Tag Archives: tee

OS Profiling

Trying out p0f along with Splunk..

p0f allows you to determine the OS of the remote machine based on the TCP fields characteristics.  It can also tell whether the machine is behind a firewall, what kind of internet connection it is running from…pretty useful for information junkies like me 😀

Here’s what I did:

./p0f -t -u MyUseridHere -i eth0 ‘src not MyIPAddressHere’ | tee -a p0f.log

Runs p0f, logging with actual timestamps (-t), chroot and setuid to MyUserIdHere (-u), listening on eth0 (-i), and filtering out packets for connections initiated from my machine itself (since I’m not interested in profiling my own machine).

tee is a (really nifty!) linux command.  What it does is to “split” the input (stdin) to two parts: stdout and the file specified.  The -a option tells it to append to the file instead of overwriting it.

Using this, p0f outputs logs like this one:

<Sat Jul  3 07:03:56 2010> – Windows 2000 SP2+, XP SP1+ (seldom 98)
-> (distance 12, link: sometimes DSL (2))

One of the Splunk queries that I poked around with:

| file /path/to/p0f.log | rex field=_raw “> (?<srcip>[^:]+):(?<srcport>[^ ]+) – (?<srcos>.+?) (” | rex field=_raw “-> (?<dstip>[^:]+):(?<dstport>[^ ]+) ” | regex srcos!=”UNKNOWN” | top limit=0 srcos

This query extracts out the source and destination IP and port, and the source OS.  Then after filtering out the OS tagged with UNKNOWN, the remaining entries are ranked…

The resulting chart, of not much real interest by itself, just shows that other than that the connections are predominantly from linux machines (hurhur), and there’s a connection from a really old Netware machine (5 was released in Oct 1998!).

Afterglow tests

Just tryin’…

Connections from/to laptop

sudo tcpdump -i wlan0 -p|cut -d' ' -f3,5|cut -d':' -f1|tee dump
cat dump |uniq |sed -r 's/^(.*).[^.]+ (.*).([^.]+)/1,3,2/' > local.csv
cat local.csv |./afterglow.pl |neato -Tgif -o test.gif
Connections to/from laptop
What a mess!

Connections from laptop

Let’s try again, this time only focusing on the outgoing connections initiated:


Connections from laptop
Much better…