Re: Snort for Broadcast Detection counts only

[Phil Wood <cpw () lanl gov>]

Snort will not see all the broadcasts.  You might want to use tcpdump.
You would have to twiddle with the attached sed script to match all the
different types of broadcasts on your particular network.  But, first
just run the following command:

  tcpdump -i <your_interface> -qn -c 100 broadcast > /tmp/100

Take a look at the file to see the different types.  And try a version of
this god-awful script:
:
cat /tmp/100 | sed -e 's/^.*IP //' -e 's/^.*) //' -e 's/^.*arp who-has //' -e 's/> //' -e 's/tell //' -e 's/: .*//' -e 
's/:ipx.*//' | sort | uniq -c | sort -rn

And you will get something like this:

     12 192.168.114.119.137 192.168.114.255.137
     11 192.168.114.52 192.168.114.241
      8 192.168.114.102 192.168.114.241
      6 192.168.114.205.137 192.168.114.255.137
      5 192.168.114.134 192.168.114.241
      5 192.168.114.100 192.168.114.29
      3 192.168.177.29.137 192.168.177.255.137
      3 192.168.114.119.138 192.168.114.255.138
      2 192.168.177.25 192.168.177.241
      2 192.168.114.215 192.168.114.241
      2 192.168.114.214 192.168.114.241
      2 192.168.114.213 192.168.114.241
      2 192.168.114.212 192.168.114.241
      2 192.168.114.211 192.168.114.241
      2 00000000.00:60:b0:f1:70:2c.400b 00000000.ff:ff:ff:ff:ff:ff.0452
      1 192.168.4.200 192.168.114.110
      1 192.168.4.115 192.168.114.21
      1 192.168.177.84 192.168.177.11
      1 192.168.177.31 192.168.177.241
      1 192.168.177.150 192.168.177.241
      1 192.168.177.124.138 192.168.177.255.138
      1 192.168.177.124 192.168.177.241
      1 192.168.114.71 192.168.114.238
      1 192.168.114.69.138 192.168.114.255.138
      1 192.168.114.65 192.168.114.241
      1 192.168.114.61.138 192.168.114.255.138
      1 192.168.114.247.138 192.168.114.255.138
      1 192.168.114.241 192.168.114.32
      1 192.168.114.238.138 192.168.114.255.138
      1 192.168.114.237.138 192.168.114.255.138
      1 192.168.114.234.138 192.168.114.255.138
      1 192.168.114.225.138 192.168.255.255.138
      1 192.168.114.2 192.168.114.173
      1 192.168.114.197 192.168.114.190
      1 192.168.114.192 192.168.114.78
      1 192.168.114.192 192.168.114.247
      1 192.168.114.192 192.168.114.238
      1 192.168.114.188 192.168.114.241
      1 192.168.114.161 192.168.114.173
      1 192.168.114.16.138 192.168.114.255.138
      1 192.168.114.145 192.168.177.14
      1 192.168.114.111 192.168.114.173
      1 00000000.00:60:b0:f1:70:2c.0452 00000000.ff:ff:ff:ff:ff:ff.0452
      1 00000000.00:60:b0:ca:53:4c.0452 00000000.ff:ff:ff:ff:ff:ff.0452
      1 00000000.00:60:b0:c7:18:89.0452 00000000.ff:ff:ff:ff:ff:ff.0452
      1 00000000.00:60:b0:9b:6e:4c.0452 00000000.ff:ff:ff:ff:ff:ff.0452
      1 00000000.00:10:83:43:6c:11.0452 00000000.ff:ff:ff:ff:ff:ff.0452
      1 00000000.00:01:e6:73:af:b6.0452 00000000.ff:ff:ff:ff:ff:ff.0452

On Tue, Dec 03, 2002 at 09:35:19AM -0600, Tim Olson wrote:
> Hi,
>
> I'd like to set up snort to detect broadcasts only and then
> have a way to tabulate the sources to see where most of them are
> coming from.   I've trimmed down my .rules section to the snort.conf
> file, and created rules to detect broadcasts.   Anyone else ever
> set snort up to do this?  If so, maybe give me some tips as to
> getting a good display of the tabulation.  So far I've only used
> Snortsnarf and never dabbled in ACID or any other add-ons.
> Give me some suggestions and I'll try them out.
>
> Ultimately I'm just trying to discover the cause of excessive
> broadcasts on our network.  Our Cisco switches see maybe 10,000
> in 5 minutes.
>
> Tim
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Microsoft Visual Studio.NET 
> comprehensive development tool, built to increase your 
> productivity. Try a free online hosted session at:
> http://ads.sourceforge.net/cgi-bin/redirect.pl?micr0003en
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
Phil Wood, cpw () lanl gov



-------------------------------------------------------
This SF.net email is sponsored by: Microsoft Visual Studio.NET 
comprehensive development tool, built to increase your 
productivity. Try a free online hosted session at:
http://ads.sourceforge.net/cgi-bin/redirect.pl?micr0003en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users