Exporting traffic statistics from open source OSes to a Netflow collector
Posted by creining | Filed under Security
Looking into piping traffic statistics from open source operating systems to a Cisco Netflow collector I ran into softflowd and pfflowd (an OpenBSD PF status message converter) both capable of Cisco Netflow datagram export. Once the data is collected it needs to be processed. There are alot of options such as flow-scan which is authored by Dave Plonka an employee at the local University of Wisconsin, cflowd, and autofocus. There’s a wealth of information, including many tools on network traffic analysis at the Cooperative Association for Internet Data Analysis (CAIDA).
Portable CARP implementation
Posted by creining | Filed under Linux/BSD
Frank Denis has created UCARP which is a portable userland implementation of the Common Address Redundancy Protocol (CARP) originally created by OpenBSD as an alternative to the patents-bloated VRRP. Basically, (U)CARP allows multiple machines to share the same virtual IP address to provide failover. UCARP has been tested and works on Linux kernel 2.4 and 2.6 as well as OpenBSD and NetBSD.
Untrustable promisc mode with ifconfig
Posted by creining | Filed under Security
A post to the tcpdump-workers mailing list asked why ifconfig output does not show promisc mode when the interface is actually in promisc mode. I have been familier with this behavior for quite some time. Running Snort or Tcpdump would not show promisc mode in ifconfig output but setting promisc mode with ifconfig itself would show the setting. The reply states that libpcap uses “PF_PACKET sockets, on 2.2 and later kernels, and with those, there’s a better way of turning promiscuous mode on and off, but it sets a flag that ifconfig *doesn’t* show.” I replied with this post stating that the iproute2 tool suite, installed on many linux distributions, would show the setting.
Sguil output plugin for Barnyard
Posted by creining | Filed under Security
Andrew Baker added the output plugin for Sguil to Barnyard CVS HEAD, no more patching 
Defeating bugged phones
Posted by creining | Filed under Security
Interesting article at the BBC about bugging phones. Advice to keep conversations private runs from buying an encrypted phone for phone conversations, using a faraday cage or shielded tent for face-to-face conversations, or the well depicted organized crime practice to “pass information during a long, unpredictable and unannounced walk in the big outdoors.”