Bro + Afterglow == Flow Insight with Link Graph

During HITB 2007 in Malaysia, I have chance to talk to Raffael Marty regarding the afterglow, he has presented the insider threat visualization with afterglow plus splunk to the audience that seems interesting to me. In fact we have used afterglow to do link graphing too.

As we are currently digging much into Bro-NIDS, the connection log is pretty powerful as it provides bidirectional connection state information and the tag for its application data. You can check out its connection state information here to further understand what I'm saying.

I have previously shown how to use afterglow to generate link graph from argus data here, however the graph itself doesn't tell me what's the current connection state or the relation between two nodes, I would prefer to generate the graph that telling me the insight of connection or the context of it and here's how I do it with bro connection log.

shell>head -n 500 conn-bro.log | \
awk '{if ($3 ~ /^192.168..*|^172.16..*|^10..*/)printf "%s,%s,%s\n",$3,$11,$4}' | \
afterglow.pl -c bro-conn-color.properties | \
neato -Tgif -o conn-bro.gif

Awk is good language when parsing the log, $3 is the field number 3 which contains the source IP and it must match any of three private IP ranges and then print the connection state which in field 11, field number 4 would be the destination IP. The delimiter is comma, then we can pipe it to afterglow and output the graph with neato. The graph is shown below -



I have configured different color setting for different connection state so that the graph can be interpreted easily. Here's my bro-conn-color.properties -

# Afterglow color property file
#
# For Bro Connection Flow
#

color.source="lightskyblue1" if ($fields[0]=~/^192\.168\..*/);
color.source="lightskyblue1" if ($fields[0]=~/^10\..*/);
color.source="lightskyblue1" if ($fields[0]=~/^172\.16\..*/);
color.source="blue"

color.event="royalblue1" if ($fields[1]=~/^S0/)
color.event="slateblue1" if ($fields[1]=~/^S1/)
color.event="slateblue2" if ($fields[1]=~/^S2/)
color.event="slateblue3" if ($fields[1]=~/^S3/)
color.event="slateblue4" if ($fields[1]=~/^SF/)
color.event="turquoise3" if ($fields[1]=~/^SH/)
color.event="cyan" if ($fields[1]=~/^SHR/)
color.event="red1" if ($fields[1]=~/^REJ/)
color.event="orangered1" if ($fields[1]=~/^RSTO/)
color.event="orangered2" if ($fields[1]=~/^RSTR/)
color.event="orangered3" if ($fields[1]=~/^RSTOs0/)
color.event="orangered4" if ($fields[1]=~/^RSTRH/)
color.event="grey55" if ($fields[1]=~/^OTH/)
color.event="purple3"

color.target="firebrick1" if ($fields[2] !~/^192\.168\..*/);
color.target="firebrick1" if ($fields[2] !~/^10\..*/);
color.target="firebrick1" if ($fields[2] !~/^172\.16\..*/);
color.target="red"

It looks cryptic for the first time for connection state definition such as S0, S1 and so forth, but you can just learn about it from the link I have mentioned above.

With this kind of graph you may be able to spot unusual traffics and it helps in identifying abnormal network events such as scanning, worm spreading in better context comparing to the previous graph that generated from argus data(two nodes mode).

Other stuffs which I would like to try would be extracting the long flow from the bro connection log by referring to its connection duration as well as the source and destination bytes comparison. It would be interesting to see the graph that generated using different kind of flow metrics.

Enjoy (;])