Moduleconfiguration

Vermont Module Configuration

CryptoPanPrefix

This module is a submodule for the RecordAnonymizer mentioned above. It implements a modified version of the CryptoPan anonymization method. The following only applies if the IP address passing through the module matches a subnet configured in the configuration file - elsewise the address is skipped: The IP address is split into a network and host identifier according to the specified CIDR, i.e. the CIDR represents the number of bits belonging to the network part. After this splitting is done, only the host part of the IP address is anonymized with the basic CryptoPan algorithm. In a second step, the network part is replaced with the preconfigured subnet given in the configuration file in the to field. As seen below, multiple mappings are possible.

Input type: IpfixRecord
Output type: IpfixRecord

Example configuration

<anonRecord id="3">
    <anonField>
        <anonMethod>CryptoPanPrefix</anonMethod>
        <anonIE>
            <ieName>destinationIPv4Address</ieName>
        </anonIE>
       <anonParam>12345678901234567890123456789013</anonParam>
       <mappingList>
           <subnet cidr="24">
                <from>192.44.88.0</from>
                <to>222.222.222.0</to>
           </subnet>
           <subnet cidr="16">
                <from>119.152.0.0</from>
                <to>111.111.0.0</to>
           </subnet>
       </mappingList>
    </anonField>
    <copyMode>false</copyMode>
    <next>5</next>
</anonRecord>

Parameters:

Element name	Default value	Description
subnet	none	The element subnet must include the attribute cidr
from	none	Subnet to be anonymized
to	none	Assigned Subnet ID

FpaPcapExporter

Expects IPFIX data records with FPA (Front Payload Aggregation, field IPFIX_ETYPE_frontPayload) or DPA (Dialog-based Payload Aggregation) data elements. This module then creates one/two packet per flow (unidirectional/bidirectional flow) and writes the packets into a PCAP file.

Input type: IpfixRecord
Output type: none

Example configuration: pcap.dump 2048

Parameters:

Element name	Default value	Description
filename	none	Filename of PCAP file that is to be created.
snaplen	PCAP_MAX_CAPTURE_LENGTH	Maximum packet size in PCAP file. Default value is specified at compile time.

FpaPacketGenerator

Expects IPFIX data records with FPA (Front Payload Aggregation, field IPFIX_ETYPE_frontPayload) or DPA (Dialog-based Payload Aggregation) data elements. This module then creates one/two packet per flow (unidirectional/bidirectional flow) and forwards raw packets to the next module.

Input type: IpfixRecord
Output type: Packet

Example configuration: 6

Parameters: There are no parameters available!

FrontPayloadSigMatcher

Matches flow records containing a front payload field (IPFIX_ETYPE_frontPayload) to signature files in the specified directory. Each signature file includes the tokens (or signature substrings) the payload is searched for. Each token is associated with a support value. The support values of all matching tokens are summed up and the result is compared against a threshold. The module reports a matching signature if the sum of the support values is equal or larger than the threshold.

Input type: IpfixRecord
Output type: none

Example configuration:

<frontPayloadSigMatcher id="9">
    <signaturedir>./signatures</signaturedir>
</frontPayloadSigMatcher>

Parameters:

Element name	Default value	Description
signaturedir	none	Directory that contains signature rule files.

Example signature file matching FTP traffic

SIGNATUREID
FTP
TOKEN
FTP
SUPPORT
0.50000
TOKEN
220
SUPPORT
0.50000
THRESHOLD
1.0

Signature file keywords:

Keyword	The line(s) following this keyword are interpreted as...
SIGNATUREID	string which identifies the signature. If omitted, the name of the signature file is used as identifier.
TOKEN	signature substring to be matched. The substring may span multiple lines. Lines must not start with any keyword.
SUPPORT	decimal support value of the preceding token.
THRESHOLD	decimal threshold value of the signature.

HostStatistics

Receives flow records and counts all bytes that were transferred by all hosts in the specified subnet. On reconfiguration, the byte sums and corresponding IP addresses are written to the file specified in element 'logPath'. Attention: This code is alpha status and may be quite slow.

Input type: IpfixRecord
Output type: none

Example configuration:

<hostStatistics id="9">
    <subnet>192.168.0.0/16</subnet>
    <addrFilter>src</addrFilter>
    <logPath>hoststats.log</logPath>
    <logInterval>10</logInterval>
</frontPayloadSigMatcher>

Parameters:

Element name	Default value	Description
subnet	none	IP subnet with all hosts that need to be analyzed. IP 4-tuple notation with subnet mask specified in bits.
addrFilter	none	Specifies which IP address fields are used for the IP filter (specified in element 'subnet'). 'src' for the source IP, 'dst' for the destination IP, 'both' for both IP addresses.
logPath	none	File, where statistics are saved.
logInterval	10	Interval in seconds, when statistics are exported. ATTENTION: currently not in use.

IdmefExporter

Exports incoming IDMEF messages to the external perl script idmefsender.pl which sends it over the network to a specified URL.

Input type: IdmefMessage
Output type: none

Example configuration:

<idmefExporter id="9">
    <sendurl>http://localhost</sendurl>
    <destdir>idmef_work</destdir>
</idmefExporter>

Parameters:

Element name	Default value	Description
sendurl	none	Destination URL where IDMEF messages must sent to.
destdir	idmef_work	Directory, where IDMEF messages are temporary stored. There they are picked up by the external perl script ''idmefsender.pl'' in directory ''/tools''.

== IpfixAggregator ==

Aggregates incoming IPFIX flows according to specified parameters. Configuration is similar to module PacketAggregator.

Input type: IpfixRecord Output type: IpfixRecord

Example configuration: 998 1 sourceIPv4Address destinationIPv4Address protocolIdentifier sourceTransportPort destinationTransportPort flowStartMilliSeconds flowEndMilliSeconds octetDeltaCount packetDeltaCount tcpControlBits revflowStartMilliSeconds revflowEndMilliSeconds revoctetDeltaCount revpacketDeltaCount revtcpControlBits 1 1 1000 4 Parameters: | Element name | Default value | Description | |rule | none |Specifies a rule according to which is aggregated. More than one rule may be specified per aggregator. | |biflowAggregation | 0 |Specifies if biflow aggregation is to be performed (0=no biflow, 1=biflow). Only valid in IpfixAggregator. To accomodate biflow information elements, Vermont-specific enterprise type ids were specified: revFlowStartMilliSeconds, revFlowEndMilliSeconds, revFlowStartSeconds, revFlowEndSeconds, revOctetDeltaCount, revPacketDeltaCount and revTcpControlBits. | |templateId | none |Template ID (optional). | |flowKey | |Flow key information element - flows are aggregated according to those keys. | |nonFlowKey | none |Non-flow key information element - those IEs are aggregated. | |ieName | none |name of the IE. | |modifier | none |Optional field modifier for flow key IEs ("discard", "mask/X"). | |match | 0 |Optional flow key filter for protocol identifier ("TCP", "UDP", "ICMP", or IANA number), IP addresses ("A.B.C.D/M"), port numbers (separated by ",", port range "A:B"), TCP control bits ("FIN", "SYN", "RST", "PSH", "ACK", "URG", separated by ","). | |inactiveTimeout | 0 |Expiration timeout for idle/inactive flows. | |activeTimeout | 0 |Periodic expiration timeout for long-lasting flows (typically larger than inactiveTimeout). | |pollInterval | 10s |Length of interval when flows should be exported to next module. | |hashtableBits | 17 |Length of hashtable used for aggregation in bits. The resulting hashtable will have a size of ''2^hashtableBits''. |

== IpfixCollector ==

Receives IPFIX records from the network and imports them into Vermont.

Input type: none Output type: IpfixRecord

Example configuration: configs/example_certs/collector_cert.pem configs/example_certs/collector_key.pem configs/example_certs/vermontCA.pem /etc/ssl/certs

<listener>
	<ipAddress>0.0.0.0</ipAddress>
	<transportProtocol>DTLS_OVER_UDP</transportProtocol>
	<port>4740</port>
	<peerFqdn>exporter.example.com</peerFqdn>
</listener>
<udpTemplateLifetime>300</udpTemplateLifetime>

== IpfixCsExporter ==

Writes IPFIX data records to a local disk using the CarmentiS file format. The module recieves Ipfix packets, caches them and writes them as a chunk to disk.

Input type: IpfixRecord Output type: none

== IpfixExporter ==

Exports internal IPFIX records to the network. The transport protocols UDP and SCTP including their secure counterparts i.e. DTLS over UDP and DTLS over SCTP are supported. The OpenSSL library is required for DTLS. At the time of writing, DTLS over SCTP is only available on the FreeBSD platform. To make DTLS over SCTP work, you have to apply the patches from http://sctp.fh-muenster.de/ to OpenSSL.

Input type: IpfixRecord Output type: none

Example configuration: 10 5000 10000 30 configs/example_certs/exporter_cert.pem configs/example_certs/exporter_key.pem configs/example_certs/vermontCA.pem /etc/ssl/certs 10

<collector>
    <ipAddressType>4</ipAddressType>
    <ipAddress>127.0.0.1</ipAddress>
    <port>1500</port>
    <transportProtocol>DTLS_OVER_UDP</transportProtocol>
    <peerFqdn>collector.example.com</peerFqdn>
    <mtu>1492</mtu>
</collector>

Parameters: ^ Element name ^ Default value ^ Description ^ |observationDomainId | 0 |Observation Domain ID of the exporter. | |templateRefreshInteval | 20s |Interval for periodic sending of templates. Applies only to UDP. | |ipAddressType | 4 |Currently, only IPv4 is supported. | |ipAddress | none |The collector's IP address in Dot-decimal notation. Host names i.e. FQDNs are not accepted.| |transportProtocol | none |SCTP, UDP, DTLS_OVER_SCTP or DTLS_OVER_UDP | |port | 4739 for insecure, 4740 for secure connections i.e. DTLS | Port number of the collector. | |maxRecordRate | 5000 |Maximum number of flow records per second sent to collector. | ^UDP specific^^^ |mtu | 0 (PMTU discovery) |The Path Maximum Transmission Unit (PMTU) that should be assumed when creating IPFIX Messages. If set to 0, PMTU discovery will be used to determine a PMTU estimate. This works currently only on Linux. In case the platform does not provide comprehensive PMTU discovery support (e.g., FreeBSD), a conservative default value (1400) is used, which might lead to suboptimal performance. You should, therefore, manually set the PMTU if you are using a platform other than Linux. | ^SCTP specific^^^ |sctpDataLifetime | 10000ms |Lifetime of SCTP messages carrying Data Records. SCTP's partial reliablity (i.e. PR-SCTP) policy "timed reliability" as defined in [RFC3758] is always turned on. | |sctpReconnectInterval | 30s |Time that the Exporter waits before reestablishing a lost connection. | ^DTLS specific^^^ |cert| (none) |File containing the certificate chain used for authentication. Quote from http://www.openssl.org/docs/ssl/SSL_CTX_use_certificate.html: "The certificates must be in PEM format and must be sorted starting with the subject's certificate (actual client or server certificate), followed by intermediate CA certificates if applicable, and ending at the highest level (root) CA."| |key| (none) |File containing the private key in PEM format corresponding to the certificate. If left empty, the file specified by the ''cert'' option will be searched for the private key. This allows for the private key to be stored in the same file as the certificate.| |CAfile| (none) |A file containing one or more certificates of trusted CAs. This file has to be in PEM format.| |CApath| (none) |A directory containing certificates of trusted CAs in PEM format. Quote from http://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html: "The files each contain one CA certificate. The files are looked up by the CA subject name hash value, which must hence be available."| |peerFqdn| (none) |The expected Fully Qualified Domain Name (FQDN) of the Collector. If set, the Collector //must// present a certificate of which either the subject's Common Name (CN) or one of the subject alternative names matches this FQDN. There is no support for wildcard matching. For the certificate verification to work, ''CAfile'' or ''CApath'' or both must be set in order to specify the locations of the root CA certificates. If ''peerFqdn'' is not set, anonymous cipher suites will be added to the list of permissible cipher suites. The identity of the peer will not be verified then. Note, that //no// DNS queries will be performed. Technically, the FQDN specified by ''peerFqdn'' does not need to resolve to an IP address.| |dtlsMaxConnectionLifetime| 1 hour |Lifetime of a DTLS over UDP connection. A new DTLS connection is initiated as soon as the lifetime is up. The old connection is replaced by the new one when the handshake is completed. This mechanism aims to overcome the dead peer problem.|

== IpfixDbReader ==

Imports IPFIX flows from a MYSQL database table.

Input type: none Output type: IpfixRecord

== IpfixDbWriter ==

Exports IPFIX flows to a database table in a MySQL database.

Input type: IpfixRecord Output type: none

== IpfixDbWriterPg ==

Exports IPFIX flows to a database table in a PostgreSQL database.

Input type: IpfixRecord Output type: none

== IpfixFileWriter ==

Dumps ipfix messages into data files.

Input type: IpfixRecord Output type: none

Example configuration: 99 64 /home/test my_dump

== IpfixNetflowExporter ==

Exports flows as Netflow.v5 records, filling non-existent fields with 0. Attention: do not send Biflows to this module, as Netflow.v5 only supports undirectional flows. The reverse direction will be ignored!

Input type: IpfixRecord Output type: none

Example configuration: localhost 9995 500

== IpfixReceiverFile ==

Reads ipfix message from data files generated with IpfixFileWriter.

Input type: none Output type: IpfixRecord

Example configuration: /home/test/ my_dump false 2.0 0 5 5

== IpfixPayloadWriter ==

Writes IPFIX records including front payload into files. Only the first N (to be set in parameters) flows in chronological order are regarded. It is expected, that incoming flows are biflows and include front payload. For each biflow, three files are generated: .info contains header information of the flow, two .payload files contain front payload in both directions.

Input type: IpfixRecord Output type: none

== IpfixPrinter ==

Prints incoming Ipfix flows to stdout for debugging purposes.

Input type: IpfixRecord Output type: none

Example configuration: tree output.log Parameters: | Element name | Default value | Description | |outputType | tree |Determines the output format of IpfixPrinter. 'tree' constructs a tree of each incoming DataRecord with all values, 'table' constructs a table-like output format, 'line' produces one line of output per DataRecord, and 'none' does not output anything. | |filename | none |Sets the name of the output file. If nothing is specified (which is the default), data is printed on STDOUT. |

== IpfixQueue ==

Caches IPFIX records in a queue until next module is ready to process them.

Input type: IpfixRecord Output type: IpfixRecord

== IpfixSampler ==

Samples IPFIX records using a simple sampler based on modulo.

Input type: IpfixRecord Output type: IpfixRecord

Example configuration: 0.1 6 Parameters: | Element name | Default value | Description | | flowRate | 1 | Ratio of flows that should pass sampler. When set to 0.1, 10% of all flows pass the module. Attention: internally, after calculating the inverse, this value is converted to an integer for the modulo operation. So values close to 1 may not be reflected properly by the sampler. Values above 1 are not allowed. |

== Observer ==

Captures raw packets using the PCAP interface.

Input type: none Output type: Packet

Example configuration: eth1 <pcap_filter>ip</pcap_filter> 2 Parameters: | Element name | Default value | Description | | interface | none |Interface PCAP listens to. Do not use in combination with parameter filename. | | captureLength | 128 |Sets the capture length of each packet. Packets bigger than that size are truncated. ATTENTION: if payload is analyzed in later modules, this parameter needs to be large enough! | | filename | none |Must be specified if Vermont needs to read from file and contains its filename. Do not use in combination with parameter interface. | | pcap_filter | none |Filter specification which is passed to PCAP (usually `ip' to only capture IP packets). | | replaceTimestamps | false |If true, PCAP packet timestamps are replaced with current time. This parameter only applies to PCAP file reading. | | offlineSpeed | 1.0 |Only applies to PCAP file reading. Sets the speed multiplier for offline PCAP file reading. A negative value means read as fast as you can. | | offlineAutoExit | true |Only applies to PCAP file reading. Sets if Vermont should be shut down automatically after reading all PCAP file data. | | maxPackets | 0 | Specifies a maximum number of packets to be processed by the Observer. After this number is reached, the Observer stops reading packets and may trigger the shutdown, if parameter 'offlineAutoExit' was specified. If this parameter is set to 0, the Observer may read an infinite amount of packets. |

== P2PDetector ==

Detects Peer-to-Peer Clients in a subnet. Attention: IPFIX flows must be aggregated to biflows.

Input type: IpfixRecord Output type: IdmefMessage

== PacketFilter ==

Forwards packets which match specified filter configuration and drops non-matching packets.

Input type: Packet Output type: Packet

Example configuration: 4 2 100 50 bla blub 0xFF024F is\s*not src 1.2.3.4 1.2.3.6 3 Parameters: | Element name | Default value | Description | | countBased | none |Creates a count-based filter. Spacing defines the number of packets accepted at the beginning of the period, interval specifies the length of the period | | timeBased | none |Creates a time-based filter. Spacing defines the number of milliseconds during which time all incoming packets are accepted at the beginning of the period, interval specifies the length of the period in milliseconds. | | interval | none |Belongs to either countBased or timeBased filter. Specifies length of period. | | spacing | none |Belongs to either countBased or timeBased filter. Specifies amount of time or number of packets accepted. | | stringBased | none |Creates a string-based filter which scans for specified strings inside the packet payload. If more than one search element is specified, only packets will be forwarded which match all specifications. | | is | none |Accepts packets which contain included ASCII string. If attribute "type" is set to "HEX", the tag's content MUST include a hexstring which specifies the binary data to be searched for. | | isnot | none |Drops packets which contain included ASCII string. If attribute "type" is set to "HEX", the tag's content MUST include a hexstring which specifies the binary data to be searched for. | | regexBased | none |Creates a regex-based filter which scans for specified regexes inside the packet payload. If more than one regex is specified, only packets will be forwarded which match all specifications. | | matchPattern | none |Specifies a regular expression used by the regex-based filter. | | stateConnectionBased | none |Creates a filter which searches for TCP connections and matches all packets that contain the first N payload bytes. It uses a determinstic algorithm that will consume all the memory necessary to store all seen TCP connections. | | connectionBased | none |Same as stateConnectionBased filter, but uses a different algorithm for TCP connection tracking. The algorithm is probabilistic and uses a fixed amount of memory to store the TCP connections. | | timeout | 3 |Belongs to either stateConnectionBased or connectionBased filter. Specifies the time in seconds a seen TCP connection request is valid, before it will time out. | | bytes | 100 |Belongs to either stateConnectionBased or connectionBased filter. Specifies how much Payload should be exported in bytes. | | hashFunctions | 3 |Belongs to connectionBased filter. Specifies the number of hash functions that are used to index the bloom filters. | | filterSize | 1000 |Belongs to connectionBased filter. Specifies the size of the bloom filters that are used by the connection based filter. | | exportControlPackets | true |Controls wether TCP control packets (SYN/FIN/RST) are exported by stateConnectionBased and connectionBased filter. | | anonFilter | none |Specifies a filter that performs anonymization on captured network packets. Contains one or more anonFields. This tag can have several subtags. The subtags are the same ones that can be used in the RecordAnonymizer module | | payloadFilter | none |Payload is dropped, when this filter is specified. | | hostBased | none |Hostbased filter, which filters packets not belonging to any IPs listed in configuration. | | addrFilter | none |Specifies if source IP address ('src'), destination IP address ('dst') or both IP addresses ('both') are used in the filter. | | ip | none |IP address that is accepted by the filter. May appear multiple times. |

== PacketQueue ==

Caches packets in a queue until next module is ready to process them.

Input type: Packet Output type: Packet

== PacketAggregator ==

Aggregates incoming raw packets to flows according to specified parameters.

Input type: Packet Output type: IpfixRecord

Example configuration: 998 sourceIPv4Address destinationIPv4Address protocolIdentifier sourceTransportPort destinationTransportPort flowStartMilliSeconds flowEndMilliSeconds octetDeltaCount packetDeltaCount tcpControlBits 1 1 1000 4 Parameters: | Element name | Default value | Description | |templateId | none |Template ID (optional). | |flowKey | |Flow key information element - flows are aggregated according to those keys. | |nonFlowKey | none |Non-flow key information element - those IEs are aggregated. | |ieName | none |name of the IE. | |modifier | none |Optional field modifier for flow key IEs ("discard", "mask/X"). | |match | 0 |Optional flow key filter for protocol identifier ("TCP", "UDP", "ICMP", or IANA number), IP addresses ("A.B.C.D/M"), port numbers (separated by ",", port range "A:B"), TCP control bits ("FIN", "SYN", "RST", "PSH", "ACK", "URG", separated by ","). | |inactiveTimeout | 0 |Expiration timeout for idle/inactive flows. | |activeTimeout | 0 |Periodic expiration timeout for long-lasting flows (typically larger than inactiveTimeout). | |pollInterval | 10s |Length of interval when flows should be exported to next module. | |hashtableBits | 17 |Length of hashtable used for aggregation in bits. The resulting hashtable will have a size of 2%%^%%{hashtableBits}. |

== PacketIdmefReporter ==

For each incoming packet an IDMEF message is generated. An extract of the packet payload called snapshot may be included in the IDMEF message.

Input type: Packet Output type: IdmefMessage

== PcapExporterFile ==

Exports incoming packets into a file in PCAP format.

Input type: Packet Output type: none

== PcapExporterPipe ==

Writes packets in PCAP format into a pipe, allowing another process to read these packets via STDIN.

Input type: Packet Output type: none

== PsampExporter ==

Exports incoming packets as PSAMP records over the network.

Input type: Packet Output type: none

== RecordAnonymizer ==

This module is capable of anonymizing arbitary fields within IPFIX-Records using different anonymization methods.

Input type: IpfixRecord Output type: IpfixRecord

Example configuration: sourceIPv4Address CryptoPan insert key here destinationIPv4Address 4 CryptoPan insert key here false 6 Parameters: | Element name | Default value | Description | |anonField | none |Specifies one field and an anonymization method for that field. Contains one anonIE, one anonMethod and an optional anonParam tag. | |anonIE | none |Specifies the information element that needs to be anonymized. Belongs to anonField. | |ieName | none |Specifies the name of the field that needs to be anonymized. Belongs to anonIE. | |anonMethod | none |Specifies the anonymization method that is used to anonymize a given header field. Belongs to anonField. Possible values are: BytewiseHashHmacSha1, BytewiseHashSha1, ConstOverwrite, ContinuousChar, HashHmacSha1, HashSha1, Randomize, Shuffle, Whitenoise, CryptoPan | |anonParam | none |Specifies an optional parameter to the anonymization method. Different methods need different params. ByteWiseHashHmacSha1, HashHmacSha1 need an variable sized key. ConstOverwrite needs one character as parameter. CryptoPan needs an 32 bytes long parameter (16 bytes key, 16 bytes pad). For CryptoPan and ConstOverwrite, keys can be specified as normal text, or as hexadecimal string starting with '0x'. | |copyMode | false |If true, the Record Anonymizer creates a copy of the incoming record and leaves the original record unchanged. Copy mode should be turned on if the original records are processed by other moduls as well. |

== SensorManager ==

Module which controls all sensors ("`MessfÃŒhler"') inside Vermont. It does not have any in- or output types and must not be connected to any other module. It is recommended to set its ID to 99 to express its special role. If this module is specified in the configuration, available sensors are activated and polled regularly. It may only be specified once.

Input type: none Output type: none

== TrwPortscanDetector ==

Detects horizontal portscans in incoming IPFIX flows. Attention: IPFIX flows must be aggregated to biflows. To achieve best results, flows should contain the following IEs:

sourceIPv4Address
destinationIPv4Address
sourceTransportPort
destinationTransportPort
protocolIdentifier
flowStartMilliSeconds
flowEndMilliSeconds
revFlowStartMilliSeconds
revFlowEndMilliSeconds
octetDeltaCount
revOctetDeltaCount
packetDeltaCount
revPacketDeltaCount
tcpControlBits
revTcpControlBits

Input type: IpfixRecord Output type: IdmefMessage

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Moduleconfiguration

Vermont Module Configuration

CryptoPanPrefix

FpaPcapExporter

FpaPacketGenerator

FrontPayloadSigMatcher

HostStatistics

IdmefExporter

Clone this wiki locally