Snort mailing list archives
using snort to monitor smb/ldap/radius login success/failure
From: Fei Liu <feiliu () aepnetworks com>
Date: Wed, 31 Jan 2007 15:14:29 -0500
Hi Group, I need to develop a tool to monitor smb/ldap/radius login success/failure. My initial approach is through wireshark (tshark) + perl parsing. I have limited success using this approach with NTLM/SMB login. But it seems to me this kind of connection tracking/sniffing must be possible with existing technology. Can snort be used for this purpose? Would someone be kind enough to demonstrate how it's possible to use snort rules to record login SMB success/failure? Thanks, Fei Here is what I do to track SMB login failure/success with perl parsing tshark output: while(<$tshark>){ my $line = $_; if($line =~ m|^Frame\s+(\d+)|){ # print Dumper(\%pkt); $pkt{frame} = $1; } if ($line =~ m|^Internet Protocol, Src: (.*?), Dst: (.*)$|){ $pkt{ip}{src} = $1; $pkt{ip}{dst} = $2; } if($line =~ m|^Transmission Control Protocol, Src Port: (\d+).*?Dst Port: (\d+).*?Seq: (\d+), Ack: (\d+), Len: (\d+)$|){ $pkt{ip}{tcp}{sport} = $1; $pkt{ip}{tcp}{dport} = $2; $pkt{ip}{tcp}{seq} = $3; $pkt{ip}{tcp}{ack_seq} = $4; $pkt{ip}{tcp}{len} = $5; next if($5 == 0); foreach (keys %sessions){ $user = $_; if($sessions{$user}{token} && ($sessions{$user}{seq} == $pkt{ip}{tcp}{seq}) ){ print "Found response pkt\n"; $sessions{$user}{resp} = 1; }else{ $sessions{$user}{resp} = 0; } } } if($line =~ m|^\s+User name: (.*)$|){ $user = $1; $sessions{$user}{seq} = $pkt{ip}{tcp}{ack_seq}; $sessions{$user}{token} = 1; print "Found request pkt\n"; } if($line =~ m|^\s+NT Status: STATUS_SUCCESS|){ foreach (keys %sessions){ if($sessions{$_}{resp}){ print "User $_ login through smb is successful\n"; } } } if($line =~ m|^\s+NT Status: STATUS_LOGON_FAILURE|){ foreach (keys %sessions){ if($sessions{$_}{resp}){ print "User $_ login through smb failed\n"; } } } } ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier. Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- using snort to monitor smb/ldap/radius login success/failure Fei Liu (Jan 31)