search

ntop / ntopng

Web-based Traffic and Security Network Traffic Monitoring
http://www.ntop.org
GNU General Public License v3.0
6.23k stars 654 forks source link

nProbe + ntopng not showing UDP DDOS fragments #8744

Open melicherm opened 1 week ago

melicherm commented 1 week ago

Hello dear community, based on our latest DDOS attack- that we have encountered - we found out, that around 20Gbit of traffic was not visible in ntopng.

It seems that nProbe / ntopng ignores UDP fragments. We think nProbe or ntopng checks for valid flows. Because a DDOS does not need to use valid flow packets -> e.g. the flow does not have a start packet and it's just random data in UDP fragments -> they are invisible using nptobe+ntopng.

Could someone check if my assumption is OK?

Environment:

How did you reproduce it?

UDP packets, random length, random data inside packets send out over a router that has sFlow -> nProbe -> ntopng and look in flows to find nothing.

Thank you community!

MatteoBiscosi commented 1 week ago

Hi @melicherm is it possible to have a pcap / small portion of that attack (in case we will talk by email)?

melicherm commented 1 week ago

@MatteoBiscosi - we have just this dump:

Frame 15: 1490 bytes on wire (11920 bits), 1490 bytes captured (11920 bits) on interface team0.295, id 0 Section number: 1 Interface id: 0 (team0.295) Interface name: team0.295 Encapsulation type: Ethernet (1) Arrival Time: Sep 16, 2024 15:30:33.079046360 CEST UTC Arrival Time: Sep 16, 2024 13:30:33.079046360 UTC Epoch Arrival Time: 1726493433.079046360 [Time shift for this packet: 0.000000000 seconds] [Time delta from previous captured frame: 0.000002343 seconds] [Time delta from previous displayed frame: 0.000002343 seconds] [Time since reference or first frame: 0.000012911 seconds] Frame Number: 15 Frame Length: 1490 bytes (11920 bits) Capture Length: 1490 bytes (11920 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:data] Ethernet II, Src: HuaweiTechno_c3:55:fa (80:e1:bf:c3:55:fa), Dst: 52:54:00:dd:34:65 (52:54:00:dd:34:65) Destination: 52:54:00:dd:34:65 (52:54:00:dd:34:65) Address: 52:54:00:dd:34:65 (52:54:00:dd:34:65) .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: HuaweiTechno_c3:55:fa (80:e1:bf:c3:55:fa) Address: HuaweiTechno_c3:55:fa (80:e1:bf:c3:55:fa) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: node-5o0.pool-1-0.dynamic.totinternet.net (1.0.156.176), Dst: AAA.BBB.CCC.DDD (AAA.BBB.CCC.DDD) 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 1476 Identification: 0x9371 (37745)

  1. .... = Flags: 0x1, More fragments 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..1. .... = More fragments: Set ...0 0000 1011 0110 = Fragment Offset: 1456 Time to Live: 51 Protocol: UDP (17) Header Checksum: 0x93a7 [validation disabled] [Header checksum status: Unverified] Source Address: node-5o0.pool-1-0.dynamic.totinternet.net (1.0.156.176) Destination Address: AAA.BBB.CCC.DDD (AAA.BBB.CCC.DDD) [Source GeoIP: Choeng Thale, TH] [Source GeoIP City: Choeng Thale] [Source or Destination GeoIP City: Choeng Thale] [Source GeoIP Country: Thailand] [Source or Destination GeoIP Country: Thailand] [Source GeoIP ISO Two Letter Country Code: TH] [Source or Destination GeoIP ISO Two Letter Country Code: TH] [Source GeoIP Latitude: 7,9957] [Source or Destination GeoIP Latitude: 7,9957] [Source GeoIP Longitude: 98,3101] [Source or Destination GeoIP Longitude: 98,3101] [Destination GeoIP: SK] [Destination GeoIP Country: Slovakia] [Source or Destination GeoIP Country: Slovakia] [Destination GeoIP ISO Two Letter Country Code: SK] [Source or Destination GeoIP ISO Two Letter Country Code: SK] [Destination GeoIP Latitude: 48,6667] [Source or Destination GeoIP Latitude: 48,6667] [Destination GeoIP Longitude: 19,5] [Source or Destination GeoIP Longitude: 19,5] Data (1456 bytes) Data [truncated]: be988d746efde6de5f236f5870dbdb124193f9fa64ad71fb89ec296e88413b4a862d5974633088531b5ca92cd53bcbaee103382d3303b0510cc00c002e00010000344401160006070100005460670faad966e80fc938ab02736c00afdafc36425de03135358907485bb87d8e87f8b [Length: 1456]

Hope this helps. Will ask for .pcap if it's available.

DST IP is hidden.

melicherm commented 1 week ago

@MatteoBiscosi - got the .pcap (around 1Mil packets available @1.2GB) i have extracted 200 packets. Would like to send it to you per email - 256 KB. Can you give me your address?

Thank you!

lucaderi commented 1 week ago

@melicherm Please send me the URL from which I can download the pcap. My email is deri@ntop.org

lucaderi commented 1 week ago

using this setup

nprobe --zmq tcp://127.0.0.1:1234 -i ~/Downloads/attack_export.pcapng -b 2 --zmq-probe-mode
ntopng -i tcp://127.0.0.1:1234c

and the pcap you sent us, we see the traffic. Can you please check how your sFlow exporter behaves in case of fragmented traffic? Theoretically, it should not matter.