[netsa-tools-discuss] results with rwfilter
Kirk Olson
Kirk_Olson at secura.net
Tue Apr 14 15:32:25 EDT 2020
Same result
From: Timur David Snoke <tdsnoke at cert.org>
Sent: Tuesday, April 14, 2020 2:30 PM
To: Kirk Olson <Kirk_Olson at secura.net>; Angela Horneman <ahorneman at cert.org>; netsa-tools-discuss at cert.org
Subject: Re: [netsa-tools-discuss] results with rwfilter
And if you change the type to other?
-Timur Snoke
From: Kirk Olson <Kirk_Olson at secura.net<mailto:Kirk_Olson at secura.net>>
Date: Tuesday, April 14, 2020 at 3:29 PM
To: Timur Snoke <tdsnoke at cert.org<mailto:tdsnoke at cert.org>>, Angela Horneman <ahorneman at cert.org<mailto:ahorneman at cert.org>>, "netsa-tools-discuss at cert.org<mailto:netsa-tools-discuss at cert.org>" <netsa-tools-discuss at cert.org<mailto:netsa-tools-discuss at cert.org>>
Subject: RE: [netsa-tools-discuss] results with rwfilter
# rwfilter --start=2020/04/10 --sensor=ACIDVS --type=in --protocol=0- --site-config-file=/var/silk/data/silk.conf --print-missing --print-stat
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.00
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.01
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.02
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.03
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.04
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.05
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.06
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.07
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.08
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.09
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.10
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.11
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.12
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.13
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.14
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.15
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.16
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.17
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.18
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.19
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.20
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.21
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.22
Missing /data/ACIDVS/in/2020/04/10/in-ACIDVS_20200410.23
Files 0. Read 0. Pass 0. Fail 0.
From: Timur David Snoke <tdsnoke at cert.org<mailto:tdsnoke at cert.org>>
Sent: Tuesday, April 14, 2020 2:28 PM
To: Kirk Olson <Kirk_Olson at secura.net<mailto:Kirk_Olson at secura.net>>; Angela Horneman <ahorneman at cert.org<mailto:ahorneman at cert.org>>; netsa-tools-discuss at cert.org<mailto:netsa-tools-discuss at cert.org>
Subject: Re: [netsa-tools-discuss] results with rwfilter
Add print-stats:
rwfilter --start=2020/04/10 --sensor=ACIDVS --type=in --protocol=0- --site-config-file=/var/silk/data/silk.conf --print-missing --print-stat
-Timur Snoke
From: Kirk Olson <Kirk_Olson at secura.net<mailto:Kirk_Olson at secura.net>>
Date: Tuesday, April 14, 2020 at 3:25 PM
To: Timur Snoke <tdsnoke at cert.org<mailto:tdsnoke at cert.org>>, Angela Horneman <ahorneman at cert.org<mailto:ahorneman at cert.org>>, "netsa-tools-discuss at cert.org<mailto:netsa-tools-discuss at cert.org>" <netsa-tools-discuss at cert.org<mailto:netsa-tools-discuss at cert.org>>
Subject: RE: [netsa-tools-discuss] results with rwfilter
I get the following:
rwfilter: No output(s) specified
Use 'rwfilter --help' for usage
From: Timur David Snoke <tdsnoke at cert.org<mailto:tdsnoke at cert.org>>
Sent: Tuesday, April 14, 2020 2:23 PM
To: Kirk Olson <Kirk_Olson at secura.net<mailto:Kirk_Olson at secura.net>>; Angela Horneman <ahorneman at cert.org<mailto:ahorneman at cert.org>>; netsa-tools-discuss at cert.org<mailto:netsa-tools-discuss at cert.org>
Subject: Re: [netsa-tools-discuss] results with rwfilter
Hi Kirk
Can you try this and show us what the result is?
rwfilter --start=2020/04/10 --sensor=ACIDVS --type=in --protocol=0- --site-config-file=/var/silk/data/silk.conf --print-missing
-Timur Snoke
From: Kirk Olson <Kirk_Olson at secura.net<mailto:Kirk_Olson at secura.net>>
Date: Tuesday, April 14, 2020 at 2:16 PM
To: Timur Snoke <tdsnoke at cert.org<mailto:tdsnoke at cert.org>>, Angela Horneman <ahorneman at cert.org<mailto:ahorneman at cert.org>>, "netsa-tools-discuss at cert.org<mailto:netsa-tools-discuss at cert.org>" <netsa-tools-discuss at cert.org<mailto:netsa-tools-discuss at cert.org>>
Subject: RE: [netsa-tools-discuss] results with rwfilter
The ‘in’ and ‘int2int’ directories also contain files for that date and time:
root at ho-nflo-p01:/var/silk/data/ACIDVS
# ls -l
total 0
drwxr-xr-x. 3 root root 18 Apr 10 12:41 in
drwxr-xr-x. 3 root root 18 Apr 9 14:42 int2int
drwxr-xr-x. 3 root root 18 Apr 9 14:42 other
From: Timur David Snoke <tdsnoke at cert.org<mailto:tdsnoke at cert.org>>
Sent: Tuesday, April 14, 2020 12:24 PM
To: Kirk Olson <Kirk_Olson at secura.net<mailto:Kirk_Olson at secura.net>>; Angela Horneman <ahorneman at cert.org<mailto:ahorneman at cert.org>>; netsa-tools-discuss at cert.org<mailto:netsa-tools-discuss at cert.org>
Subject: Re: [netsa-tools-discuss] results with rwfilter
Hi Kirk,
Your selection criteria might be too limiting, in the example that you presented you are looking for any UDP traffic to or from 172.18.18.151 between April 10 at 09:00 and April 12 at 11:00.
Try something that you know will get a result for a shorter time period to get a quicker validation that you have content.
rwfilter --start=2020/04/10T09 --sensor=ACIDVS --type=all --protocol=0- --pass=/tmp/netstat/ACIDVS-2020041009.rw --site-config-file=/var/silk/data/silk.conf
This will query for all traffic seen by the sensor during the hour of April 10 at 09:00 and write it to a file.
You can also look at your data repository for the date/time in question and confirm that you have content.
-Timur Snoke
From: <netsa-tools-discuss-bounces+tdsnoke=cert.org at cert.org<mailto:netsa-tools-discuss-bounces+tdsnoke=cert.org at cert.org>> on behalf of Kirk Olson <Kirk_Olson at secura.net<mailto:Kirk_Olson at secura.net>>
Date: Tuesday, April 14, 2020 at 1:07 PM
To: Angela Horneman <ahorneman at cert.org<mailto:ahorneman at cert.org>>, "netsa-tools-discuss at cert.org<mailto:netsa-tools-discuss at cert.org>" <netsa-tools-discuss at cert.org<mailto:netsa-tools-discuss at cert.org>>
Subject: Re: [netsa-tools-discuss] results with rwfilter
My apologies Angela, this is the command which returns no data:
rwfilter --start=2020/04/10T09 --end=2020/04/12T11 --sensor=ACIDVS --type=all --any-address=172.18.18.151 --protocol=17 --pass=/tmp/netstat/HOCA01udp.rw --site-config-file=/var/silk/data/silk.conf
From: Angela Horneman <ahorneman at cert.org<mailto:ahorneman at cert.org>>
Sent: Tuesday, April 14, 2020 11:52 AM
To: Kirk Olson <Kirk_Olson at secura.net<mailto:Kirk_Olson at secura.net>>; netsa-tools-discuss at cert.org<mailto:netsa-tools-discuss at cert.org>
Subject: Re: [netsa-tools-discuss] results with rwfilter
Hi Kirk,
In the command below you have a start year of 2020 and an end of 2015.
Angela Horneman
Situational Awareness Analysis Team Lead
CMU/SEI/CERT
From: <netsa-tools-discuss-bounces+ahorneman=cert.org at cert.org<mailto:netsa-tools-discuss-bounces+ahorneman=cert.org at cert.org>> on behalf of Kirk Olson <Kirk_Olson at secura.net<mailto:Kirk_Olson at secura.net>>
Date: Tuesday, April 14, 2020 at 12:46 PM
To: "netsa-tools-discuss at cert.org<mailto:netsa-tools-discuss at cert.org>" <netsa-tools-discuss at cert.org<mailto:netsa-tools-discuss at cert.org>>
Subject: [netsa-tools-discuss] results with rwfilter
I have been using the following rwfilter command to pull data from a sensor named ACIDVS:
rwfilter --start=2020/04/10T09 --end=2015/06/17T11 --sensor=ACIDVS --type=all --any-address=172.18.18.151 --protocol=17 --pass=HOCA01udp.rw
rwfilter does build a resultant file with headers in the top row but there is no data from the sensor in the file. Is there something simple I am missing here? I have read the docs and it is not obvious to me where I might be going wrong.
Thank you for your time.
-Kirk
Kirk Olson
Information Security Engineer
Direct: 920-224-7426
Toll Free: 800-558-3405 ext. 7426
[cid:16b8a6c7a1e6d227b41]<https://www.secura.net/>
website | blog | Facebook | Twitter | LinkedIn<https://www.secura.net/>
<https://www.secura.net/>
Recognized among Ward’s Top 50 and rated A Excellent by A.M. Best. <https://www.secura.net/>
Confidentiality Note: This email may contain confidential and/or private information. If you received this email in error, please delete and notify sender.<https://www.secura.net/>
-------------- next part --------------
HTML attachment scrubbed and removed
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 3708 bytes
Desc: image001.jpg
URL: <http://lists.sei.cmu.edu/pipermail/netsa-tools-discuss/attachments/20200414/5f4a9718/attachment.jpg>
More information about the netsa-tools-discuss
mailing list