########################################################################################## PAS-9: Unique list of IP/Ports ########################################################################################## Issue Type: New Feature ----------------------------------------------------------------------------------------- Issue Information ==================== Priority: Major Status: Open Resolution: Unresolved Project: PCAP Analysis Script (PAS) Reported By: btasker Assigned To: btasker Components: - Data Correlation and Extraction Affected Versions: - 0.1 Targeted for fix in version: - 0.1 Time Estimate: 22 minutes Time Logged: 23 minutes ----------------------------------------------------------------------------------------- Issue Description ================== It'd be good to generate a list of which IP's have been seen connecting to which ports. Given there might be client connections coming into a monitored system, need to know which end is the destination so that we don't clog up the file with client ports. So it'll have to be based on the initial SYN so that we know exactly who is initiating the connection and what the service port is. ----------------------------------------------------------------------------------------- Issue Relations ================ - blocks PAS-11: Call TShark only if a relevant port has been observed ----------------------------------------------------------------------------------------- Activity ========== ----------------------------------------------------------------------------------------- 2015-11-25 15:25:03 btasker ----------------------------------------------------------------------------------------- The changes made in PAS-10 need to be kept in mind. Where observed traffic is IPv4 encapsulated IPv6 we want the list to show the real (i.e. the IPv6) destination and not the tunnel endpoint. The simplest way to be sure is probably going to be to extract a full list and then have three runs through the data - Native IPv4 - Native IPv6 - Tunnelled IPv6 We still want to record that the tunnel endpoint was connected to though, so may need to come up with some sort of indicator to mark it as such. ----------------------------------------------------------------------------------------- 2015-11-25 16:14:52 btasker ----------------------------------------------------------------------------------------- Data will be output into a new report _dest-ip-ports.csv_ which has the following field structure -- BEGIN SNIPPET -- Dest IP, Dest Port, Tunnelled -- END SNIPPET -- - For both native IPv4 and IPv6, _Tunnelled_ will be _N_ - For IPv4 encapsulated IPv6, _Tunnelled_ will be _Y_ - For IPv4 addresses identified as a tunnel endpoint, port will be empty and _Tunnelled_ will be _T_ ----------------------------------------------------------------------------------------- 2015-11-25 16:52:16 ----------------------------------------------------------------------------------------- btasker changed timespent from '0 minutes' to '20 minutes' ----------------------------------------------------------------------------------------- 2015-11-25 16:53:41 git ----------------------------------------------------------------------------------------- -- BEGIN QUOTE -- Repo: PCAPAnalyseandReport Commit: c53b027773a2bcb820df7afb7545257f154e802b Author: Ben Tasker