Many UDP communications are susceptible to amplification attacks. You might want to monitor communication over UDP on your network for the following situations:
Prerequisites
In order to execute this procedure in your environment, you may need to first on-board the data, services, or apps shown in the following table.
|
Category |
Name |
Importance |
|
Data |
Required |
|
|
Add-on |
Recommended |
|
|
App |
Recommended |
Example
The purpose of this example is to show how this procedure works in a general environment. In your environment, you can optimize the search by specifying an index, a time range, or a different data source.
You want to compare bytes sent to bytes received by your memcached server to determine whether the payload was amplified, which might indicate an attempt at a Denial of Service attack.
Option 1
If you don't know the port number the external host is using, use this search. After you identify port numbers in use, you can use Option 2 to validate your findings.
- Run the following search:
sourcetype=aws:cloudwatchlogs:vpcflow (src_port=<memcached server port number> OR dest_port=<memcached server port number>)
| head 4
| table _time duration account_id region interface_id src src_port dest dest_port bytes protocol packets vpcflow_action
Search Explanation
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
|
Splunk Search |
Explanation |
|
sourcetype=aws:cloudwatchlogs:vpcflow |
Search only AWS CloudWatch VPCFlow data. |
|
(src_port=<memcached server port number> OR dest_port=<memcached server port number>) |
Return results originating from or going to the memcached server. |
|
| head 4 |
Return the 4 most recent events. Note: VCPFlows are collections of unidirectional packets. Therefore, 4 results represent 2 network connections. You can adjust this number as needed. |
|
| table _time duration account_id region interface_id src src_port dest dest_port bytes protocol packets vpcflow_action |
Display the results in a table with columns in the order shown. Note: External hosts cannot communicate with an AWS-hosted RFC1918 address, so the actual network communications must have come through a public IP address such as a load balancer. |
Option 2
If you already know what port number the external host uses, use this search.
- Run the following search:
sourcetype=stream:udp (src_port=<client port number> OR src_port=<another client port number> OR src_port=<memcached server port number>)
| head 2
| eval short_src_content=substr(src_content,1,75)
| eval short_dest_content=substr(dest_content,1,75)
| table _time bytes_in bytes_out src src_port dest dest_port short_src_content short_dest_content
Search Explanation
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
|
Splunk Search |
Explanation |
|
sourcetype=stream:udp |
Search only Stream UDP data. |
|
(src_port=<client port number> OR src_port=<another client port number> OR src_port=<memcached server port number>) |
Return results originating from the external host or the memcached server. Note: You can add as many client port numbers to this search as needed. |
|
| head 2 |
Return the 2 most recent events. Note: Stream data shows a complete network connection, bytes sent and received. |
|
| eval short_src_content=substr(src_content,1,75) |
Return characters 1 through 75 of the src_content string, and rename the column as short_src_content. |
|
| eval short_dest_content=substr(dest_content,1,75) |
Return characters 1 through 75 of the dest_content string, and rename the column as short_dest_content. |
|
| table _time bytes_in bytes_out src src_port dest dest_port short_src_content short_dest_content |
Display the results in a table with columns in the order shown. |
Result
Compare the bytes sent (bytes_out) to the bytes received (bytes_in) to see whether the payload has been amplified. For example, if 50 bytes were sent, but 51327 bytes were received, there is an amplification factor of almost 1027. Note that the byte values will vary slightly between the two search options provided in this guide due to IP overhead, such as packet options.
Save this search to continue to monitor for packet size disparities. You might also want to monitor packet count disparities.
Comments
0 comments
Please sign in to leave a comment.