[Snort-users] using snort to monitor smb/ldap/radius login success/failure

[Fei Liu <feiliu@aepnetworks.com>]

Hi Group, I need to develop a tool to monitor smb/ldap/radius login 
success/failure. My initial approach is through wireshark (tshark) + 
perl parsing. I have limited success using this approach with NTLM/SMB 
login. But it seems to me this kind of connection tracking/sniffing must 
be possible with existing technology. Can snort be used for this 
purpose? Would someone be kind enough to demonstrate how it's possible 
to use snort rules to record login SMB success/failure?

Thanks,

Fei

Here is what I do to track SMB login failure/success with perl parsing 
tshark output:
while(<$tshark>){
                my $line = $_;
                if($line =~ m|^Frame\s+(\d+)|){
#                       print Dumper(\%pkt);
                        $pkt{frame} = $1;
                }
                if ($line =~ m|^Internet Protocol, Src: (.*?), Dst: (.*)$|){
                        $pkt{ip}{src} = $1;
                        $pkt{ip}{dst} = $2;
                }

                if($line =~ m|^Transmission Control Protocol, Src Port: 
(\d+).*?Dst Port: (\d+).*?Seq: (\d+), Ack: (\d+), Len: (\d+)$|){
                        $pkt{ip}{tcp}{sport} = $1;
                        $pkt{ip}{tcp}{dport} = $2;
                        $pkt{ip}{tcp}{seq} = $3;
                        $pkt{ip}{tcp}{ack_seq} = $4;
                        $pkt{ip}{tcp}{len} = $5;

                        next if($5 == 0);
                        foreach (keys %sessions){
                                $user = $_;
                                if($sessions{$user}{token} && 
($sessions{$user}{seq} == $pkt{ip}{tcp}{seq}) ){
                                        print "Found response pkt\n";
                                        $sessions{$user}{resp} = 1;
                                }else{
                                        $sessions{$user}{resp} = 0;
                                }
                        }
                }
                if($line =~ m|^\s+User name: (.*)$|){
                        $user = $1;
                        $sessions{$user}{seq} = $pkt{ip}{tcp}{ack_seq};
                        $sessions{$user}{token} = 1;
                        print "Found request pkt\n";
                }
               if($line =~ m|^\s+NT Status: STATUS_SUCCESS|){
                        foreach (keys %sessions){
                                if($sessions{$_}{resp}){
                                        print "User $_ login through smb 
is successful\n";
                                }
                        }
                }
                if($line =~ m|^\s+NT Status: STATUS_LOGON_FAILURE|){
                        foreach (keys %sessions){
                                if($sessions{$_}{resp}){
                                        print "User $_ login through smb 
failed\n";
                                }
                        }
                }
}

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier.
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users