[Snort-users] Snort for Broadcast Detection counts only

Phil Wood cpw at ...440...
Wed Dec 4 08:51:03 EST 2002


Snort will not see all the broadcasts.  You might want to use tcpdump.
You would have to twiddle with the attached sed script to match all the
different types of broadcasts on your particular network.  But, first
just run the following command:

  tcpdump -i <your_interface> -qn -c 100 broadcast > /tmp/100

Take a look at the file to see the different types.  And try a version of
this god-awful script:
:
cat /tmp/100 | sed -e 's/^.*IP //' -e 's/^.*) //' -e 's/^.*arp who-has //' -e 's/> //' -e 's/tell //' -e 's/: .*//' -e 's/:ipx.*//' | sort | uniq -c | sort -rn

And you will get something like this:

     12 192.168.114.119.137 192.168.114.255.137
     11 192.168.114.52 192.168.114.241
      8 192.168.114.102 192.168.114.241
      6 192.168.114.205.137 192.168.114.255.137
      5 192.168.114.134 192.168.114.241
      5 192.168.114.100 192.168.114.29
      3 192.168.177.29.137 192.168.177.255.137
      3 192.168.114.119.138 192.168.114.255.138
      2 192.168.177.25 192.168.177.241
      2 192.168.114.215 192.168.114.241
      2 192.168.114.214 192.168.114.241
      2 192.168.114.213 192.168.114.241
      2 192.168.114.212 192.168.114.241
      2 192.168.114.211 192.168.114.241
      2 00000000.00:60:b0:f1:70:2c.400b 00000000.ff:ff:ff:ff:ff:ff.0452
      1 192.168.4.200 192.168.114.110
      1 192.168.4.115 192.168.114.21
      1 192.168.177.84 192.168.177.11
      1 192.168.177.31 192.168.177.241
      1 192.168.177.150 192.168.177.241
      1 192.168.177.124.138 192.168.177.255.138
      1 192.168.177.124 192.168.177.241
      1 192.168.114.71 192.168.114.238
      1 192.168.114.69.138 192.168.114.255.138
      1 192.168.114.65 192.168.114.241
      1 192.168.114.61.138 192.168.114.255.138
      1 192.168.114.247.138 192.168.114.255.138
      1 192.168.114.241 192.168.114.32
      1 192.168.114.238.138 192.168.114.255.138
      1 192.168.114.237.138 192.168.114.255.138
      1 192.168.114.234.138 192.168.114.255.138
      1 192.168.114.225.138 192.168.255.255.138
      1 192.168.114.2 192.168.114.173
      1 192.168.114.197 192.168.114.190
      1 192.168.114.192 192.168.114.78
      1 192.168.114.192 192.168.114.247
      1 192.168.114.192 192.168.114.238
      1 192.168.114.188 192.168.114.241
      1 192.168.114.161 192.168.114.173
      1 192.168.114.16.138 192.168.114.255.138
      1 192.168.114.145 192.168.177.14
      1 192.168.114.111 192.168.114.173
      1 00000000.00:60:b0:f1:70:2c.0452 00000000.ff:ff:ff:ff:ff:ff.0452
      1 00000000.00:60:b0:ca:53:4c.0452 00000000.ff:ff:ff:ff:ff:ff.0452
      1 00000000.00:60:b0:c7:18:89.0452 00000000.ff:ff:ff:ff:ff:ff.0452
      1 00000000.00:60:b0:9b:6e:4c.0452 00000000.ff:ff:ff:ff:ff:ff.0452
      1 00000000.00:10:83:43:6c:11.0452 00000000.ff:ff:ff:ff:ff:ff.0452
      1 00000000.00:01:e6:73:af:b6.0452 00000000.ff:ff:ff:ff:ff:ff.0452

On Tue, Dec 03, 2002 at 09:35:19AM -0600, Tim Olson wrote:
> Hi,
> 
> I'd like to set up snort to detect broadcasts only and then
> have a way to tabulate the sources to see where most of them are
> coming from.   I've trimmed down my .rules section to the snort.conf
> file, and created rules to detect broadcasts.   Anyone else ever
> set snort up to do this?  If so, maybe give me some tips as to
> getting a good display of the tabulation.  So far I've only used
> Snortsnarf and never dabbled in ACID or any other add-ons.
> Give me some suggestions and I'll try them out.
> 
> Ultimately I'm just trying to discover the cause of excessive
> broadcasts on our network.  Our Cisco switches see maybe 10,000
> in 5 minutes.
> 
> Tim
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Microsoft Visual Studio.NET 
> comprehensive development tool, built to increase your 
> productivity. Try a free online hosted session at:
> http://ads.sourceforge.net/cgi-bin/redirect.pl?micr0003en
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
Phil Wood, cpw at ...440...





More information about the Snort-users mailing list