Fwd: Re: Can IP addresses be partially wildcarded w/ `ipfstat -t'?

Jim Klimov <[email protected]> Sun, 28 Aug 2011 03:44:24 +0400
Newsgroups gmane.comp.security.firewalls.ipfilter
Organization JSC COS/HT
Message-ID <[email protected]>
This is a multi-part message in MIME format.
--------------020007030601010508040209
Content-Type: text/plain; charset=windows-1251; format=flowed
Content-Transfer-Encoding: quoted-printable
X-MIME-Autoconverted: from 8bit to quoted-printable by maildrop2.anu.edu.au id p7RNkIup013005

Forwarding Mike's reply to the list - as I seem to have
responded in private to a public discussion. Here follows:

-------- =C8=F1=F5=EE=E4=ED=EE=E5 =F1=EE=EE=E1=F9=E5=ED=E8=E5 --------
=D2=E5=EC=E0: 	Re: Can IP addresses be partially wildcarded w/ `ipfstat -=
t'?
=C4=E0=F2=E0: 	Sat, 27 Aug 2011 13:55:52 -0400 (EDT)
=CE=F2: 	Michael T. Davis <[email protected]>
=CA=EE=EC=F3: 	[email protected]



At 10:41:03.02 on 27-AUG-2011 in message<[email protected]>, you wr=
ote:

>Lame reply (since I don't know about this feature in IPF): you can pipe
>the output to "egrep", "awk" or "perl -e" -- in order to match the IPs t=
o
>a certain regexp string. Not very simple or elegant, but solves your
>problem =3D)
>
>Also this way you can more easily match IP ranges which are not
>CIDR subnets.
>

	I'm fairly sure this won't work, since the output from `ipfstat -t'
is presented in the same way as `top'.  That is, it is designed for dynam=
ic
application-driven screen updating.  As a trivial test, I tried this...

            ipfstat -t -P tcp -D any,22|awk '$2 !=3D "<firewall-ip>,22"'

...but all I could see on the screen was the heading from the `ipfstat -t=
'
display:

[begin display]
                       <hostname>  - IP Filter: v4.1.29 - state top      =
 13:44:45

Src: 0.0.0.0, Dest: 0.0.0.0,22, Proto: tcp, Sorted by: # bytes
[end display]

	On a related note, another option came to mind.  It would be
particularly useful to exclude a given host (or network range specified b=
y
CIDR or addr/mask).  If we take the above pipeline as an example, this mi=
ght
be expressed (assuming `ipfstat -t' supported it and the IP address of th=
e
firewall was 192.168.0.1) as...

                       ipfstat -t -P tcp -D !192.168.0.1,22

The scope of "!" would be limited to only the IP address or port number, =
so
that the output would be to any destination on TCP port 22 except 192.168=
.0.1.
Alternatively, if you wanted to look at all traffic destined for the fire=
wall
except SSH...

                       ipfstat -t -P tcp -D 192.168.0.1,!22

(The syntax "!any" [and equivalents] for address or port number would be
disallowed.)

Regards,
Mike


--------------020007030601010508040209
Content-Type: text/html; charset=windows-1251
Content-Transfer-Encoding: quoted-printable
X-MIME-Autoconverted: from 8bit to quoted-printable by maildrop2.anu.edu.au id p7RNkIup013005

<html>
  <head>

    <meta http-equiv=3D"content-type" content=3D"text/html; charset=3Dwin=
dows-1251">
  </head>
  <body bgcolor=3D"#FFFFFF" text=3D"#000000">
    <tt>Forwarding Mike's reply to the list - as I seem to have <br>
      responded in private to a public discussion. Here follows:<br>
    </tt><br>
    -------- =C8=F1=F5=EE=E4=ED=EE=E5 =F1=EE=EE=E1=F9=E5=ED=E8=E5 -------=
-
    <table class=3D"moz-email-headers-table" border=3D"0" cellpadding=3D"=
0"
      cellspacing=3D"0">
      <tbody>
        <tr>
          <th align=3D"RIGHT" nowrap=3D"nowrap" valign=3D"BASELINE">=D2=E5=
=EC=E0: </th>
          <td>Re: Can IP addresses be partially wildcarded w/ `ipfstat
            -t'?</td>
        </tr>
        <tr>
          <th align=3D"RIGHT" nowrap=3D"nowrap" valign=3D"BASELINE">=C4=E0=
=F2=E0: </th>
          <td>Sat, 27 Aug 2011 13:55:52 -0400 (EDT)</td>
        </tr>
        <tr>
          <th align=3D"RIGHT" nowrap=3D"nowrap" valign=3D"BASELINE">=CE=F2=
: </th>
          <td>Michael T. Davis <a class=3D"moz-txt-link-rfc2396E" href=3D=
"mailto:[email protected]">&lt;[email protected]&gt;</a=
></td>
        </tr>
        <tr>
          <th align=3D"RIGHT" nowrap=3D"nowrap" valign=3D"BASELINE">=CA=EE=
=EC=F3: </th>
          <td><a class=3D"moz-txt-link-abbreviated" href=3D"mailto:jim@co=
s.ru">[email protected]</a></td>
        </tr>
      </tbody>
    </table>
    <br>
    <br>
    <pre>At 10:41:03.02 on 27-AUG-2011 in message <a class=3D"moz-txt-lin=
k-rfc2396E" href=3D"mailto:[email protected]">&lt;4E5901E5.6060108@=
cos.ru&gt;</a>, you wrote:

&gt;Lame reply (since I don't know about this feature in IPF): you can pi=
pe
&gt;the output to "egrep", "awk" or "perl -e" -- in order to match the IP=
s to
&gt;a certain regexp string. Not very simple or elegant, but solves your
&gt;problem =3D)
&gt;
&gt;Also this way you can more easily match IP ranges which are not
&gt;CIDR subnets.
&gt;

	I'm fairly sure this won't work, since the output from `ipfstat -t'
is presented in the same way as `top'.  That is, it is designed for dynam=
ic
application-driven screen updating.  As a trivial test, I tried this...

           ipfstat -t -P tcp -D any,22|awk '$2 !=3D "&lt;firewall-ip&gt;,=
22"'

...but all I could see on the screen was the heading from the `ipfstat -t=
'
display:

[begin display]
                      &lt;hostname&gt; - IP Filter: v4.1.29 - state top  =
     13:44:45

Src: 0.0.0.0, Dest: 0.0.0.0,22, Proto: tcp, Sorted by: # bytes
[end display]

	On a related note, another option came to mind.  It would be
particularly useful to exclude a given host (or network range specified b=
y
CIDR or addr/mask).  If we take the above pipeline as an example, this mi=
ght
be expressed (assuming `ipfstat -t' supported it and the IP address of th=
e
firewall was 192.168.0.1) as...

                      ipfstat -t -P tcp -D !192.168.0.1,22

The scope of "!" would be limited to only the IP address or port number, =
so
that the output would be to any destination on TCP port 22 except 192.168=
.0.1.
Alternatively, if you wanted to look at all traffic destined for the fire=
wall
except SSH...

                      ipfstat -t -P tcp -D 192.168.0.1,!22

(The syntax "!any" [and equivalents] for address or port number would be
disallowed.)

Regards,
Mike
</pre>
  </body>
</html>

--------------020007030601010508040209--