Slashdot Mirror
Build A Darknet To Capture Naughty Traffic
DM_NeoFLeX writes "Have some routable Address Space lying around? You might want to build a DarkNet. The folks over at Team Cymru have outlined instructions for creating one with FreeBSD and as little as /32 routable space. From the article: 'A Darknet is a portion of routed, allocated IP space in which no active services or servers reside. These are 'dark' because there is, seemingly, nothing within these networks. Any packet that enters a Darknet is by its presence Aberrant.' Darknets can provide useful information for tracking the flow of naughty network traffic."
Embrace the power of the darknet.
"Would you, could you, with a goat?" Dr Seuss
The comments that follow are time-stamped proof of what you were all doing during working hours...
I thought that California had the market cornered on this during the energy crisis...
Do not look into laser with remaining eye.
darknet n. The collection of networks and other technologies that enable people to illegally share copyrighted digital files with little or no fear of detection.a sp
http://www.wordspy.com/words/darknet.
How do you track so called "naughty network traffic" when it goes to an IP with no services or servers? I guess you could do this with somthing along the lines of a "border" firewall (rather then a NAT system). But few of us have such a setup.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
It would seem like a good idea to use the info collected by the Darknet to perhaps automatically blacklist those offending IP addresses or perhaps to automatically complain to the offending ISP.
The Juniper (NetScreen/OneSecure) IDP has done a similar thing for years now.
You can assign it any IP and port combination, and it will ACK for any SYN's sent to it, whether there's a real server running on that IP or not. Such 'unsolicited' connections are a bad-traffic giveaway.
-AutoNiN
These are 'dark' because there is, seemingly, nothing within these networks. Any packet that enters a Darknet is by its presence Aberrant.
That's like the mailman trying to deliver letters to Santa Claus, or somebody addressing a letter wrong, thank good I know all those letters are Abberant now.
Your hair look like poop, Bob! - Wanker.
It's like a honeypot, except designed to catch worms, rather than live hacking attempts. Hell this could be extended with fake entries in a corporate address book to monitor worms that spread via e-mail communication.
I like the idea, and wish I had the corporate status to consider an implementation at my company.
I want an IP in the darknet!
I can hear the cry of the children everywhere!
Oh yeah! and whats an IP?
The Box is Open
Ok, it's a really good idea, but catching the naughty traffic isnt the hard part, what does it do witht he naughty traffic it gets, just make a pretty graph?
"Pushing little children, with their fully automatics, they like to push the weak around"
I have read thousands of Slash posts, and I promise you that being funny has never been a problem.
Seriously. I've read Dilbert and User Friendly, and what passes for +1 Funny with you folks isn't. It's complaining with community tech jargon thrown in, or it's complaining, or it's misuse of community jargon by outsiders.
I'm not the only one who's made this observation. You guys need a serious humor overhaul. Look to some humor sources from better-adjusted people to fully understand your problem.
LOL, I hate Monday too, John Arbuckle. Let's see what ole Marmaduke's up to.
The analysis of the Witty worm (discussed on /. here ) used a massive darknet subtending 1/256 of the entire IPv4 address space. This gave them an excellent sample size for analyzing the behavior of the worm.
Two wrongs don't make a right, but three lefts do.
Somehow I doubt ARIN and IANA will like this.
Sounds like a standard HoneyPot, except the only machine on the nextwork segement is a packet sniffer, so the address doesn't have any real destinations.. Not a big deal. I'm sure the honeynet people have done similar.
-molo
Using your sig line to advertise for friends is lame.
A sniffer will sniff all traffic on the wire for malicious activity, where as this, since there is no reason for any traffic to be directed at these addresses or routed to that subnet, you know immediately something is up.
If it seems like you've heard it before, you probably have, its similar if not the same thing to a honeypot/net.
"I use a Mac because I'm just better than you are."
a /32 block is a single machine.
Using dark ip space, bogon space and so on for blackhole network monitoring has been in use for a while to help detect DDoS's and even network worms. Jose Nazario has written quite thoroughly and extensively about their usage in his book, Defense and Detection Strategies against Internet Worms. Check it out if this interests you.
An interesting use of a darknet would be to shield a real server from unwanted attacks. Have the darknet relate any internet IPs that contact the darknet to your real server to ignore.
As an example. Setup a darknet on the following IPs:
DARK_A : 204.210.34.1
DARK_B : 204.210.34.3
Setup the real server mathematically between the two darknet IP addresses:
REAL : 204.210.34.2
Now have DARK_A & DARK_B contact REAL whenever DARK_A or DARK_B receive any packets. REAL can be setup to, on the fly, filter out any packets received from the same source as the DARK servers reported.
In a sense you're creating a realtime blacklist. You can set the list on a timed delay to expire. Or even filter out specific packet signatures instead of entire suspect IP addresses.
just a thought...
Joseph Elwell
I have a whole list of bookmarks for my naughty traffic.
Seriously, though... I have a spare wireless router set up at work that's easily hacked, easily found, and logs every damn thing that touches it. Our real wireless network is obscured, encrypted, mac filtered, etc. I realize it's not technically the same thing as the post describes (I guess you'd call it a honeypot network or something) but it's the same idea.
Of course, nobody will care if a hacker makes his way into our network (honeypot or not) unless he does some "damage."
like anyone here as a /32 ip block
/32 block, I do, and so does everyone else here. A /32 block is a single ip address. People with DSL connections, who get more than 1 ip allocated, are perfect candadites. I can even get additional ip's from my cable company, on request, for no additional charge (at least that was the case about a year ago, I heard they charge like 3 bucks a month now).
Maybe you should have learned networking before posting that. You have a
bash: rtfm: command not found
What's the difference between a darknet and a honeypot/net setup? Both seem to have the same goals, and both use some IP space to detect potential attacks.
...there are easier ways of finding Pr0n aren't there? Like opening up your spam folder :-)
These posts express my own personal views, not those of my employer
The idea here is to catch traffic to otherwise unused network addresses. This does not require any of the stuff that seems to be implied here.
For example, say you have a Linux system in a colo somewhere (or on the end of a T-1 or some other >1 IP address static network). You have some IP addresses assigned to you that are otherwise not assigned. Here is how you can get all of the darknet functionality with your standard server.
Some example numbers (none of which are real)
Unused address to watch: 10.11.12.13
Interface on which you receive traffic: eth0
A fake interface to route to: tap0
Configure your server to ARP the extra addresses:
arp -Ds 10.11.12.13 eth0 -i eth0 pub
Setup a "tap" device to route the traffic to
tunctl -u nobody -t tap0
ifconfig tap0 10.11.12.13 netmask 255.255.255.0 broadcast 10.11.12.255 up
Setup a "route" to the device
ip route add 10.11.12.13 dev tap0
At this point the traffic should all route to the fake device tap0. You can run tcpdump on this, setup IP filter chains, run MRTG on it directly, etc. All without any extra hardware.
For those that work with UML (User Mode Linux), you already recognize this is exactly how you setup virtual UML networks.
This is also somewhat related to "tar pits" that just answer connect requests to addresses that have un-completed ARP requests.
Have fun.
These things have been around for awhile, but known as Network Telescopes. The largest (AFAIK) is at UCSD, which is just a tad larger than a /32 (like, say, a /8). They collected some interesting data off the thing during all the Blaster rampages (Google cache of HTML'ed PDF here).
Also, see the NANOG guide to setting them up here, and the home for the CAIDA/UCSD telescope here.
So in short, nice job to the Welsh for implementing it, but there's bigger elsewhere for y'all to play with.
Cue The Sun...
Well, yes it's 10.0.0.0
but I control it...and that's what's important.
Ok, well...yes, I only control it on my side of the router...
sniff...nevermind
Waitaminute !
Wouldn't this be impossible to create with IPv6? Because of the *huge* address space and the negligible probability of a packet entering a darknet?
This is in no way an argument against IPv6, I'm eagerly awaiting it - I'm just curious...
Santa Claus
North Pole, Canada
H0H 0H0
If you write Santa at this address, he will write back. Not 100% sure USPS will send it over the border, but if they do, it'll work.
( Canada Post sends out replies to children each year; I think employees at the post office volunteer and take the time to hand-craft a personal reply to each and every letter, though they may be auto-generated nowadays, i am not certain ).
Down at SDSC they have a little less than 1% of ALL of the routable IP space dedicated to doing this stuff. They call it a network telescope, and use it to study DOS activity and stuff.
http://www.caida.org/analysis/security/telescop
"Inferring Internet Denial-of-Service Activity" [2001] is good reading.
I completely agree, after spending countless hours sifting through log files, tweaking triggers to help reduce the amount of false positives, the IDS is not the complete answer.
An IDS is only so efficient, you need to first really understand your network before deploying, and even after deployment, this is only the beginning.
We have been using Darknets, or honeypots for sometime, an excellent combination of tools, see Snort, ACID (Analysis Console for Intrusion Databases
As said before and in the article, this is a sophisticated set of tools and you need to understand your network, or you will find yourself chasing ghosts, Enter the Darknet (Honeypot).
Combined with the other tools, we have been using Honeyd , an excellent honeypot, simple to get up an going and very configurable.
Snort.org has an excellent howto documentation to get the IDS up an going, then you can add the honeypot.
It can be downright humorous how quickly you will begin to capture useful information. In addition, adding scripts to interact with the traffic will allow you to keep the user busy while you are collecting data, or Tarpitting the traffic making the port "sticky" dragging the connections, another good one would be LeBrea.
If you have any interest in network security, or simply want to monitor your home network, you need to take a look at darknet, or any of the other tools mentioned.
I've got a /666 block. It's a devil to manage.
Whenever you read this sig someone's refrigerator light turns on.
"upto date design" is for marketeers. Simplicity is for conveying information. If you dont like it, don't read it.
just another excuse for sysadmins everywhere to amass large quantities of pr0n in a short period of time ...
We moderators do not have a sense of humor that we are aware of.
I think we should punish people no matter what they do. It's fun!
Luke did not 'defeat' Vader and the darkside. He threw down his lightsaber and it was Vader who rose up and brought an end to the Sith - but not the darkside of the force. Han's daughter briefly dabbled, and Mara Jade could be considered 'dark'.
Slap it on the nose with a newspaper and say, "Bad! Bad packet!"?
More than a decade ago we built a "darknet" out of several unused class A addresses which we had access at the time. This was an experiment and we coordinated with the right network operators and funding agencies to make it all right. All networks were routed to our capture network containing only a packet sniffer. We kept the network in place for a month. The result: an amazing variety of "broken packets" which one Internet guru dubbed "bogons" arived at a low but constant rate. The three class A networks allowed us to see effects across part of the network address "spectrum:" we noticed, for example, that some bogons from the same host showed up on all three networks, spreading broken packets across the address space! We traced many bogons to bad UNIX ports and could, in some cases, locate the specific porting error responsible. Big and little endian problems accounted for many. A lot of people ran these broken ports and, due to the random luck of their address assignment, the port generated orphaned bogons onto our three class A networks. and hence to our darknet. One day we captured bogons containing commands for a distributed database. We traced it to a development lab run by a large computer manufacturer who thought no one knew that they were working on a new distributed database product. We were able to discover the origin and cause of many bogons, however, in the majority of cases we could not establish the bogon's cause or its origin. Our "darknet" experience showed a constant low level chatter of bogons througout the Internet. There are no "silent" slots in the address space, unused, where no one routes traffic. Unexpected things arrive and await discovery.