第4章03-04节-网络信息被动获取与处理-主机获取.pptVIP

应用实例 Snort libnids tcpdump ssldump sniffer 四、基于Libnids的网络 编程技术 libnids – reassemble IP streams NIDS “E” box (event generation box) Userland TCP/IP stack Based on Linux 2.0.36 IP stack Uses libpcap, libnet internally IP fragment reassembly Kernel IP stack Userland Kernel IP stack Userland IP stack Libnids libnids Basics Initialize nids_init() Register callbacks nids_register_tcp() nids_regster_ip() nids_regiser_udp() Run! nids_run() React nids_kill_tcp() nids_run() UDP callback TCP callback IP callback TCP stream object: - TCP state - client data - server data - source IP, port - dest IP, port - seq, ack, etc … UDP packet: - source IP, port - dest IP, port - UDP payload IP packet - struct IP packet - contains upper layers libnids TCP states NIDS_JUST_ESTABLISHED New TCP connected state (3WHS) Must set stream-{client,server}.collect=1 to get stream payload collected NIDS_DATA Data within a known, established TCP connection NIDS_RESET, NIDS_CLOSE, NIDS_TIMED_OUT TCP connection is reset, closed gracefully, or was lost libnids doesn’t expose SYN_SENT, FIN_WAIT, etc … Example libnids code: jflow jflow Pcap to NetFlow summaries Daemonizes Sends to a receiving host over UDP Limitations of jflow Not very lightweight Inaccurate for some things /~jose/software/jflow/ includes export record ip callback int main (int argc, char *argv[]) { getopt handler UDP socket connect nids_init(); nids_register_ip(monitor_ip); nids_run(); return(0); } ip callback (truncated): void monitor_ip(struct ip *pkt) { struct ip_record rec; int i; rec.rec.srcaddr = (u_int)(pkt-ip_src.s_addr); rec.rec.dstaddr = (u_int)(pkt-ip_dst.s_addr); rec.rec.nexthop = inet_addr(); rec.rec.dOctets = htonl(pkt-ip_len); rec.rec.pad = 0x0; t = pkt-ip_p; rec.rec.tos = 0x0; rec.rec.tcp_flags = 0x0; rec.rec.pad_2 = 0x0; rec.rec.pad_3 = 0x0; for (i = 0; i 4; i++) rec.rec.reserved[i] = 0x0; export_ip_record(rec); return; } export record: void export_ip_rec