Zeek-Parser-CIFS-NBNS-COM
English is here
æ¦è¦
Zeek-Parser-CIFS-NBNS-COMã¨ã¯NetBios Protocolãè§£æã§ããZeekãã©ã°ã¤ã³ã§ãã
ã¤ã³ã¹ãã¼ã«
ããã±ã¼ã¸ããã¼ã¸ã£ã¼ã«ããã¤ã³ã¹ãã¼ã«
ãã®ãã©ã°ã¤ã³ã¯Zeek Package Mangerç¨ã®ããã±ã¼ã¸ã¨ãã¦æä¾ããã¦ãã¾ãã
以ä¸ã®ã³ãã³ããå®è¡ãããã¨ã§ãæ¬ãã©ã°ã¤ã³ã¯å©ç¨å¯è½ã«ãªãã¾ãã
zkg refresh
zkg install zeek-parser-CIFS-NBNS-COM
ããã¥ã¢ã«ã¤ã³ã¹ãã¼ã«
æ¬ãã©ã°ã¤ã³ãå©ç¨ããåã«ãZeek, Spicyãã¤ã³ã¹ãã¼ã«ããã¦ãããã¨ã確èªãã¾ãã
# Zeekã®ãã§ãã¯
~$ zeek -version
zeek version 5.0.0
# Spicyã®ãã§ãã¯
~$ spicyz -version
1.3.16
~$ spicyc -version
spicyc v1.5.0 (d0bc6053)
# æ¬ããã¥ã¢ã«ã§ã¯Zeekã®ãã¹ã以ä¸ã§ãããã¨ãåæã¨ãã¦ãã¾ãã
~$ which zeek
/usr/local/zeek/bin/zeek
æ¬ãªãã¸ããªããã¼ã«ã«ç°å¢ã« git clone
ãã¾ãã
~$ git clone https://github.com/nttcom/zeek-parser-CIFS-NBNS-COM.git
ä½¿ãæ¹
ããã±ã¼ã¸ããã¼ã¸ã£ã¼ã«ããã¤ã³ã¹ãã¼ã«ã®å ´å
以ä¸ã®ããã«æ¬ãã©ã°ã¤ã³ã使ããã¨ã§ nbns.log
ãçæããã¾ãã
zeek -Cr /usr/local/zeek/var/lib/zkg/clones/package/zeek-parser-CIFS-NBNS-COM/testing/Traces/test.pcap zeek-parser-CIFS-NBNS-COM
ããã¥ã¢ã«ã¤ã³ã¹ãã¼ã«ã®å ´å
ã½ã¼ã¹ã³ã¼ããã³ã³ãã¤ã«ãã¦ããªãã¸ã§ã¯ããã¡ã¤ã«ã以ä¸ã®ãã¹ã«ã³ãã¼ãã¾ãã
~$ cd ~/zeek-parser-CIFS-NBNS-COM/analyzer
~$ spicyz -o nbns.hlto nbns.spicy nbns.evt
# nbns.hltoãçæããã¾ã
~$ cp nbns.hlto /usr/local/zeek/lib/zeek-spicy/modules/
åæ§ã«Zeekãã¡ã¤ã«ã以ä¸ã®ãã¹ã«ã³ãã¼ãã¾ãã
~$ cd ~/zeek-parser-CIFS-NBNS-COM/scripts/
~$ cp main.zeek /usr/local/zeek/share/zeek/site/NBNS.zeek
æå¾ã«Zeekãã©ã°ã¤ã³ãã¤ã³ãã¼ããã¾ãã
~$ tail /usr/local/zeek/share/zeek/site/local.zeek
...çç¥...
@load NBNS
æ¬ãã©ã°ã¤ã³ã使ããã¨ã§ nbns.log
ãçæããã¾ãã
~$ cd ~/zeek-parser-CIFS-NBNS-COM/testing/Traces
~$ zeek -Cr test.pcap /usr/local/zeek/share/zeek/site/NBNS.zeek
ãã°ã®ã¿ã¤ãã¨èª¬æ
æ¬ãã©ã°ã¤ã³ã¯nbnsã®å
¨ã¦ã®é¢æ°ãç£è¦ãã¦nbns.log
ã¨ãã¦åºåãã¾ãã
ãã£ã¼ã«ã | ã¿ã¤ã | 説æ |
---|---|---|
ts | time | éä¿¡ããæã®ã¿ã¤ã ã¹ã¿ã³ã |
SrcIP | addr | éä¿¡å IPã¢ãã¬ã¹ |
SrcMAC | string | éä¿¡å MACã¢ãã¬ã¹ |
Name | string | ããã¤ã¹åãã¢ãã«çªå· |
TTL | count | çåæéï¼ãã¼ã¿ã®æå¹æéãç ´æ£ãããã¾ã§ã®æ®ãæéï¼ |
ServerType | string | ãµã¼ãã¼ã®ã¿ã¤ã |
nbns.log
ã®ä¾ã¯ä»¥ä¸ã®ã¨ããã§ãã
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path nbns
#open 2023-09-13-04-00-57
#fields ts SrcIP SrcMAC Name TTL ServiceType
#types time addr string string count string
750820972.181240 192.168.1.215 3c:a6:f6:29:43:51 MACBOOKAIR-435 900 Server
750820972.171322 192.168.1.215 3c:a6:f6:29:43:51 MACBOOKAIR-435 900 Workstation
750823604.550596 192.168.1.215 3c:a6:f6:29:43:51 MACBOOKAIR-435 900 Server
#close 2023-09-13-04-00-57
é¢é£ã½ããã¦ã§ã¢
æ¬ãã©ã°ã¤ã³ã¯OsecTã§å©ç¨ããã¦ãã¾ãã