?
Solved

Remotely starting wireshark

Posted on 2014-02-14
4
Medium Priority
?
356 Views
Last Modified: 2014-02-20
How can I start a capture due to a monitored threshold being met?
0
Comment
Question by:whroadmin
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 40

Expert Comment

by:noci
ID: 39861091
With wireshark comes tshark, the text variant.
You can remotely monitor a system for example:

ssh remote tshark -w file -i ethX not port 22

(Prevent port 22 from being monitored, and write to the local file 'file'
while monitoring ethX.   Port 22 would measure also the output of t-shark)..
0
 

Author Comment

by:whroadmin
ID: 39861518
I have two 1g circuits into my network. i have nogios and active monitor watching them for ddos attacks. Now, should they detect that the circuit went from 300Mbs to 998Mbs, they send me an alert, but i also want them to start a batch file that will start a wireshark capture. I have the bat file, i just need some way for it to be started by nagios or active monitor.
0
 
LVL 40

Accepted Solution

by:
noci earned 1000 total points
ID: 39861555
tshark -w /var/log/tsharkfile.$(date +%Y%m%dT%H%M%S) -i ethX

Which will capture everything from then on.... ethX = eth0 or eth1 or whatever.
in the /var/log/tsharkfile.{start time}...

Now you will also need a means to stop it again after a while....

You may want to look into fail2ban to activly monitor & block network access.
0
 
LVL 33

Assisted Solution

by:Dave Howe
Dave Howe earned 1000 total points
ID: 39864676
nagios has the concept of an "event handler" - by enabling this, you can have it run a second script on trigger of warn or crit.

http://nagios.sourceforge.net/docs/3_0/eventhandlers.html

note - event handlers can be any command you wish (which is good!) but have a timeout after which the process will be killed - this is quite short (30s on my system) so you will want the command to fork the actual tshark process with nohup or similar rather than starting it directly and having it killed when nagios cleans up.

if you have gnu screen installed, you might want to consider using "screen -dmS <name> <command>" which will run the process in a detached screen session - which you can then join to to look at later with "screen -r"
0

Featured Post

Cyber Threats to Small Businesses (Part 2)

The evolving cybersecurity landscape presents SMBs with a host of new threats to their clients, their data, and their bottom line. In part 2 of this blog series, learn three quick processes Webroot’s CISO, Gary Hayslip, recommends to help small businesses beat modern threats.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is written by John Gates, CISSP. Gates, the SNUG President-Elect, currently holds the position of Manager of Information Systems at Lake Park High School in Roselle, Illinois.
The well known Cerber ransomware continues to spread this summer through spear phishing email campaigns targeting enterprises. Learn how it easily bypasses traditional defenses - and what you can do to protect your data.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
Suggested Courses

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question