0snap / visual-pcap-mixer

Visually arrange PCAPs in browser and rewrite IPs / timestamps. Requires config with known groudtruth about attacks / benign traffic

Visual PCAP Mixer

What this is

• A highly experimental thing that I need for myself
• Untested code, potentially dangerous

YOU SHOULD NOT USE THIS UNLESS YOU KNOW WHAT YOU DO

You alone are responsible for using this tool, I do not take any responsibility for any kind of harm that it may cause.

Functions

• A go cli wrapper around existing tools that can analyze and modify pcaps. The tools are directly invoked as cmd. They write stuff on your harddrive. Thats why you should not use this.
• A react frontend for the browser to visualize what will happen with the pcaps.

Config

The backend needs a config.json. This thing differentiates attack samples and benign traffic. Example below.

Btw, nice dataset for attack & benign traffic here: https://www.unb.ca/cic/datasets/ids-2018.html

{
    "groundtruth": [
        {
            "files": [
                "/home/you/pcaps/unbca/attacks/28-02-2018/capEC2AMAZ-O4EL3NG-172.31.69.24-part1",
                "/home/you/pcaps/unbca/attacks/28-02-2018/capEC2AMAZ-O4EL3NG-172.31.69.24-part2"
            ],
            "attacks": [
                {
                    "attackers": [
                        "13.58.225.34"
                    ],
                    "victims": [
                        "172.31.69.24"
                    ],
                    "name": "Infiltration",
                    "start": "2018-02-28T10:50:00-04:00",
                    "end": "2018-02-28T12:05:00-04:00"
                },
                {
                    "attackers": [
                        "13.58.225.34"
                    ],
                    "victims": [
                        "172.31.69.24"
                    ],
                    "name": "Infiltration",
                    "start": "2018-02-28T13:42:00-04:00",
                    "end": "2018-02-28T14:40:00-04:00"
                }
            ]
        }
    ],
    "unclassifiedTraffic": [
        "/home/you/pcaps/unbca/benign/22-02-2018",
        "/home/you/pcaps/unbca/benign/28-02-2018"
    ],
    "outPath": "/home/you/pcap/apt-scenarios"
}

When you really really want to use this

Install dependencies:

$ go get github.com/spf13/cobra

Install packages for your linux distro. The go wrapper calls them.

• wireshark (needed: capinfos)
• tcpdump. in case you are on debian/ubuntu make sure that it can be used by your user. if you have app-armor in place and it blocks you, here is a guide https://gcplinux.com/tcpdump-permission-denied-running-as-root/
• tcpreplay (needed tcprewrite)

Init app

• add the backend folder to your go path
• build your own config.json file like above
• check the help menu go run main.go

You must first run a deep analysis over the configured files. Export the analysis results to a state file:

$ go run main.go export -e your_state.json

Grab a coffee in case you have several hundred gigs of traffic (as I do) ...

Now take the analysed files and host a server

$ go run main.go server -s your_state.json

Navigate to the frontend folder and fire it up. you need a moderately new version of npm / yarn:

$ npm install
$ npm start

Go to your browser, localhost:3000. When you did the config right the browser content looks somewhat like this:

In browser use

• create new days of an attack scenario by hitting the big +
• move all the stuff per drag n drop (attacks, traffic samples, days in the timeline)
• drag benign and attack traffic to your liking
• hover stuff for more info
• double click stuff to delete it
• you can rewrite IP addresses with the form in the bottom left corner
• name the scenario you created (form in lower right corner)

When you create an attack scenario the following will happen on your computer:

• first timestamp is taken from first traffic sample in day 1
• all other pcaps get time-adjusted, that they apprear to have been recorded in order
• IP replacements are applied
• stuff is copied to a new folder in the outPath that is configured in the config.json

Depending on your traffic samples that may fill your harddrive. again, be careful where you run this. better dont. NEVER HOST THIS ON A PUBLIC SERVER. it gives away cmd.

TODO:

• test this shit
• clean up, take out garbage
• I remember vaguely that I built in a silly assumption about filenames in the benign traffic folders. sigh. remove that.

visual-pcap-mixer's Issues

[idea] backend: Tie replacements somehow to the day

Currently it is near impossible to use a single pcaps multiple times in a single MSA, as the replacements are carried out globally for all files. This means that multiple instances of the same pcap cannot be overriden with different IP addresses per day.

We could chance the API to tie replacements to days (possibly with a default that resembles the current state). This could also make the replacements more efficient as the list of replacements probably shrinks for each day which might impact tcprewrite's performance positively.

backend: Make processing of pcaps async

Currently all pcap editing is done in a serial fashion. We could fork out the single steps via goroutines and use a barrier (via channel I would assume) to wait for all time editing to be finished before starting the IP replacement step.

backend: Don't invoke editcap when t = 0.0

Just leaving this here for later reference..

Currently the backend calls editcap unconditionally even if the adjustment parameter t is zero.
This step could be removed to improve speed.

backend: Allow multiple pcaps with same name per day

Currently the backend cannot handle multiple input files with the same name per day in the MSA (independent whether it's a trace or an attack). Solution would be to check for existance in the target folder of the day and append a suffix if necessary.