Table of Contents
Advertisement
Backdoor analysis uses two algorithms. The first algorithm collects the specified number of ICMP
echo request and echo response packets, then compares the total number of echo requests with the
number of echo responses. The numbers should match. If the numbers are off by the specified
threshold, the collected traffic is analyzed further to determine which IP address is sending
unsolicited echo response packets. The internal event generated is ICMP:BD-REPLY.
The second algorithm looks at all collected ICMP echo request and response pairs and looks for
ICMP sequence numbers that do not change. Typically, ICMP ping packets increment their
sequence number by one for each subsequent ping. Many hacker ICMP communication tools do
not do this, including tools like Loki. The internal event generated is ICMP:BD-SEQ.
In all cases, the Network Sensor attempts to collect some of the ICMP packets in question after a
suspect IP has been identified. Broken routers, bad routes and broken IP stacks can cause false
positives for these alerts, and a manual inspection of the ICMP traffic is usually required.
Fast ICMP Settings
Fast ICMP analysis can indicate unusual patterns of ICMP traffic, the use of an ICMP backdoor, or
an incoming ICMP flood. You configure the minimum number of ICMP packets required to make
a Fast ICMP determination, and the Time modifier, in seconds. The configured minimum number
of ICMP packets must be received within the configured time in order to generate an event.
The internal event generated is FAST-ICMP.
Enable Loki Check Setting
Loki is a tool used to communicate between a client and server using ICMP. Tools such as this are
commonly used by hackers as covert channels to access systems they have broken into. Enable the
Loki check to search ICMP echo response and echo request packets for evidence of Loki traffic.
The internal event generated is LOKI.
Procedure
To configure the sensor to perform ICMP traffic analysis:
1.
Click the Network Policy View icon and the Network Policies tab.
2.
Expand the tree by clicking the expansion symbols and select the custom policy name.
The modules for that policy are displayed in the tree.
Configuring the Covert Channel Analysis Module
Creating Network Sensor Policies and Signatures 2-21
Advertisement
Table of Contents
