main.bro /usr/local/bro/share/bro/base/protocols/irc/./dcc-send.bro /usr/local/bro/share/bro/base/protocols/smtp/__load__.bro /usr/local/bro/share/bro/base/protocols/smtp/./main.bro /usr/local/bro/share/bro/base/protocols/smtp/./entities.bro /usr/local/bro/share/bro/base/protocols/smtp/./entities-excerpt.bro /usr/local/bro/share/bro/base/protocols/ssh/__load__.bro /usr/local/bro/share/bro/base/protocols/ssh/./main.bro /usr/local/bro/share/bro/base/protocols/ssl/__load__.bro /usr/local/bro/share/bro/base/protocols/ssl/./consts.bro /usr/local/bro/share/bro/base/protocols/ssl/./main.bro /usr/local/bro/share/bro/base/protocols/ssl/./mozilla-ca-list.bro /usr/local/bro/share/bro/base/protocols/syslog/__load__.bro /usr/local/bro/share/bro/base/protocols/syslog/./consts.bro /usr/local/bro/share/bro/base/protocols/syslog/./main.bro /usr/local/bro/spool/policy/site/local.bro /usr/local/bro/share/bro/policy/misc/loaded-scripts.bro /usr/local/bro/share/bro/policy/tuning/defaults/__load__.bro /usr/local/bro/share/bro/policy/tuning/defaults/./packet-fragments.bro /usr/local/bro/share/bro/policy/tuning/defaults/./warnings.bro /usr/local/bro/share/bro/policy/frameworks/software/vulnerable.bro /usr/local/bro/share/bro/policy/protocols/http/software.bro /usr/local/bro/share/bro/policy/protocols/ftp/software.bro /usr/local/bro/share/bro/policy/protocols/smtp/software.bro /usr/local/bro/share/bro/policy/protocols/ssh/software.bro /usr/local/bro/share/bro/policy/protocols/dns/detect-external-names.bro /usr/local/bro/share/bro/policy/protocols/ftp/detect.bro /usr/local/bro/share/bro/policy/frameworks/software/version-changes.bro /usr/local/bro/share/bro/policy/protocols/conn/known-hosts.bro /usr/local/bro/share/bro/policy/protocols/conn/known-services.bro /usr/local/bro/share/bro/policy/protocols/ssl/known-certs.bro /usr/local/bro/share/bro/policy/protocols/ssl/cert-hash.bro /usr/local/bro/share/bro/policy/protocols/ssl/validate-certs.bro /usr/local/bro/share/bro/policy/protocols/ssh/geo-data.bro /usr/local/bro/share/bro/policy/protocols/ssh/detect-bruteforcing.bro /usr/local/bro/share/bro/policy/protocols/ssh/interesting-hostnames.bro /usr/local/bro/share/bro/policy/protocols/http/detect-MHR.bro /usr/local/bro/share/bro/policy/protocols/http/detect-sqli.bro /usr/local/bro/share/bro/policy/misc/scan.bro /usr/local/bro/share/bro/broctl/__load__.bro /usr/local/bro/share/bro/broctl/./main.bro /usr/local/bro/share/bro/policy/frameworks/control/controllee.bro /usr/local/bro/share/bro/policy/frameworks/communication/listen.bro /usr/local/bro/share/bro/broctl/standalone.bro /usr/local/bro/spool/tmp/check-config-bro/standalone-layout.bro /usr/local/bro/share/bro/policy/misc/trim-trace-file.bro /usr/local/bro/share/bro/broctl/auto.bro /usr/local/bro/spool/tmp/check-config-bro/local-networks.bro /usr/local/bro/spool/tmp/check-config-bro/broctl-config.bro /usr/local/bro/share/bro/broctl/check.bro [BroControl] >
Hacemos un típico top:
[BroControl] > top Name Type Node Pid Proc VSize Rss Cpu Cmd bro standalone localhost 15234 child 30K 15M 25% bro bro standalone localhost 15233 parent 26K 18M 21% bro dfd
Podemos redefinir variables o ver su configuración con print y la variable:
[BroControl] > print
Syntax error: no id to print given
[BroControl] > print HTTP::extract_file_types
bro HTTP::extract_file_types = /^?(application\/pdf)$?/
[BroControl] > print FTP::extract_file_types
bro FTP::extract_file_types = /^?(NO_DEFAULT)$?/
[BroControl] > print Scan::scan_triples
bro Scan::scan_triples = {
}
[BroControl] > print Communication::nodes
bro Communication::nodes = {
[local-control] = [host=127.0.0.1, p=<uninitialized>,, events=/^?(Control::.*_request)$?/, connect=F, retry=0 secs, accept_input=T, sync=F, request_logs=F, auth=F, capture_filter=<uninitialized>, ssl=F, compression=0, peer=[id=10006, host=127.0.0.1, p=34725/tcp, is_local=F, descr=,], connected=T],
[control] = [host=127.0.0.1, p=<uninitialized>,, events=/^?(Control::.*_request)$?/, connect=F, retry=0 secs, accept_input=T, sync=F, request_logs=F, auth=F, capture_filter=<uninitialized>, ssl=F, compression=0, peer=<uninitialized>, connected=F]
Con redef podemos redefinir una variable. Para el ejemplo de arriba Communication::nodes:
redef Communication::nodes = {
# We're waiting for connections from this host for control.
["control"] = [$host=127.0.0.1, $events=Control::controller_events],
};
Los logs generados por broctl (Bro Control) se ubicarán en:
ls -l /usr/local/bro/logs/
total 20
drwxr-xr-x 2 root root 4096 2011-12-07 18:23 2011-11-02
drwxr-xr-x 2 root root 4096 2011-12-07 18:30 2011-12-07
drwxr-xr-x 2 root root 4096 2012-01-12 11:16 2012-01-05
drwxr-xr-x 2 root root 4096 2012-01-12 11:16 2012-01-12
drwxr-xr-x 2 root root 4096 2012-01-20 13:01 2012-01-20
lrwxrwxrwx 1 root root 24 2012-01-20 12:23 current -> /usr/local/bro/spool/bro
ls -l /usr/local/bro/logs/2012-01-20
total 104
-rw-r--r-- 1 root root 2789 2012-01-20 12:40 communication.12:23:20-12:40:01.gz
-rw-r--r-- 1 root root 246 2012-01-20 12:45 communication.12:40:01-12:45:30.gz
-rw-r--r-- 1 root root 4312 2012-01-20 13:00 communication.12:45:33-13:00:00.gz
-rw-r--r-- 1 root root 3179 2012-01-20 12:40 conn.12:25:01-12:40:01.gz
-rw-r--r-- 1 root root 462 2012-01-20 12:46 conn.12:40:01-12:45:30.gz
-rw-r--r-- 1 root root 1387 2012-01-20 13:01 conn.12:45:44-13:00:00.gz
-rw-r--r-- 1 root root 852 2012-01-20 12:40 conn-summary.12:25:01-12:40:01.gz
-rw-r--r-- 1 root root 597 2012-01-20 12:46 conn-summary.12:40:01-12:45:30.gz
-rw-r--r-- 1 root root 687 2012-01-20 13:01 conn-summary.12:45:44-13:00:00.gz
-rw-r--r-- 1 root root 2274 2012-01-20 12:40 dns.12:25:52-12:40:01.gz
-rw-r--r-- 1 root root 785 2012-01-20 13:00 dns.12:45:41-13:00:00.gz
-rw-r--r-- 1 root root 891 2012-01-20 12:40 http.12:30:11-12:40:01.gz
-rw-r--r-- 1 root root 184 2012-01-20 12:40 known_services.12:25:14-12:40:01.gz
-rw-r--r-- 1 root root 184 2012-01-20 13:00 known_services.12:45:36-13:00:00.gz
-rw-r--r-- 1 root root 1062 2012-01-20 12:40 loaded_scripts.12:23:20-12:40:01.gz
-rw-r--r-- 1 root root 1062 2012-01-20 13:00 loaded_scripts.12:45:33-13:00:00.gz
-rw-r--r-- 1 root root 395 2012-01-20 12:40 notice_policy.12:23:20-12:40:01.gz
-rw-r--r-- 1 root root 395 2012-01-20 13:00 notice_policy.12:45:33-13:00:00.gz
-rw-r--r-- 1 root root 161 2012-01-20 12:40 packet_filter.12:23:20-12:40:01.gz
-rw-r--r-- 1 root root 161 2012-01-20 13:00 packet_filter.12:45:33-13:00:00.gz
-rw-r--r-- 1 root root 219 2012-01-20 12:40 reporter.12:40:01-12:40:01.gz
-rw-r--r-- 1 root root 84 2012-01-20 12:45 stderr.12:23:18-12:45:30.gz
-rw-r--r-- 1 root root 33 2012-01-20 12:45 stdout.12:23:18-12:45:30.gz
-rw-r--r-- 1 root root 983 2012-01-20 12:40 weird.12:23:20-12:40:01.gz
-rw-r--r-- 1 root root 290 2012-01-20 13:00 weird.12:45:34-13:00:00.gz
Estadísticas trace-summary.
Lo vimos en anteriores artículos. Lo recordamos:
~/browork$ python /usr/local/bro/bin/trace-summary -b -c conn.log >== Total === 2012-01-20-09-17-48 - 2012-01-20-10-50-17 - Connections 5.3k - Payload 64.3m - Ports | Sources | Destinations | Services | Protocols | States | 13266 69.8% | 192.168.1.29 60.9% | 192.168.1.245 70.2% | http 66.6% | 6 99.6% | SF 75.1% | 993 12.6% | 192.168.1.36 14.6% | 192.168.100.241 22.9% | - 25.1% | 17 0.4% | RSTO 7.5% | 143 9.1% | 192.168.1.5 8.6% | 213.60.206.51 3.1% | ssl 7.8% | 1 0.0% | SHR 6.6% | 443 6.8% | 192.168.1.11 7.9% | 74.200.247.187 0.8% | dns 0.4% | | OTH 4.6% | 445 1.1% | 192.168.1.10 6.6% | 107.21.127.186 0.6% | smtp 0.0% | | S1 3.7% | 53 0.4% | 192.168.1.109 1.0% | 76.74.254.120 0.5% | | | RSTR 2.3% | 465 0.1% | 192.168.1.24 0.2% | 76.74.255.117 0.2% | | | S3 0.2% | 25 0.0% | 192.168.1.106 0.2% | 72.233.69.10 0.2% | | | RSTRH 0.1% | 137 0.0% | 192.168.1.28 0.0% | 93.184.220.42 0.2% | | | S0 0.0% | 1900 0.0% | 192.168.1.245 0.0% | 207.171.163.225 0.1% | | | SH 0.0% | First: 2012-01-20-09-17-48 (1327047468.033436) Last: 2012-01-20-10-50-17 1327053017.309365 ~/browork$ python /usr/local/bro/bin/trace-summary -r -c conn.log >== Total === 2012-01-20-09-17-48 - 2012-01-20-10-50-17 - Connections 5.3k - Payload 64.3m - Ports | Sources | Destinations | Services | Protocols | States | 13266 36.6% | 192.168.1.29#1 51.6% | 192.168.1.245#2 66.9% | - 33.2% | 6 50.7% | SF 68.5% | 53 30.2% | 192.168.1.5#3 16.1% | 192.168.1.29#4 6.0% | dns 32.4% | 17 47.6% | S0 17.5% | 443 8.7% | 192.168.1.10#5 4.0% | 192.168.100.241#6 4.9% | http 30.7% | 1 1.7% | SHR 7.9% | 22267 5.8% | 192.168.1.11#7 3.6% | 192.168.1.255#8 4.7% | ssl 3.7% | | OTH 3.0% | 993 4.1% | 192.168.1.36#9 3.4% | 192.168.1.5#10 4.3% | smtp 0.1% | | RSTO 1.7% | 51927 3.3% | 192.168.1.245#11 1.8% | 192.168.1.109#12 3.9% | | | S1 0.6% | 138 2.7% | 192.168.1.24#13 1.3% | 74.200.247.187#14 2.5% | | | RSTRH 0.3% | 35066 2.6% | 192.168.1.109#15 0.9% | 76.74.254.120#16 1.4% | | | S3 0.3% | 137 2.0% | 192.168.1.90#17 0.9% | 76.74.255.117#18 0.8% | | | SH 0.2% | 54 1.5% | 192.168.1.28#19 0.6% | 173.194.34.44#20 0.3% | | | RSTR 0.0% |
- -r para resolución de nombres
- -b estádistica por bytes en vez de por paquetes
- -C solo tcp ignorando seq==0
- -t solo tcp
- -u solo udp
- -v más información
Capstats.
Ofrece información estadística sobre una interface de red. Ante un scan de puertos nmap y ofreciendo estadísticas cada 10 segundos:
~/browork$ sudo /usr/local/bro/bin/capstats -ieth1 -I10
1327064179.563741 pkts=93413 kpps=9.3 kbytes=3923 mbps=3.2 nic_pkts=93418 nic_drops=0 u=6 t=93398 i=0 o=0 nonip=9
1327064189.563961 pkts=37736 kpps=3.8 kbytes=1585 mbps=1.3 nic_pkts=131149 nic_drops=0 u=4 t=37728 i=0 o=0 nonip=4
(aquí terminó el scan)
1327064199.564173 pkts=88 kpps=0.0 kbytes=10 mbps=0.0 nic_pkts=131237 nic_drops=0 u=2 t=82 i=0 o=0 nonip=4
1327064209.564365 pkts=68 kpps=0.0 kbytes=3 mbps=0.0 nic_pkts=131305 nic_drops=0 u=3 t=62 i=0 o=0 nonip=3
1327064219.564560 pkts=64 kpps=0.0 kbytes=3 mbps=0.0 nic_pkts=131369 nic_drops=0 u=0 t=62 i=0 o=0 nonip=2
1327064229.564754 pkts=55 kpps=0.0 kbytes=2 mbps=0.0 nic_pkts=131424 nic_drops=0 u=1 t=50 i=0 o=0 nonip=4
1327064239.564949 pkts=67 kpps=0.0 kbytes=3 mbps=0.0 nic_pkts=131491 nic_drops=0 u=1 t=62 i=0 o=0 nonip=4
1327064249.565128 pkts=63 kpps=0.0 kbytes=2 mbps=0.0 nic_pkts=131554 nic_drops=0 u=3 t=55 i=0 o=0 nonip=5
^C1327064252.380788 pkts=18 kpps=0.0 kbytes=1 mbps=0.0 nic_pkts=131572 nic_drops=0 u=2 t=15 i=0 o=0 nonip=1
1327064252.380805
=== Total
1327064252.380878 pkts=131572 kpps=1.6 kbytes=5536 mbps=0.5 nic_pkts=131572 nic_drops=0 u=22 t=131514 i=0 o=0 nonip=36
Relacionado con Bro-IDS:
Bro – IDS. Un sistema de detección de intrusiones basado en políticas especializadas.
Bro – IDS. Un sistema de detección de intrusiones basado en políticas especializadas. Parte 2
Con AfterGlow:
Herramientas para la interpretación de capturas de red. (9/10) Parte 1
===============
Y hasta aquí por hoy. Hasta la próxima.
Seguridad y Redes 
Pingback: Sistema de detección de intrusiones basado en políticas especializadas | B1nary0's Web