search

cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.53k stars 1.7k forks source link

Also show local IP addresses #649

Open jbremer opened 8 years ago

jbremer commented 8 years ago

Currently local IP addresses are filtered and not shown in the Network Analysis tab. Do make them show as targeted samples may contain hardcoded IP addresses to other boxes in the same private network.

botherder commented 8 years ago

We should however filter out those that are involved for Cuckoo operations. I feel that otherwise it's mostly gonna cause lots of confusion. @jekil thoughts?

KillerInstinct commented 8 years ago

Cuckoo operations shouldn't be captured at all due to bpf filtering of host <-> guest in the sniffer auxiliary module. I think what Jurriaan is getting as is the dropping of packets if it's a local network which is done in the network processing module: https://github.com/cuckoobox/cuckoo/blob/master/modules/processing/network.py#L179

Why not make it configurable? :)

botherder commented 8 years ago

There's still a lot that bpf filter isn't filtering out. Regular Windows UDP traffic and shit related to the execution of the VM and configuration of the internal network. That kind of stuff I also considered as "Cuckoo operations".

KillerInstinct commented 8 years ago

While that may be true, there is no UDP traffic parsers that we particularly care about. I deleted that line for a custom inetsim rig and that generated some 'bloat' stuff. So really the only thing you have to do is ignore some of the tcp/udp dissection in the tcp/udp panes. But honestly, that is probably the least useful information overall when quickly looking at an analysis -- IMO.

jbremer commented 8 years ago

@KillerInstinct just to be clear, what do you refer to with the least useful information overall here?

KillerInstinct commented 8 years ago

The TCP/UDP tabs. They are generally unuseful for quickly looking at an analysis and really only provide supporting information to other networking data.

jbremer commented 8 years ago

Agreed, now would be a good time to port those to http/https/etc protocols and remove the streams from the tcp/udp tabs for all streams that are represented in another tab.