Skip to main content

OPERATION: Network Sniffing

1. Start Elastic + supporting services​

  1. Ensure the Elastic and support services (kibana, elasticsearch, logstash, arkime-viewer) are started:

    sudo systemctl start elastic.target

    NOTE: These services are set to auto-start on boot due to systemctl enable elastic.target being ran during installation

  2. You can also verify by accessing the web interfaces of Kibana (https://localhost:5601) and Arkime (https://localhost:8005)

    NOTE: Username: assessor | Password: elastic

2. Sensor Configuration​

tip

The SENSOR_NAME variable within /cvah/dmip/sensor.cfg will be populated in the agent.name and agent.hostname fields in Zeek and Suricata logs within Kibana - if you are collecting network traffic from different locations it is recommended to change SENSOR_NAME to something descriptive for that location (ie. "pumphouse-1") and restarting sensor.target.

  1. Set the sniffing interface(s) you will use, the SENSOR_NAME, and HOME_NET within /cvah/dmip/sensor.cfg: 
    # One or more interfaces to sense on (must be COMMA delimited) - is applied to Zeek, Suricata, and Arkime
    INTERFACES=<MIP_SNIFFING_INTERFACE(S)>

    # The name of the sensor - is applied to Zeek and Suricata logs via Filebeat
    SENSOR_NAME=<UNIQUE_SENSOR_NAME>

    # Home Net determines connection directionality (must be COMMA delimited) - is applied to Zeek and Suricata
    HOME_NET=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

    # External Net affects Suricata alerting logic (must be COMMA delimited) - is only applied to Suricata
    EXTERNAL_NET=any

    # The Berkeley Packet Filter (BPF) to focus on to capture - is only applied to Arkime
    BPF=

    # The Berkeley Packet Filter (BPF) to exclude saving as PCAP - is only applied to Arkime
    DONT_SAVE_BPF=

    NOTE: You may configure the other variables as well if you know what you are doing

3. Configure sniffing interface(s)​

danger

In order to not accidentally transmit any frames or packets from the MIP from the sniffing interface(s), it is highly recommended that the sniffing interface(s) be configured in the following manner.

info

The sensor-interfaces service configures all valid interfaces in the INTERFACES variable within /cvah/dmip/sensor.cfg to:

  • Flush the interface(s) IP address(es)
  • Enable promiscuous mode
  • Disable ARP
  • Add firewall rules to drop all outbound traffic
warning

All communications using the specified interfaces will be interrupted!

Restart the sensor-interfaces service:

sudo systemctl restart sensor-interfaces
tip

To undo the changes made to the interfaces, you can just stop the sensor-interfaces service:

sudo systemctl stop sensor-interfaces

4. Tune Sensor rulesets (optional)​

info
  • SURICATA RULES: /cvah/dmip/suricata/suricata.rules - Suricata was configured to use rules copied from the smb://fileserver/share/ANALYTICS/02_SURICATA/RULES/ folder during installation, but more can be added/modified/removed within this file.
  • ZEEK SIGNATURES: /cvah/dmip/zeek/signatures.sig - Zeek signatures can be added to this file.
  • ZEEK INTEL: /cvah/dmip/zeek/intel.dat - Atomic IOCs feed into Zeek's Intel framework can be added here (see 262COS-DIP-SOP-004 - CVAH DIP Sensor Configuration for syntax)
  • ZEEK SCRIPTS: /cvah/dmip/zeek/scripts/ - Zeek scripts to be loaded can be added to this folder.

4. Start Sensor services​

  1. Restart the sensor services (filebeat, zeek, suricata, arkime-capture) are started: 
    sudo systemctl restart sensor.target

    NOTE: These services are NOT set to auto-start and must be manually started/stopped

6. Connect sniffing interface(s)​

With everything configured, you may now connect the sniffing interface(s) to your target SPAN/TAP ports.

7. Monitor in Kibana / Arkime​

Access the web interfaces of Kibana (https://localhost:5601) and Arkime (https://localhost:8005)

NOTE: Username: assessor | Password: elastic