Logging the whole packet

Logging the whole packet

[Brad Tilley]

Is it possible to log the packet body and not just the header?

Currently I have this line in my iptables start-up file:

/sbin/iptables -I INPUT -p tcp -s ! 128.173.120.79 -d 128.173.120.79  -j 
LOG --log-prefix="Packet_Filter:"

And it generates log entries such as this:

Nov 23 16:44:28 athop1 kernel: Packet_Filter:IN=eth0 OUT= 
MAC=00:30:6e:5e:a2:0c:00:d0:01:ab:44:00:08:00 SRC=64.81.214.131 
DST=128.173.120.79 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=29621 DF 
PROTO=TCP SPT=60366 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0

I'd like to capture the packet body as well. I'm new to packet logging 
so forgive me if I'm over looking the obvious.

Thanks,
Brad

Re: Logging the whole packet

[Jason Opperisano]

On Tue, Nov 23, 2004 at 04:50:28PM -0500, Brad Tilley wrote:
> Is it possible to log the packet body and not just the header?
> 
> Currently I have this line in my iptables start-up file:
> 
> /sbin/iptables -I INPUT -p tcp -s ! 128.173.120.79 -d 128.173.120.79  -j 
> LOG --log-prefix="Packet_Filter:"
> 
> And it generates log entries such as this:
> 
> Nov 23 16:44:28 athop1 kernel: Packet_Filter:IN=eth0 OUT= 
> MAC=00:30:6e:5e:a2:0c:00:d0:01:ab:44:00:08:00 SRC=64.81.214.131 
> DST=128.173.120.79 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=29621 DF 
> PROTO=TCP SPT=60366 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0
> 
> I'd like to capture the packet body as well. I'm new to packet logging 
> so forgive me if I'm over looking the obvious.

AFAIK, the normal LOG target cannot actually do this.  instead, use the
ULOG target which will copy the entire packet to the userspace ulogd
daemon where you can use the ulogd_PCAP.so plugin to create a tcpdump
file of the packets you are interested in.  check out:

  http://gnumonks.org/gnumonks/projects/project_details?p_id=1

for more details about ulogd.

HTH...

-j

--
"Television! Teacher, mother, secret lover."
        --The Simpsons

Re: Logging the whole packet

[Brad Tilley]

Jason Opperisano wrote:

>On Tue, Nov 23, 2004 at 04:50:28PM -0500, Brad Tilley wrote:
>  
>
>>Is it possible to log the packet body and not just the header?
>>
>>Currently I have this line in my iptables start-up file:
>>
>>/sbin/iptables -I INPUT -p tcp -s ! 128.173.120.79 -d 128.173.120.79  -j 
>>LOG --log-prefix="Packet_Filter:"
>>
>>And it generates log entries such as this:
>>
>>Nov 23 16:44:28 athop1 kernel: Packet_Filter:IN=eth0 OUT= 
>>MAC=00:30:6e:5e:a2:0c:00:d0:01:ab:44:00:08:00 SRC=64.81.214.131 
>>DST=128.173.120.79 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=29621 DF 
>>PROTO=TCP SPT=60366 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0
>>
>>I'd like to capture the packet body as well. I'm new to packet logging 
>>so forgive me if I'm over looking the obvious.
>>    
>>
>
>AFAIK, the normal LOG target cannot actually do this.  instead, use the
>ULOG target which will copy the entire packet to the userspace ulogd
>daemon where you can use the ulogd_PCAP.so plugin to create a tcpdump
>file of the packets you are interested in.  check out:
>
>  http://gnumonks.org/gnumonks/projects/project_details?p_id=1
>
>for more details about ulogd.
>
>HTH...
>
>-j
>
>--
>"Television! Teacher, mother, secret lover."
>        --The Simpsons
>
>
>  
>
Thanks, that works great. I had to recompile the kernel to get ULOG 
support, but other than that, it's rather straightforward. I added this 
line to my iptables startup script:

/sbin/iptables -I INPUT -p tcp -s ! 128.173.120.79 -d 128.173.120.79 -j 
ULOG --ulog-prefix "Packet_Filter:"

I'm using the  /usr/lib/ulogd/ulogd_OPRINT.so plugin to write the packet 
capture to a file for now. Here's a sample of what it looks like:

===>PACKET BOUNDARY
tcp.fin=0
tcp.syn=1
tcp.rst=0
tcp.psh=0
tcp.ack=0
tcp.urg=0
tcp.window=64240
tcp.ackseq=0
tcp.seq=4245420361
tcp.dport=445
tcp.sport=2797
ip.fragoff=16384
ip.id=11011
ip.csum=2618
ip.ihl=5
ip.totlen=48
ip.ttl=111
ip.tos=0
ip.protocol=6
ip.daddr=128.173.120.79
ip.saddr=63.231.157.167
oob.out=
oob.in=eth0
oob.mark=0
oob.time.usec=213408
oob.time.sec=1101257132
oob.prefix=Packet_Filter:
raw.pktlen=48
raw.pkt=raw.mac=00:30:6e:5e:a2:0c:00:d0:01:ab:44:00:08:00

Now, all I need to do is figure out what's in the packet body. Any 
pointers on that? Ideally I'd like to write a script that recreates 
keystrokes from packets that contain ssh session info. Probably 
off-topic here, but I thought I'd ask. Thanks for the ULOG tip!

Re: Logging the whole packet

[Brad Tilley]

Brad Tilley wrote:

> Jason Opperisano wrote:
>
>> On Tue, Nov 23, 2004 at 04:50:28PM -0500, Brad Tilley wrote:
>>  
>>
>>> Is it possible to log the packet body and not just the header?
>>>
>>> Currently I have this line in my iptables start-up file:
>>>
>>> /sbin/iptables -I INPUT -p tcp -s ! 128.173.120.79 -d 
>>> 128.173.120.79  -j LOG --log-prefix="Packet_Filter:"
>>>
>>> And it generates log entries such as this:
>>>
>>> Nov 23 16:44:28 athop1 kernel: Packet_Filter:IN=eth0 OUT= 
>>> MAC=00:30:6e:5e:a2:0c:00:d0:01:ab:44:00:08:00 SRC=64.81.214.131 
>>> DST=128.173.120.79 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=29621 DF 
>>> PROTO=TCP SPT=60366 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0
>>>
>>> I'd like to capture the packet body as well. I'm new to packet 
>>> logging so forgive me if I'm over looking the obvious.
>>>   
>>
>>
>> AFAIK, the normal LOG target cannot actually do this.  instead, use the
>> ULOG target which will copy the entire packet to the userspace ulogd
>> daemon where you can use the ulogd_PCAP.so plugin to create a tcpdump
>> file of the packets you are interested in.  check out:
>>
>>  http://gnumonks.org/gnumonks/projects/project_details?p_id=1
>>
>> for more details about ulogd.
>>
>> HTH...
>>
>> -j
>>
>> -- 
>> "Television! Teacher, mother, secret lover."
>>        --The Simpsons
>>
>>
>>  
>>
> Thanks, that works great. I had to recompile the kernel to get ULOG 
> support, but other than that, it's rather straightforward. I added 
> this line to my iptables startup script:
>
> /sbin/iptables -I INPUT -p tcp -s ! 128.173.120.79 -d 128.173.120.79 
> -j ULOG --ulog-prefix "Packet_Filter:"
>
> I'm using the  /usr/lib/ulogd/ulogd_OPRINT.so plugin to write the 
> packet capture to a file for now. Here's a sample of what it looks like:
>
> ===>PACKET BOUNDARY
> tcp.fin=0
> tcp.syn=1
> tcp.rst=0
> tcp.psh=0
> tcp.ack=0
> tcp.urg=0
> tcp.window=64240
> tcp.ackseq=0
> tcp.seq=4245420361
> tcp.dport=445
> tcp.sport=2797
> ip.fragoff=16384
> ip.id=11011
> ip.csum=2618
> ip.ihl=5
> ip.totlen=48
> ip.ttl=111
> ip.tos=0
> ip.protocol=6
> ip.daddr=128.173.120.79
> ip.saddr=63.231.157.167
> oob.out=
> oob.in=eth0
> oob.mark=0
> oob.time.usec=213408
> oob.time.sec=1101257132
> oob.prefix=Packet_Filter:
> raw.pktlen=48
> raw.pkt=raw.mac=00:30:6e:5e:a2:0c:00:d0:01:ab:44:00:08:00
>
> Now, all I need to do is figure out what's in the packet body. Any 
> pointers on that? Ideally I'd like to write a script that recreates 
> keystrokes from packets that contain ssh session info. Probably 
> off-topic here, but I thought I'd ask. Thanks for the ULOG tip!
>
>
>
I figured it out. BTW, I meant telnet sessions, not ssh... didn't want 
y'all to think I'm a complete idiot.

Brad

RE: Logging the whole packet

[israel Gold]

Jason Opperisano wrote:

>>AFAIK, the normal LOG target cannot actually do this.  instead, use
the ULOG target which will copy the entire packet to the
>>userspace ulogd daemon where you can use the ulogd_PCAP.so plugin to
create a tcpdump file of the packets you are 
>>interested in.

I also would like to log the packet data. In fact, I would like to
monitor NFS Write calls.
However, using ULOG and copying all packets to user space is time
consuming. 
I have no interest in Read calls which is most of the traffic.
Does iptables provide a tool to filtering packets by looking at the data
?

Thanks,
Israel   

-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Jason
Opperisano
Sent: Wednesday, November 24, 2004 12:12 AM
To: netfilter@lists.netfilter.org
Subject: Re: Logging the whole packet


On Tue, Nov 23, 2004 at 04:50:28PM -0500, Brad Tilley wrote:
> Is it possible to log the packet body and not just the header?
> 
> Currently I have this line in my iptables start-up file:
> 
> /sbin/iptables -I INPUT -p tcp -s ! 128.173.120.79 -d 128.173.120.79  
> -j
> LOG --log-prefix="Packet_Filter:"
> 
> And it generates log entries such as this:
> 
> Nov 23 16:44:28 athop1 kernel: Packet_Filter:IN=eth0 OUT=
> MAC=00:30:6e:5e:a2:0c:00:d0:01:ab:44:00:08:00 SRC=64.81.214.131 
> DST=128.173.120.79 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=29621 DF 
> PROTO=TCP SPT=60366 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0
> 
> I'd like to capture the packet body as well. I'm new to packet logging
> so forgive me if I'm over looking the obvious.

AFAIK, the normal LOG target cannot actually do this.  instead, use the
ULOG target which will copy the entire packet to the userspace ulogd
daemon where you can use the ulogd_PCAP.so plugin to create a tcpdump
file of the packets you are interested in.  check out:

  http://gnumonks.org/gnumonks/projects/project_details?p_id=1

for more details about ulogd.

HTH...

-j

--
"Television! Teacher, mother, secret lover."
        --The Simpsons

RE: Logging the whole packet

[Jason Opperisano]

On Wed, 2004-11-24 at 06:03, israel Gold wrote:
> Jason Opperisano wrote:
> 
> >>AFAIK, the normal LOG target cannot actually do this.  instead, use
> the ULOG target which will copy the entire packet to the
> >>userspace ulogd daemon where you can use the ulogd_PCAP.so plugin to
> create a tcpdump file of the packets you are 
> >>interested in.
> 
> I also would like to log the packet data. In fact, I would like to
> monitor NFS Write calls.
> However, using ULOG and copying all packets to user space is time
> consuming. 
> I have no interest in Read calls which is most of the traffic.
> Does iptables provide a tool to filtering packets by looking at the data
> ?
> 
> Thanks,
> Israel   

iptables is a firewall; not a high performance packet capturing tool.

you guys ever heard of tcpdump?  snort?

-j

--
"They think they're so high and mighty, just because they never got
 caught driving without pants."
	--The Simpsons

RE: Logging the whole packet

[israel Gold]

Jason you correct,
I am looking for tool that is capable of real-time protocol analysis
and content matching. SNORT seems to be more appropriate.
Thank you for the tip.
Israel.


-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Jason
Opperisano
Sent: Wednesday, November 24, 2004 4:59 PM
To: netfilter@lists.netfilter.org
Subject: RE: Logging the whole packet


On Wed, 2004-11-24 at 06:03, israel Gold wrote:
> Jason Opperisano wrote:
> 
> >>AFAIK, the normal LOG target cannot actually do this.  instead, use
> the ULOG target which will copy the entire packet to the
> >>userspace ulogd daemon where you can use the ulogd_PCAP.so plugin to
> create a tcpdump file of the packets you are
> >>interested in.
> 
> I also would like to log the packet data. In fact, I would like to 
> monitor NFS Write calls. However, using ULOG and copying all packets 
> to user space is time consuming.
> I have no interest in Read calls which is most of the traffic.
> Does iptables provide a tool to filtering packets by looking at the
data
> ?
> 
> Thanks,
> Israel   

iptables is a firewall; not a high performance packet capturing tool.

you guys ever heard of tcpdump?  snort?

-j

--
"They think they're so high and mighty, just because they never got
caught driving without pants."
	--The Simpsons