Logging MAC

Logging MAC

[Marcelus Trojahn]

Folks,

  I have an outdoor wireless network and I only accept FORWARD packets
  when  the  IP  address  matchs  with  the  MAC  address I have on my
  iptables rules... (Bad english sorry)

  For example:
  iptables -j ACCEPT -A FORWARD -i eth1 -s 10.10.10.80 -m mac --mac-source 00:40:F4:93:40:82

  iptables -j LOG  -A FORWARD -i eth1 $pref "[rule 06]"
  iptables -j DROP -A FORWARD -i eth1

  Any  other  connection  that  doesn't  match  the  IP+MAC  rules are
  dropped (or at least I think it was :)).

  The  problem  is:  Recently  I noticed a large traffic (MRTG) on the
  access points that doesn't seem to match with traffic of the clients
  connected  to  it...  Looks  like  someone  are being able to bypass
  iptables  rules.  So,  I  want  to know if there is a way to the LOG
  target logs the MAC address of the connection too...

  Sorry about my english... I hope you can understand me...

-- 
Marcelus Trojahn

Re: Logging MAC

[Antony Stone]

On Friday 21 May 2004 2:39 pm, Marcelus Trojahn wrote:

> Folks,
>
>   I  want  to know if there is a way to the LOG
>   target logs the MAC address of the connection too...

The LOG target does log the MAC address of the connection.   Here's an example 
of a packet from my system a minute ago (IPs obscured):

May 21 14:47:15 Firewall kernel: IN=eth0 OUT= 
MAC=00:05:5d:63:88:b8:00:d0:58:e0:04:cf:08:00 SRC=253.47.80.398 
DST=253.121.341.14 LEN=48 TOS=0x00 PREC=0x00 TTL=115 ID=25492 DF PROTO=TCP 
SPT=3961 DPT=2745 WINDOW=16384 RES=0x00 SYN URGP=0

That long string after MAC= tells you the MAC addresses at each end of the 
link (first 6 bytes = local (firewall) end; next six bytes = remote end; last 
two bytes means IP packet inside this ethernet frame)

Therefore taking the above example, 00:d0:58:e0:04:cf is the MAC address of 
the system connecting to my firewall.

>   Sorry about my english... I hope you can understand me...

No problem at all :)

Regards,

Antony.

-- 
Anyone that's normal doesn't really achieve much.

 - Mark Blair, Australian rocket engineer

                                                     Please reply to the list;
                                                           please don't CC me.

Re[2]: Logging MAC

[Marcelus Trojahn]

Friday, May 21, 2004, 10:53:02 AM, voce escreveu:

> May 21 14:47:15 Firewall kernel: IN=eth0 OUT=
> MAC=00:05:5d:63:88:b8:00:d0:58:e0:04:cf:08:00 SRC=253.47.80.398 
> DST=253.121.341.14 LEN=48 TOS=0x00 PREC=0x00 TTL=115 ID=25492 DF PROTO=TCP
> SPT=3961 DPT=2745 WINDOW=16384 RES=0x00 SYN URGP=0

Not for me... Take a look:
May 21 11:13:20 BACKUP kernel: [smtp]IN=eth1 OUT=eth0 SRC=10.10.10.81
DST=200.221.11.50 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=60955 DF PROTO=TCP
SPT=2438 DPT=25 WINDOW=8192 RES=0x00 SYN URGP=0

Maybe cause I use preffix?

--
Marcelus Trojahn

Re: Re[2]: Logging MAC

[Antony Stone]

On Friday 21 May 2004 3:17 pm, Marcelus Trojahn wrote:

> Friday, May 21, 2004, 10:53:02 AM, voce escreveu:
> > May 21 14:47:15 Firewall kernel: IN=eth0 OUT=
> > MAC=00:05:5d:63:88:b8:00:d0:58:e0:04:cf:08:00 SRC=253.47.80.398
> > DST=253.121.341.14 LEN=48 TOS=0x00 PREC=0x00 TTL=115 ID=25492 DF
> > PROTO=TCP SPT=3961 DPT=2745 WINDOW=16384 RES=0x00 SYN URGP=0
>
> Not for me... Take a look:
> May 21 11:13:20 BACKUP kernel: [smtp]IN=eth1 OUT=eth0 SRC=10.10.10.81
> DST=200.221.11.50 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=60955 DF PROTO=TCP
> SPT=2438 DPT=25 WINDOW=8192 RES=0x00 SYN URGP=0
>
> Maybe cause I use preffix?

No, I use a prefix as well - I just cut it out of the text a pasted 
previously.

What version of netfilter are you using?

Regards,

Antony.

-- 
Perfection in design is achieved not when there is nothing left to add, but 
rather when there is nothing left to take away.

 - Antoine de Saint-Exupery

                                                     Please reply to the list;
                                                           please don't CC me.

Re[4]: Logging MAC

[Marcelus Trojahn]

Prezado(a) Antony,

1.2.10 (CVS one)

-- 
Marcelus Trojahn

-=======//=================-

Friday, May 21, 2004, 11:34:11 AM, voce escreveu:

> On Friday 21 May 2004 3:17 pm, Marcelus Trojahn wrote:

>> Friday, May 21, 2004, 10:53:02 AM, voce escreveu:
>> > May 21 14:47:15 Firewall kernel: IN=eth0 OUT=
>> > MAC=00:05:5d:63:88:b8:00:d0:58:e0:04:cf:08:00 SRC=253.47.80.398
>> > DST=253.121.341.14 LEN=48 TOS=0x00 PREC=0x00 TTL=115 ID=25492 DF
>> > PROTO=TCP SPT=3961 DPT=2745 WINDOW=16384 RES=0x00 SYN URGP=0
>>
>> Not for me... Take a look:
>> May 21 11:13:20 BACKUP kernel: [smtp]IN=eth1 OUT=eth0 SRC=10.10.10.81
>> DST=200.221.11.50 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=60955 DF PROTO=TCP
>> SPT=2438 DPT=25 WINDOW=8192 RES=0x00 SYN URGP=0
>>
>> Maybe cause I use preffix?

> No, I use a prefix as well - I just cut it out of the text a pasted 
> previously.

> What version of netfilter are you using?

> Regards,

> Antony.

Re: Re[4]: Logging MAC

[Antony Stone]

On Friday 21 May 2004 4:07 pm, Marcelus Trojahn wrote:

> > What version of netfilter are you using?
>
> 1.2.10 (CVS one)

Hm - that's more recent than anything I've used.   I'd be a bit surprised if 
the log output format has changed to exclude MAC addresses, but it's 
possible.   I suggest you check the changelogs for recent versions of 
netfilter, and perhaps ask on the developers' list whether this change has in 
fact happened.

Is anyone else here aware of such a change in the log output format?

Regards,

Antony.

-- 
Ramdisk is not an installation procedure.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Logging MAC

[Alistair Tonner]

On May 21, 2004 11:25 am, Antony Stone wrote:
> On Friday 21 May 2004 4:07 pm, Marcelus Trojahn wrote:
> > > What version of netfilter are you using?
> >
> > 1.2.10 (CVS one)
>
> Hm - that's more recent than anything I've used.   I'd be a bit surprised
> if the log output format has changed to exclude MAC addresses, but it's
> possible.   I suggest you check the changelogs for recent versions of
> netfilter, and perhaps ask on the developers' list whether this change has
> in fact happened.
>
> Is anyone else here aware of such a change in the log output format?
>
	/me HMmmmms.
	
	I note that iptables doesn't log mac addresses it cannot see (i.e. not 
directly connected) ... in 1.2.9x (as I and Antony are running) you still see 
the MAC= element.  Perhaps in CVS the logging function drops this entry if 
MAC="" ?? -- that would indicate that someone on the wireless is being 
hijacked as a proxy?? *ugh*

	(Just an off the top o me head thought)

	Alistair


> Regards,
>
> Antony.

Re: Logging MAC

[Antony Stone]

On Saturday 22 May 2004 2:47 am, Alistair Tonner wrote:

> 	I note that iptables doesn't log mac addresses it cannot see (i.e. not
> directly connected) ... in 1.2.9x (as I and Antony are running) you still
> see the MAC= element.  Perhaps in CVS the logging function drops this entry
> if MAC="" ??

Surely there will *always* be two MAC addresses involved in a communication - 
that's how two machines find each other across the local subnet (ie: via a 
switch / hub / access point etc)?

I agree that in a multi-hop connection between systems, at least one of the 
MAC addresses seen by netfilter will definitely not be an endpoint (it will 
be an interface on a local router), however unless you are running an access 
point *as* a router (the standard way to run them is as a bridge) then you 
should still see the MAC address of whatever machine is talking to the 
firewall?

> -- that would indicate that someone on the wireless is being
> hijacked as a proxy?? *ugh*

In which case you would see the MAC address of the hijacked poxy machine...

Regards,

Antony.

-- 
Bill Gates has personally assured the Spanish Academy that he will never allow 
the upside-down question mark to disappear from Microsoft word-processing 
programs, which must be reassuring for millions of Spanish-speaking people, 
though just a piddling afterthought as far as he's concerned.

 - Lynne Truss, "Eats, Shoots and Leaves"

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Logging MAC

[Alistair Tonner]

On May 22, 2004 05:06 am, Antony Stone wrote:
> On Saturday 22 May 2004 2:47 am, Alistair Tonner wrote:
> > 	I note that iptables doesn't log mac addresses it cannot see (i.e. not
> > directly connected) ... in 1.2.9x (as I and Antony are running) you still
> > see the MAC= element.  Perhaps in CVS the logging function drops this
> > entry if MAC="" ??
>
> Surely there will *always* be two MAC addresses involved in a communication
> - that's how two machines find each other across the local subnet (ie: via
> a switch / hub / access point etc)?

	*Thwack*'s self in head.  Of course, so long as "Ethernet" is involved.  Not 
being 100% on the ball at that moment, I was looking at lines from my ppp 
connection which is pppoe in reality. -- There is no 'ethernet' frame 
involved on that link, thus there are no 'MAC' addresses, or at least there 
aren't MAC addresses in the ppp packets, the MAC address is in the wrapping 
ethernet frame which is going through a dfferent device, which is either 
before or after the ppp device, depending on direction.

>
> I agree that in a multi-hop connection between systems, at least one of the
> MAC addresses seen by netfilter will definitely not be an endpoint (it will
> be an interface on a local router), however unless you are running an
> access point *as* a router (the standard way to run them is as a bridge)
> then you should still see the MAC address of whatever machine is talking to
> the firewall?
  
	Ummm .. I don't think so:	
	in ipt_LOG.c MAC address logging is ONLY done in INPUT.  So ..if the
	packet is NOT destined for the machine, you wont see MAC.

>
> > -- that would indicate that someone on the wireless is being
> > hijacked as a proxy?? *ugh*
>
> In which case you would see the MAC address of the hijacked poxy machine...
	
>
> Regards,
>
> Antony.

Re: Logging MAC

[Antony Stone]

On Saturday 22 May 2004 1:09 pm, Alistair Tonner wrote:

> On May 22, 2004 05:06 am, Antony Stone wrote:
> >
> > Surely there will *always* be two MAC addresses involved in a
> > communication - that's how two machines find each other across the local
> > subnet (ie: via a switch / hub / access point etc)?
>
> 	*Thwack*'s self in head.  Of course, so long as "Ethernet" is involved. 

Or some similar broadcast-based medium such as 802.11 (which isn't ethernet, 
but behaves like it for a lot of things, including MAC addresses).

The general rule is: you need MAC addresses for broadcast-connected networks 
(where each device can see every other locally-connected device) - the MAC 
address is needed to tell one device from another.

You don't need MAC addresses for point-to-point (one-to-one) connected 
networks, because you know there's only one device on the other end of each 
of your own interfaces, therefore you don't need to specify where they're 
going.

> 	in ipt_LOG.c MAC address logging is ONLY done in INPUT.  So ..if the
> 	packet is NOT destined for the machine, you wont see MAC.

Aha :)   [ * Light bulb * ]

The answer to the original poster's question.

I guess (without having looked at the source) that it should be a simple 
enough hack to get ipt_LOG.c to log MAC addresses for all chains.

Regards,

Antony.

-- 
"When you talk about Linux versus Windows, you're talking about which 
operating system is the best value for money and fit for purpose. That's a 
very basic decision customers can make if they have the information available 
to them. Quite frankly if we lose to Linux because our customers say it's 
better value for money, tough luck for us."

 - Steve Vamos, MD of Microsoft Australia

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Logging MAC

[Alistair Tonner]

On May 22, 2004 08:33 am, Antony Stone wrote:
> On Saturday 22 May 2004 1:09 pm, Alistair Tonner wrote:
> > On May 22, 2004 05:06 am, Antony Stone wrote:
> > > Surely there will *always* be two MAC addresses involved in a
> > > communication - that's how two machines find each other across the
> > > local subnet (ie: via a switch / hub / access point etc)?
> >
> > 	*Thwack*'s self in head.  Of course, so long as "Ethernet" is involved.
>
> Or some similar broadcast-based medium such as 802.11 (which isn't
> ethernet, but behaves like it for a lot of things, including MAC
> addresses).
>
> The general rule is: you need MAC addresses for broadcast-connected
> networks (where each device can see every other locally-connected device) -
> the MAC address is needed to tell one device from another.
>
> You don't need MAC addresses for point-to-point (one-to-one) connected
> networks, because you know there's only one device on the other end of each
> of your own interfaces, therefore you don't need to specify where they're
> going.
>
> > 	in ipt_LOG.c MAC address logging is ONLY done in INPUT.  So ..if the
> > 	packet is NOT destined for the machine, you wont see MAC.
>
> Aha :)   [ * Light bulb * ]
>
> The answer to the original poster's question.
>
> I guess (without having looked at the source) that it should be a simple
> enough hack to get ipt_LOG.c to log MAC addresses for all chains.
>
	should be ridiculously simple -- the limiter is a wrapping if statement

	if ( in && !out) {

	(logging of MAC code)
	}

	I suspect that the clever hacker will want to re-wrap that if statement such 
that it only logs it if there IS a MAC address present.  Not being a maven 
with such, I'm NOT gonna make any suggestions as to how.

	Alistair

> Regards,
>
> Antony.

Re: Logging MAC

[Antony Stone]

On Saturday 22 May 2004 4:57 pm, Alistair Tonner wrote:

> On May 22, 2004 08:33 am, Antony Stone wrote:
> >
> > I guess (without having looked at the source) that it should be a simple
> > enough hack to get ipt_LOG.c to log MAC addresses for all chains.
>
> 	should be ridiculously simple -- the limiter is a wrapping if statement
>
> 	if ( in && !out) {
>
> 	(logging of MAC code)
> 	}
>
> 	I suspect that the clever hacker will want to re-wrap that if statement
> such that it only logs it if there IS a MAC address present.  Not being a
> maven with such, I'm NOT gonna make any suggestions as to how.

I would guess that such a check is already present (still not having bothered 
to look at the source code), because as you said yourself earlier in this 
thread:

> >     I note that iptables doesn't log mac addresses it cannot see (i.e. not
> > directly connected)

And this is true even for the INPUT chain (eg: when you are using a ppp 
interface), so presumably the check for "only show MAC if one exists" is 
already coded.

Regards,

Antony.

-- 
"Note: Windows 98, Windows 98SE and Windows 95 are not affected by [MS
Blaster].   However, these products are no longer supported.   Users of these
products are strongly encouraged to upgrade to later versions."

(which *are* affected by MS Blaster...)

http://www.microsoft.com/security/security_bulletins/ms03-026.asp

                                                     Please reply to the list;
                                                           please don't CC me.