Brad Tilley wrote:
Jason Opperisano wrote:
On Tue, Nov 23, 2004 at 04:50:28PM -0500, Brad Tilley wrote:
Is it possible to log the packet body and not just the header?
Currently I have this line in my iptables start-up file:
/sbin/iptables -I INPUT -p tcp -s ! 128.173.120.79 -d
128.173.120.79 -j LOG --log-prefix="Packet_Filter:"
And it generates log entries such as this:
Nov 23 16:44:28 athop1 kernel: Packet_Filter:IN=eth0 OUT=
MAC=00:30:6e:5e:a2:0c:00:d0:01:ab:44:00:08:00 SRC=64.81.214.131
DST=128.173.120.79 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=29621 DF
PROTO=TCP SPT=60366 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0
I'd like to capture the packet body as well. I'm new to packet
logging so forgive me if I'm over looking the obvious.
AFAIK, the normal LOG target cannot actually do this. instead, use the
ULOG target which will copy the entire packet to the userspace ulogd
daemon where you can use the ulogd_PCAP.so plugin to create a tcpdump
file of the packets you are interested in. check out:
http://gnumonks.org/gnumonks/projects/project_details?p_id=1
for more details about ulogd.
HTH...
-j
--
"Television! Teacher, mother, secret lover."
--The Simpsons
Thanks, that works great. I had to recompile the kernel to get ULOG
support, but other than that, it's rather straightforward. I added
this line to my iptables startup script:
/sbin/iptables -I INPUT -p tcp -s ! 128.173.120.79 -d 128.173.120.79
-j ULOG --ulog-prefix "Packet_Filter:"
I'm using the /usr/lib/ulogd/ulogd_OPRINT.so plugin to write the
packet capture to a file for now. Here's a sample of what it looks like:
===>PACKET BOUNDARY
tcp.fin=0
tcp.syn=1
tcp.rst=0
tcp.psh=0
tcp.ack=0
tcp.urg=0
tcp.window=64240
tcp.ackseq=0
tcp.seq=4245420361
tcp.dport=445
tcp.sport=2797
ip.fragoff=16384
ip.id=11011
ip.csum=2618
ip.ihl=5
ip.totlen=48
ip.ttl=111
ip.tos=0
ip.protocol=6
ip.daddr=128.173.120.79
ip.saddr=63.231.157.167
oob.out=
oob.in=eth0
oob.mark=0
oob.time.usec=213408
oob.time.sec=1101257132
oob.prefix=Packet_Filter:
raw.pktlen=48
raw.pkt=raw.mac=00:30:6e:5e:a2:0c:00:d0:01:ab:44:00:08:00
Now, all I need to do is figure out what's in the packet body. Any
pointers on that? Ideally I'd like to write a script that recreates
keystrokes from packets that contain ssh session info. Probably
off-topic here, but I thought I'd ask. Thanks for the ULOG tip!
I figured it out. BTW, I meant telnet sessions, not ssh... didn't want
y'all to think I'm a complete idiot.
Brad
