{"id":66,"date":"2013-04-11T22:32:18","date_gmt":"2013-04-12T03:32:18","guid":{"rendered":"https:\/\/adamkuj.net\/blog\/?p=66"},"modified":"2021-05-11T09:00:56","modified_gmt":"2021-05-11T14:00:56","slug":"using-abusing-awk-for-rudimentary-dos-detection","status":"publish","type":"post","link":"https:\/\/adamkuj.net\/blog\/2013\/04\/11\/using-abusing-awk-for-rudimentary-dos-detection\/","title":{"rendered":"Using (Abusing?) AWK For Rudimentary DoS Detection"},"content":{"rendered":"

\"sFlow(R)\"<\/a>InMon’s sflowtool<\/a> comes with an sample script, ipTopTalkers<\/a> that uses awk to provide a list of toptalkers based on sflow sampled packets. All I’ve done here is build on their ipTopTalkers sample code to find which addresses are receiving >10,000 pps or >80 Mb\/s, and send that information to a log file and reporting-script (not shown).<\/p>\n

Converting the binary sflow feed to text, then piping it through awk to do basic math and sorting functions, is not exactly the most elegent solution. But hey, it works!<\/p>\n

[shell collapse=”true” title=”DoSTargets”]
\n#!\/usr\/bin\/mawk-cur -f<\/p>\n

# ALK 2013-01-10
\n#
\n# for performance reasons, mawk is preferred to gawk
\n# newer versions of mawk include things like strftime that tradionally had been
\n# gawk-only features. code and builds of mawk-cur (cutting edge) can be found at:
\n# http:\/\/invisible-island.net\/mawk\/
\n# (the features of mawk-cur aren’t available in official debian packages of mawk)
\n#
\n# based on ipTopTalkers from InMon:
\n#
\n# Copyright (c) 2001 InMon Corp. Licensed under the terms of the InMon sFlow licence:
\n# http:\/\/www.inmon.com\/technology\/sflowlicense.txt<\/p>\n

# usage: sflowtool | DoSTargets<\/p>\n

BEGIN{
\nlastInt = 0;
\nreport = “tee -a \/var\/log\/ddos-report.log | dos-report.sh”;
\ninterval = 60; #1 minute window
\nBPSthreshold = 83886080; # alert threshold in bits per second i.e. 80 Mb\/s
\nPPSthreshold = 10000; # alert threshold in packets per second i.e 10kpps
\n}
\n\/unixSecondsUTC\/{
\ncurrentInt = $2 – ($2 % interval);
\nif(currentInt != lastInt) {
\nfor(i = 1; i < = 1000; i++) { # consider up to 1000 simultaneous targets
\nBPSmaxCount = 0;
\nBPSmaxKey = “”;
\nfor(BPSkey in BPScount) {
\nif(BPScount[BPSkey] > BPSmaxCount) {
\nBPSmaxCount = BPScount[BPSkey];
\nBPSmaxKey = BPSkey;
\n}
\n}
\nif(BPSmaxCount > (BPSthreshold * interval)) printf(“%d %s %d %s”, strftime(“%s”, lastInt), BPSmaxKey, sprintf(“%d”,(BPSmaxCount\/1024\/1024\/interval)),”mbps\\n”) | report;
\ndelete BPScount[BPSmaxKey];<\/p>\n

PPSmaxCount = 0;
\nPPSmaxKey = “”;
\nfor(PPSkey in PPScount) {
\nif(PPScount[PPSkey] > PPSmaxCount) {
\nPPSmaxCount = PPScount[PPSkey];
\nPPSmaxKey = PPSkey;
\n}
\n}
\nif(PPSmaxCount > (PPSthreshold * interval)) printf(“%d %s %d %s”, strftime(“%s”, lastInt), PPSmaxKey, sprintf(“%d”,(PPSmaxCount\/interval)),”pps\\n”) | report;
\ndelete PPScount[PPSmaxKey];
\n}
\nfflush(stdout); # write out stdout buffer
\nclose(report); # send the alert email
\nlastInt = currentInt;
\ndelete BPScount;
\ndelete PPScount;
\n}
\n}
\n\/meanSkipCount\/{ samplingInterval = $2; }
\n\/sampledPacketSize\/{ sampledPacketSize = $2; }
\n\/dstIP\/{ BPScount[$2] = BPScount[$2] + ( samplingInterval * sampledPacketSize * 8); PPScount[$2] = PPScount[$2] + samplingInterval; }
\nEND{}
\n[\/shell]<\/p>\n","protected":false},"excerpt":{"rendered":"

InMon’s sflowtool comes with an sample script, ipTopTalkers that uses awk to provide a list of toptalkers based on sflow sampled packets. All I’ve done here is build on their ipTopTalkers sample code to find which addresses are receiving >10,000 pps or >80 Mb\/s, and send that information to a log file and reporting-script (not […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[7,8,9],"class_list":["post-66","post","type-post","status-publish","format-standard","hentry","category-networking-tools","tag-awk","tag-ddos","tag-sflow"],"_links":{"self":[{"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/posts\/66","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/comments?post=66"}],"version-history":[{"count":13,"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/posts\/66\/revisions"}],"predecessor-version":[{"id":320,"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/posts\/66\/revisions\/320"}],"wp:attachment":[{"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/media?parent=66"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/categories?post=66"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/tags?post=66"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}