Notes on Trafshow 5

Trafshow is a ncurses-based program that shows a snapshot of active network sessions in near real time. I like to use it with OpenSSH sessions on sensors to get a quick look at hosts that might be hogging bandwidth. Recently Trafshow 5 became available in the FreeBSD ports tree (net/trafshow), so I have started using it.

When I showed it in class last week, I realized I did not recognize the color scheme depicted in the screen shot above. I learned that the configuration file /usr/local/etc/trafshow controls these colors:

# The colors are:
#       black  red  green  yellow  blue  magenta  cyan  white
#
# The upper-case Fcolor mean bright *on* and Bcolor blink *on*.
#

#default white:blue

# following color settings looks nice under black-on-gray xterm (xterm-color)

# Private IP Addresses will be alarmed by Red foreground.
# Source        Destination     Color

10.0.0.0/8      any             Red
any             10.0.0.0/8      Red
127.0.0.1/8     any             Red
any             127.0.0.1/8     Red
172.16.0.0/16   any             Red
any             172.16.0.0/16   Red
192.168.0.0/16  any             Red
any             192.168.0.0/16  Red

# Network Services.
# Service       Color   Comments

135             Red     # netbios
137             red     # netbios
138             red     # netbios
139             red     # netbios

snmp            white
smux            white
162             White   # snmp-trap
67              white   # bootp/dhcp-server
68              white   # bootp/dhcp-client
546             white   # dhcpv6-client
547             white   # dhcpv6-server
timed           white
who             white

domain          cyan
389             cyan    # ldap
636             cyan    # ldaps
*/icmp          Cyan

http            blue
https           blue
3128            Blue    # http-proxy
8080            Blue    # http-proxy

smtp            Green
nntp            Green
pop3            green
995             green   # pop3s
143             green   # imap2,4
220             green   # imap3

ftp             yellow
20              Yellow  # ftp-data
tftp            Yellow
nfs             Yellow
6000            Yellow  # X11

ssh             magenta
telnet          Magenta
sunrpc          Magenta
513/tcp         Magenta # rsh
514/tcp         Magenta # rcmd

As you can see in the screen shot, we have SSH, WHOIS, ICMP, DNS, IRC, and NTP active.

You may notice records without port information. For example, the 7th record shows source 69.243.40.166 and destination 204.152.184.73 speaking protocol 6 (TCP). No ports are listed. However, the first two records list the two sides of a conversation between those two hosts. Similarly, the last two records show traffic involving 69.243.40.166 and 65.201.175.103, with no ports. If we look at the 9th record, however, we see those two IPs speaking on port 43 TCP (WHOIS).

A quick look at Argus data from yesterday (when I took this screenshot) reveals that the port 43 TCP traffic was the only conversation between those two hosts:

ra -nn -r argus2.arg -L0 -A - host 65.201.175.103

    StartTime        Flgs   Type     SrcAddr     Sport Dir     DstAddr     Dport 
 SrcPkt   DstPkt    SAppBytes    DAppBytes   State

22 Dec 05 17:11:52           tcp   69.243.40.166.49202  ->  65.201.175.103.43   
  6        6         16           2736        FIN

This indicates to me that the records without port data are related to those with port data, because in this second case only one session involved both IPs.

I will contract Trafshow's author to gain confirmation.

One aspect of the new Trafshow I do not like is the way it opens a port to listen for NetFlow records:

orr:/home/richard$ sockstat -4 | grep trafshow
root     trafshow   1078  4  udp4   *:9995                *:*

To disable this NetFlow collector function, invoke Trafshow with the '-u 0' option.

One feature of Trafshow 5 that I like is the ability to listen on an interface that does not have an IP address assigned. Previous Trafshow versions would complain and fail if they were told to listen on an interface with no IP.

Comments

Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more