Profiling client internet connections

Some more fun with p0f and Splunk…Now with profiling of client internet connections!

Setup of the p0f and logging is the same as in the OS Profiling post.

The Splunk search string has been extended to extract the source’s internet link as a field too (go for the portion in bold for the field extracting commands):

| file /home/path/to/p0f.log | rex field=_raw “> (?<srcip>[^:]+):(?<srcport>[^ ]+) – (?<srcos>.+?) (” | rex field=_raw “-> (?<dstip>[^:]+):(?<dstport>[^ ]+) ” | rex field=_raw “link: (?<srclink>.*))$” |  regex srclink!=”(unspecified|unknown)” | top limit=0 srclink

The fields that I extract with this:

  • srcip -> source IP
  • srcport -> source TCP port
  • srcos -> source’s OS (woot!)
  • dstip -> destination IP (which is my machine’s)
  • dstport -> the destination port which the TCP connection was initiated to
  • srclink -> the internet link of the source machine

After filtering out the “unspecified” and “unknown” links, the list of the detected links are as follows:

“ethernet/modem” points to mostly cable connections.  There’re some interesting entries in the list though, like vtun, pppoe, Google/AOL, IPv6/IPIP (early adopters? haha).  Don’t have any idea on what’s IPSec/GRE, or vLAN here in this context though.

Just for the heck of it, here’s the chart for this table, generated from the reports link in Splunk.

I like the charts, because they allow some interaction with the charts for simple datasets, but I digress 😛

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s