Re: racluster for DNS

Yeah, there're just two filters in "racluster.conf":

filter="port 53"        status=0 idle=0
filter=""               model="saddr daddr proto dport sport"

About the pcap, it's ok too.

2016-06-03 15:55 GMT-03:00 Carter Bullard <[email protected]>:

> And your racluster.conf only has the 2 lines in it ...  no other rules !!!
> Carter
>
> On Jun 3, 2016, at 1:21 PM, Raphael Campos Silva <
> [email protected]> wrote:
>
> Hello,
>
> I checked the file "cleaned_dump.argus" and seems to be OK. The output
> from "ra -r cleaned_dump.argus - port 53" is the following:
>
>          StartTime      Flgs  Proto            SrcAddr  Sport   Dir
>      DstAddr  Dport  TotPkts   TotBytes State
>    21:53:13.609647  e           udp    192.168.100.106.1040     <->
>  192.168.100.1.domain        2        240   CON
>    21:53:14.135221  e           udp    192.168.100.106.1040     <->
>  192.168.100.1.domain        2        224   CON
>    21:53:15.079598  e           udp    192.168.100.106.1040     <->
>  192.168.100.1.domain        2        368   CON
>    21:53:16.315496  e           udp    192.168.100.106.1040     <->
>  192.168.100.1.domain        2        209   CON
>
> Tks,
>
>
> 2016-06-03 10:01 GMT-03:00 Carter Bullard <[email protected]>:
>
>> Hey Raphael,
>> Check that your "cleaned_dump.argus" isn't already cleaned up too much,
>> and make sure that your racluster.conf only has 2 lines in it.  So many
>> times, the tools do the correct thing, just not what you expect it to do.
>>
>> What does the "cleaned_dump.argus" file have in it for domain traffic ?
>>    ra -r cleaned_dump - port 53
>>
>> Carter
>>
>> On Jun 3, 2016, at 4:46 AM, Raphael Campos Silva <
>> [email protected]> wrote:
>>
>> Carter, tks for the answer.
>>
>> I tried this but didn't work for me.
>>
>> % tail -n 2 /etc/racluster.conf
>>
>> filter="port 53"        status=0 idle=0
>>
>> filter=""               model="saddr daddr proto dport sport"
>>
>>
>> % racluster -f /etc/racluster.conf -r cleaned_dump.argus
>>
>> 192.168.100.106.1040     <->      192.168.100.1.domain        8       1041
>>
>> If I set status and idle to 1, sometimes it works, but not always.
>>
>>
>> Tks.
>>
>> 2016-06-02 18:04 GMT-03:00 Carter Bullard <[email protected]>:
>>
>>> Hey Raphael,
>>> Try this racluster.conf …
>>>
>>>    filter="port 53"   status=0  idle=0
>>>    filter=""              model="saddr daddr proto dport sport “
>>>
>>> and run racluster as;
>>>
>>>    racluster -f racluster.conf -r file
>>>
>>> The status=0 tells racluster.1 not to merge the records together.
>>> How does that work for you ????
>>>
>>> Carter
>>>
>>> > On Jun 2, 2016, at 4:18 PM, Raphael Campos Silva via Argus-info <
>>> [email protected]> wrote:
>>> >
>>> > Hello guys,
>>> >
>>> > I'm using racluster for aggregate some http flows, but I don't want
>>> aggregate DNS flows. By default, racluster aggregate all dns flows, like
>>> this:
>>> > % racluster -r cleaned_dump.argus
>>> >
>>> > udp    192.168.100.106.1041     <->      192.168.100.1.domain
>>> 8       1041   CON
>>> >
>>> >
>>> >
>>> > For aggregate http, I just used the following filter (with -f option)
>>> and everthing is O.K.:
>>> >
>>> > filter="tcp"            model="saddr daddr proto dport sport"
>>> >
>>> > I've tried something like this for DNS, but is not working (returns
>>> ArgusParseAggregator: ArgusNewAggregator returned NULL):
>>> > filter="udp and dst port 53"           model="none"
>>> >
>>> > If I don't use the option -f with racluster and pass "-m none" to the
>>> program, all DNS are correct, but the http flows isn't aggregate.
>>> >
>>> > 192.168.100.106.1041     <->      192.168.100.1.domain        2
>>> 240
>>> >
>>> >
>>> > 192.168.100.106.1042      ->        A.http          7        714
>>> >
>>> >
>>> > 192.168.100.106.1041     <->      192.168.100.1.domain        2
>>> 224
>>> >
>>> >
>>> > 192.168.100.106.1041     <->      192.168.100.1.domain        2
>>> 368
>>> >
>>> >
>>> > 192.168.100.106.1041     <->      192.168.100.1.domain        2
>>> 209
>>> >
>>> >
>>> > 192.168.100.106.1042      ->        A.http          2        114
>>> >
>>> > I read the racluster manual and tried some configs but I couldn't find
>>> a solution for this. Probably I miss something.
>>> > Any suggestion is wellcome.
>>> >
>>> > Tks.
>>> > --
>>> > Raphael Campos Silva
>>> > Ciência da Computação - IBILCE Rio Preto - SP
>>> > Knowledge, exploit it.
>>> >
>>>
>>>
>>
>>
>> --
>> Raphael Campos Silva
>> Ciência da Computação - IBILCE Rio Preto - SP
>> *Knowledge, exploit it.*
>>
>>
>>
>
>
> --
> Raphael Campos Silva
> Ciência da Computação - IBILCE Rio Preto - SP
> *Knowledge, exploit it.*
>
>
>


-- 
Raphael Campos Silva
Ciência da Computação - IBILCE Rio Preto - SP
*Knowledge, exploit it.*