One of the problems that people have is logging the origin of the attack
streams and tracing packet paths through the networks. Here is a small bit of
code that may help you inexpensively deploy some packet loggers at key
network ingress/egress points. The real solution is to get Dragon or NFR or some
other really kick ass IDS sensor stuff. But for those ISPs on a budget, that
just want to build a quick and dirty forensic logger to track down or follow the
path to the origin of attacks, here is a Linux kernel patch that turns any Linux
system into an ethernet logger that records mac address, ip address, ports and
protocols with a timestamp in the system log.

It can be activated and deactivated at the system console with
two keystrokes, see build instructions below. It's from a tool set of an
article I was working on, but it seemed relevant so I'll release it in
advance.  It started life as a project to build a sniffer small enough to
type from memory. It's simple enough that you should be able to tweak
the output format to suit your own tastes. It is intended to be small
and light so as to lose as few packets as possible.

One nice application is to build a very stripped down Linux system
and turn it on to log packets using a simple low cost pc or rack server.
Depending on your traffic rate and your disk size you may be able to store a
pretty good time window of traffic. If it's not enough... time for a commercial
product with fancy data structures and compression. :-)  We'll be covering
stuff like this during our training at CanSecWest (plug, plug :-).

P.S. I have a message for all the silly bad ass ddos bozos:
       If this is for fun... you'll probably have less fun in the
       long run by being detrimental to others.

comments, feedback, enhancements welcome...
--dr
kyx.net

Learn Kanga-Foo - www.dursec.com

this is a patch for /usr/src/linux/net/ethernet/eth.c:
--kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx--

***************
*** 182,196 ****
--- 184,295 ----
        unsigned char *rawp;

        skb->mac.raw=skb->data;
+
+       /*Linux Kernel Forensic Logger --dr@dursec.com*/
+       eth = skb->mac.ethernet;
+       if( *((u16*)((u8*)skb->data+12)) == 0x0608 )
+       {
+                               printk(">>ARP<< ");
+                               if(*((u16*)((u8*)skb->data+20)) == 0x0100)
+                                       printk("req ");
+                               else if(*((u16*)((u8*)skb->data+20)) == 0x0200)
+                                       printk("REP");
+                               printk("T:%03d.%03d.%03d.%03d:%02x%02x%02x%02x%02x%02x S:%03d.%03d.%03d.%03d:%02x%02x%02x%02x%02x%02x\n",
+                                       *((u8*)skb->data+38), *((u8*)skb->data+39), *((u8*)skb->data+40),
+                                       *((u8*)skb->data+41), *((u8*)skb->data+32), *((u8*)skb->data+33),
+                                       *((u8*)skb->data+34), *((u8*)skb->data+35), *((u8*)skb->data+36),
+                                       *((u8*)skb->data+37), *((u8*)skb->data+28), *((u8*)skb->data+29),
+                                       *((u8*)skb->data+30), *((u8*)skb->data+31), *((u8*)skb->data+22),
+                                       *((u8*)skb->data+23), *((u8*)skb->data+24), *((u8*)skb->data+25),
+                                       *((u8*)skb->data+26), *((u8*)skb->data+27));
+       }
+       else if( *((u16*)((u8*)skb->data+12)) == 0x0008 )
+       {
+               printk(">>IP<< ");
+               switch(*((u8*)skb->data+23))
+               {
+                       case 1: printk("ICMP%d ", ((u8*)skb->data+34));
+                               break;
+                       case 2: printk("IGMP ");
+                               break;
+                       case 0x11: printk("UDP ");
+               }
+               if (*((u16*)((u8*)skb->data+34)) == 0x4300 ||
+                                       *((u16*)((u8*)skb->data+36)) == 0x4400)
+               {
+                       printk("DHCP ");
+                       if(*((u8*)skb->data+42) == 1)
+                               printk("req ");
+                       else  if(*((u8*)skb->data+42) == 2)
+                                 printk("REP ");
+                       else printk("invalid ");
+               }
+               else if(*((u16*)((u8*)skb->data+34)) == 0x3500 ||
+                                       *((u16*)((u8*)skb->data+36)) == 0x3500)
+                       printk("DNS ");
+               printk("s:%03d.%03d.%03d.%03d:%d d:%03d.%03d.%03d.%03d:%d  %d bytes  hl:%02x iplen:%04x ttl:%u\n",
+                                       *((u8*)skb->data+30), *((u8*)skb->data+31), *((u8*)skb->data+32),
+                                       *((u8*)skb->data+33), *((u8*)skb->data+37) + (*((u8*)skb->data+36) << 8),
+                                       *((u8*)skb->data+26), *((u8*)skb->data+27), *((u8*)skb->data+28),
+                                       *((u8*)skb->data+29), *((u8*)skb->data+35) + (*((u8*)skb->data+34) << 8),
+                                       skb->len, *((u8*)skb->data+14), *((u8*)skb->data+17) + (*((u8*)skb->data+16) << 8),
+                                       *((u8*)skb->data+22));
+       }
+       if(*eth->h_dest&1)
+               printk("BCAST-ETH ");
+       if (*(unsigned short *)((u8*)skb->data+12) == 0xFFFF)
+               printk("IPX ");
+        printk("-- MAC:");
+        for(rawp = skb->mac.raw; rawp - skb->mac.raw < 12; rawp++)
+        {
+                printk("%02x",((u8*)eth->h_source)[rawp - skb->mac.raw]);
+                if (rawp - skb->mac.raw == 5) printk(":");
+        }
+       printk("\n");
+ /*eoklog --dr*/
        skb_pull(skb,dev->hard_header_len);
        eth= skb->mac.ethernet;
--kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx--

Klog INSTRUCTIONS:

To use this logger, patch /usr/src/linux/net/ethernet/eth.c, and rebuild your
kernel. (It's recommended that you enable the Magic SysRq key code.)
It's been used under lots of different kernel versions with success....

How to use it:
-This patch makes the kernel log all ethernet packets to syslog.
-The logging happens at the default level.  I.e. normally on.
-You can turn logging on and off at the console by using the Magic SysRq key
 and a number to change the logging level.
-Put the interface into promiscuous mode: ifconfig eth0 promisc

Notes:
-It makes a neat hotkey sniffer when using the text console too.
-It seems to run pretty fast. Any benchmark data welcome(-->dr@dursec.com).
-try a tail -f /var/log/messages for real time display

cheers,
--dr

--
dursec.com / kyx.net - we're from the future                      http://www.dursec.com
learn kanga-foo from security experts: CanSecWest - April 19-21 Vancouver

Speakers: Ron Gula/NSW, Ken Williams/E&Y, Marty Roesch/Hiverworld, Fyodor/insecure.org,
          RainForestPuppy/wiretrip.net, Theo de Raadt/OpenBSD, Max Vision/whitehats.com