[Snort-users] using snort to monitor smb/ldap/radius login success/failure

Fei Liu feiliu at ...14056...
Wed Jan 31 15:14:29 EST 2007


Hi Group, I need to develop a tool to monitor smb/ldap/radius login 
success/failure. My initial approach is through wireshark (tshark) + 
perl parsing. I have limited success using this approach with NTLM/SMB 
login. But it seems to me this kind of connection tracking/sniffing must 
be possible with existing technology. Can snort be used for this 
purpose? Would someone be kind enough to demonstrate how it's possible 
to use snort rules to record login SMB success/failure?

Thanks,

Fei

Here is what I do to track SMB login failure/success with perl parsing 
tshark output:
while(<$tshark>){
                my $line = $_;
                if($line =~ m|^Frame\s+(\d+)|){
#                       print Dumper(\%pkt);
                        $pkt{frame} = $1;
                }
                if ($line =~ m|^Internet Protocol, Src: (.*?), Dst: (.*)$|){
                        $pkt{ip}{src} = $1;
                        $pkt{ip}{dst} = $2;
                }

                if($line =~ m|^Transmission Control Protocol, Src Port: 
(\d+).*?Dst Port: (\d+).*?Seq: (\d+), Ack: (\d+), Len: (\d+)$|){
                        $pkt{ip}{tcp}{sport} = $1;
                        $pkt{ip}{tcp}{dport} = $2;
                        $pkt{ip}{tcp}{seq} = $3;
                        $pkt{ip}{tcp}{ack_seq} = $4;
                        $pkt{ip}{tcp}{len} = $5;

                        next if($5 == 0);
                        foreach (keys %sessions){
                                $user = $_;
                                if($sessions{$user}{token} && 
($sessions{$user}{seq} == $pkt{ip}{tcp}{seq}) ){
                                        print "Found response pkt\n";
                                        $sessions{$user}{resp} = 1;
                                }else{
                                        $sessions{$user}{resp} = 0;
                                }
                        }
                }
                if($line =~ m|^\s+User name: (.*)$|){
                        $user = $1;
                        $sessions{$user}{seq} = $pkt{ip}{tcp}{ack_seq};
                        $sessions{$user}{token} = 1;
                        print "Found request pkt\n";
                }
               if($line =~ m|^\s+NT Status: STATUS_SUCCESS|){
                        foreach (keys %sessions){
                                if($sessions{$_}{resp}){
                                        print "User $_ login through smb 
is successful\n";
                                }
                        }
                }
                if($line =~ m|^\s+NT Status: STATUS_LOGON_FAILURE|){
                        foreach (keys %sessions){
                                if($sessions{$_}{resp}){
                                        print "User $_ login through smb 
failed\n";
                                }
                        }
                }
}




More information about the Snort-users mailing list