From netramet-owner Tue Dec 12 02:42:42 1995
Received: (from majordom@localhost) by mailhost.auckland.ac.nz (8.7.1/8.7.1-ua) id CAA19394 for netramet-outgoing; Tue, 12 Dec 1995 02:36:58 +1300 (NZDT)
Received: from crc.u-strasbg.fr (crc.u-strasbg.fr [130.79.200.20]) by mailhost.auckland.ac.nz (8.7.1/8.7.1-ua) with SMTP id CAA19388 for <
[email protected]>; Tue, 12 Dec 1995 02:36:37 +1300 (NZDT)
Received: (from wagner@localhost) by crc.u-strasbg.fr (8.6.11/8.6.9) id NAA24793 for
[email protected]; Mon, 11 Dec 1995 13:59:22 +0100
Date: Mon, 11 Dec 1995 13:59:22 +0100
From: Denis Wagner - Centre Reseau Communication - Universite Louis Pasteur <
[email protected]>
Message-Id: <
[email protected]>
To:
[email protected]
Subject: rules files
X-Sun-Charset: US-ASCII
Sender:
[email protected]
Precedence: bulk
Hello,
I tried to build a rule file to know WWW trafic on a subnet.
I designed the rule like this :
---------------------------------------------------------------------
#
SET 5
#
RULES
#
# I select IP trafic at first
#
SourcePeerType & 255 = IP: PushtoAct, IP_pkt;
#
IP_pkt:
#
# I take this following lines from an example
#
SourcePeerAddress & 255.255.255.0 = 0.0.0.0: PushPkttoAct, Next;
DestPeerAddress & 255.255.255.0 = 0.0.0.0: PushPktto, Next;
#
SourceTransType & 255 = tcp: Pushto, tcp_udp;
SourceTransType & 255 = udp: Pushto, tcp_udp;
#
tcp_udp:
s_www:
SourceTransAddress & 255.255 = www: PushtoAct, c_trans_source;
#
#
DestTransAddress & 255.255 = www: GotoAct, s_www;
#
c_trans_source:
SourceTransType & 255 = 0: CountPkt, 0;
#
#
FORMAT
SourceTransAddress" "DestTransAddress" "FromPDUs" "ToPDUs
" "SourcePeerType" "SourceTransType" "SourcePeerAddress" "DestPeerAddress;
#
# end of file
-----------------------------------------------------------------------------
-----------------------------------------------------------------------------
the result is :
-----------------------------------------------------------------------------
##NeTraMet v3.3: -c60 -r rules.dw2 netmgr le0 2600 flows starting at 13:27:15 Mon 11 Dec 95
#Format: sourcetransaddress desttransaddress frompdus topdus sourcepeertype sourcetranstype sourcepeeraddress destpeeraddress
#Time: 13:27:15 Mon 11 Dec 95 netmgr Flows from 1 to 1300
0 0 0 635 7 0 0.0.0 0.0.0
0 0 0 1393 2 0 0.0.0.0 0.0.0.0
0 0 0 106 12 0 00-00 00-00
0 0 0 55 6 0 0.0.0.0 0.0.0.0
0 0 0 5 5 0 0.0.0 0.0.0
#Time: 13:28:00 Mon 11 Dec 95 netmgr Flows from 1299 to 5800
80 0 11 12 2 6 130.79.54.0 130.79.200.0
80 0 0 58 0 6 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
80 0 37 41 2 6 130.79.17.0 130.79.200.0
#Time: 13:29:00 Mon 11 Dec 95 netmgr Flows from 5799 to 11800
80 0 15 18 2 6 130.79.54.0 130.79.200.0
80 0 0 80 0 6 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
80 0 18 25 2 6 130.79.16.0 130.79.200.0
#Time: 13:30:00 Mon 11 Dec 95 netmgr Flows from 11799 to 17800
80 0 0 138 0 6 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
80 0 20 23 2 6 130.79.36.0 130.79.200.0
80 0 45 49 2 6 130.79.144.0 130.79.200.0
#Time: 13:31:00 Mon 11 Dec 95 netmgr Flows from 17799 to 23800
80 0 0 166 0 6 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
80 0 21 20 2 6 130.79.112.0 130.79.200.0
#Time: 13:32:00 Mon 11 Dec 95 netmgr Flows from 23799 to 29800
80 0 0 248 0 6 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
80 0 107 113 2 6 130.79.112.0 130.79.200.0
80 0 4 6 2 6 130.79.35.0 130.79.200.0
#Time: 13:33:00 Mon 11 Dec 95 netmgr Flows from 29799 to 35800
80 0 0 390 0 6 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
----------------------------------------------------------------------------
In the result file I have not only SourceTransAddress = 80 but in the same time Adresse 0 : why?
Iwoult hope to know the adresse of the host 130.79.200.12 but I have the adresse of the sub-net 130.79.200.00.
In the same time I have a CLNS addresse I test IP trafic.
I don't know where I fail, can anyone help me?.
Thanks Denis.
From netramet-owner Sat Dec 16 03:59:01 1995
Received: (from majordom@localhost) by mailhost.auckland.ac.nz (8.7.1/8.7.1-ua) id DAA11004 for netramet-outgoing; Sat, 16 Dec 1995 03:51:25 +1300 (NZDT)
Received: from crc.u-strasbg.fr (crc.u-strasbg.fr [130.79.200.20]) by mailhost.auckland.ac.nz (8.7.1/8.7.1-ua) with SMTP id DAA10999 for <
[email protected]>; Sat, 16 Dec 1995 03:51:18 +1300 (NZDT)
Received: (from wagner@localhost) by crc.u-strasbg.fr (8.6.11/8.6.9) id PAA12887 for
[email protected]; Fri, 15 Dec 1995 15:45:08 +0100
Date: Fri, 15 Dec 1995 15:45:08 +0100
From: Denis Wagner - Centre Reseau Communication - Universite Louis Pasteur <
[email protected]>
Message-Id: <
[email protected]>
To:
[email protected]
Subject: NeTraMet
X-Sun-Charset: US-ASCII
Sender:
[email protected]
Precedence: bulk
Hello,
I use NeTraMet with the rule file :
#
SET 7
#
RULES
SourcePeerType & 255 = IP: PushtoAct, IP_pkt;
Null & 0 = 0: Ignore, 0;
#
IP_pkt: # Tally IP traffic by (Class C) subnet
SourcePeerAddress & 255.255.255.255 = 0: PushPktToAct, Next;
DestPeerAddress & 255.255.255.255 = 0: PushPktto, Next;
#
SourceTransType & 255 = tcp: Pushto, s_tcp;
Null & 0 = 0: Ignore, 0;
#
#
s_tcp:
#s_www:
# SourceTransAddress & 255.255 = www: PushtoAct, c_trans_source;
s_ftpdata:
SourceTransAddress & 255.255 = ftpdata: PushtoAct, c_trans_source;
#s_smtp:
# SourceTransAddress & 255.255 = smtp: PushtoAct, c_trans_source;
s_ftp:
SourceTransAddress & 255.255 = ftp: PushtoAct, c_trans_source;
#
#
#DestTransAddress &255.255 =www: GotoAct, s_www;
DestTransAddress &255.255 =ftpdata: GotoAct, s_ftpdata;
#DestTransAddress &255.255 =smtp: GotoAct, s_smtp;
DestTransAddress &255.255 =ftp: GotoAct, s_ftp;
#
#
c_trans_source:
SourceTransType & 255 = 0: CountPkt, 0;
#
-------------------------------------------------------------------------------
The File result is :
##NeTraMet v3.3: -c15 -r rules.dw8 netmgr le0 2600 flows starting at 15:27:25 Fri 15 Dec 95
#Format: flowruleset flowindex firsttime lasttime sourcepeertype sourcepeeraddress destpeeraddress sourcetranstype sourcetransaddress desttransaddress topdus frompdus tooctets fromoctets topdurate frompdurate tooctetrate fromoctetrate
#Time: 15:27:25 Fri 15 Dec 95 netmgr Flows from 1 to 2500
#Time: 15:27:30 Fri 15 Dec 95 netmgr Flows from 2499 to 3000
#Time: 15:27:45 Fri 15 Dec 95 netmgr Flows from 2999 to 4500
#Time: 15:28:00 Fri 15 Dec 95 netmgr Flows from 4499 to 6000
#Time: 15:28:15 Fri 15 Dec 95 netmgr Flows from 5999 to 7500
#Time: 15:28:30 Fri 15 Dec 95 netmgr Flows from 7499 to 9000
7 8 8400 8600 2 130.79.200.12 130.79.200.20 6 20 0 1044 443 1459678 26580 1044 443 1459678 26580
#Time: 15:28:45 Fri 15 Dec 95 netmgr Flows from 8999 to 10500
#Time: 15:29:00 Fri 15 Dec 95 netmgr Flows from 10499 to 12000
#Time: 15:29:15 Fri 15 Dec 95 netmgr Flows from 11999 to 13500
#Time: 15:29:30 Fri 15 Dec 95 netmgr Flows from 13499 to 15000
7 8 8400 13900 2 130.79.200.12 130.79.200.20 6 20 0 2088 886 2919356 53160 1044 443 1459678 26580
#Time: 15:29:45 Fri 15 Dec 95 netmgr Flows from 14999 to 16500
#Time: 15:30:00 Fri 15 Dec 95 netmgr Flows from 16499 to 18000
#Time: 15:30:15 Fri 15 Dec 95 netmgr Flows from 17999 to 19500
-------------------------------------------------------------------------------
So I create a filter file like this :
FORMAT:
FlowRuleSet FlowIndex FirstTime LastTime SourcePeerType SourcePeerAddress DestPeerAddress SourceTransType SourceTransAddress DestTransAddress ToPDUs FromPDUs ToOctets FromOctets ToPduRate FromPduRate ToOctetRate FromOctetRate;
Tag 1:
SourceTransAddress = ftpdata;
The result is :
##NeTraMet v3.3: -c15 -r rules.dw8 netmgr le0 2600 flows starting at 15:27:25 Fri 15 Dec 95
#Format: flowruleset flowindex firsttime lasttime sourcepeertype sourcepeeraddress destpeeraddress sourcetranstype sourcetransaddress desttransaddress topdus frompdus tooctets fromoctets topdurate frompdurate tooctetrate fromoctetrate
#Time: 15:27:25 Fri 15 Dec 95 netmgr Flows from 1 to 2500
#Time: 15:27:30 Fri 15 Dec 95 netmgr Flows from 2499 to 3000
#Time: 15:27:45 Fri 15 Dec 95 netmgr Flows from 2999 to 4500
#Time: 15:28:00 Fri 15 Dec 95 netmgr Flows from 4499 to 6000
#Time: 15:28:15 Fri 15 Dec 95 netmgr Flows from 5999 to 7500
#Time: 15:28:30 Fri 15 Dec 95 netmgr Flows from 7499 to 9000
7 8 8400 8600 2 130.79.200.12 130.79.200.20 6 20 0 1044 443 1459678 26580 1044 443 1459678 26580
#Time: 15:28:45 Fri 15 Dec 95 netmgr Flows from 8999 to 10500
#Time: 15:29:00 Fri 15 Dec 95 netmgr Flows from 10499 to 12000
#Time: 15:29:15 Fri 15 Dec 95 netmgr Flows from 11999 to 13500
#Time: 15:29:30 Fri 15 Dec 95 netmgr Flows from 13499 to 15000
7 8 8400 13900 2 130.79.200.12 130.79.200.20 6 20 0 2088 886 2919356 53160 1044 443 1459678 26580
#Time: 15:29:45 Fri 15 Dec 95 netmgr Flows from 14999 to 16500
#Time: 15:30:00 Fri 15 Dec 95 netmgr Flows from 16499 to 18000
#Time: 15:30:15 Fri 15 Dec 95 netmgr Flows from 17999 to 19500
--------------------------------------------------------------------------------
I create an extract file for ftp_data :
time: elapsed seconds;
column: 2 ToOctetRate Tag 1;
The result is :
5 0
20 0
35 0
50 0
65 0
80 0
95 0
110 0
125 0
140 0
155 0
-------------------------------------------------------------------------------
I don't understand how the time is calculated and why the result in column 2 is 0. I'd hope to have only to times corresponding to the 2 lines where there are ftpdata and the result 1459678 each time for ToOctetRate.
Can someone explain to me where I fail and why there are not 2 times?.
Thanks,
Denis
From netramet-owner Tue Dec 19 03:32:41 1995
Received: (from majordom@localhost) by mailhost.auckland.ac.nz (8.7.1/8.7.1-ua) id DAA24745 for netramet-outgoing; Tue, 19 Dec 1995 03:28:10 +1300 (NZDT)
Received: from iconz.co.nz (iconz.co.nz [202.14.100.2]) by mailhost.auckland.ac.nz (8.7.1/8.7.1-ua) with SMTP id DAA24740 for <
[email protected]>; Tue, 19 Dec 1995 03:28:08 +1300 (NZDT)
Received: (rowan@localhost) by iconz.co.nz (8.6.12/8.6.10) id DAA18599; Tue, 19 Dec 1995 03:28:05 +1300
Date: Tue, 19 Dec 1995 03:28:04 +1300 (NZDT)
From: Rowan Smith <
[email protected]>
To:
[email protected]
Subject: Mangled packet.
Message-ID: <
[email protected]>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender:
[email protected]
Precedence: bulk
What does this error mean, when presented by the Manager?
Netramet was running quite happily on my SS20, until I launched a SATAN
scan on it, then NeMaC printed "Mangled Packet" 11 times down the screen,
and the Meter switched to the default rule set.
I assume that the default rule set is the emergency set when one isn't
specified?
I was runing the rules.ipport rulefile provided with the netramet
distribution.
Thanks in advance
-Rowan