Profiling client internet connections
Some more fun with p0f and Splunk...Now with profiling of client internet connections!
Setup of the p0f and logging is the same as in the OS Profiling post.
The Splunk search string has been extended to extract the source's internet link as a field too (go for the portion in bold for the field extracting commands):
| file /home/path/to/p0f.log | rex field=_raw "> (?<srcip>[^:]+):(?<srcport>[^ ]+) – (?<srcos>.+?) \(" | rex field=_raw "-> (?<dstip>[^:]+):(?<dstport>[^ ]+) " | rex field=_raw "link: (?<srclink>.*)\)$" | regex srclink!="(unspecified|unknown)" | top limit=0 srclink
The fields that I extract with this:
- srcip -> source IP
- srcport -> source TCP port
- srcos -> source's OS (woot!)
- dstip -> destination IP (which is my machine's)
- dstport -> the destination port which the TCP connection was initiated to
- srclink -> the internet link of the source machine
After filtering out the "unspecified" and "unknown" links, the list of the detected links are as follows:
"ethernet/modem" points to mostly cable connections. There're some interesting entries in the list though, like vtun, pppoe, Google/AOL, IPv6/IPIP (early adopters? haha). Don't have any idea on what's IPSec/GRE, or vLAN here in this context though.
Just for the heck of it, here's the chart for this table, generated from the reports link in Splunk.
I like the charts, because they allow some interaction with the charts for simple datasets, but I digress 
