用于数据包捕获的 IDP 实用程序
用于数据包捕获的 IDP 实用程序是一种专门的工具，用于捕获、管理和允许分析与 IDP 事件相关的数据包数据。
数据包捕获实用程序用于分析记录网络流量的数据包捕获文件。IDP 实用程序允许网络管理员检查这些数据包捕获文件，以识别网络流量中的潜在安全威胁或异常情况。
使用 功能资源管理器 确认平台和版本对特定功能的支持。
查看 特定于平台的数据包捕获行为 部分，了解与您的平台相关的注意事项。
数据包捕获
IDP 中的数据包捕获是一项捕获和分析网络流量以检测和预防安全威胁的功能。
仅提供 CLI 支持来显示和清除数据包捕获流量的上下文和关联数据，从而改进 IDP 验证过程。
您可以在 inet 模式或透明模式下运行数据包捕获实用程序以生成协议上下文。您应该从 UNIX shell 提示符 （%） 运行命令行数据包捕获馈送器实用程序工具。
数据包捕获馈线实用程序使用要馈送数据包的流量接口中可用的一对源和目标 IPv4 地址。数据包捕获馈线实用程序还会使用为注入这些 PCAP 的接口配置的 IPV4 地址。 将 PCAP 馈送到这些接口后，将与 PCAP 关联的上下文列表以及上下文中的数据进行匹配。仅对于数据包捕获馈送器生成的流量，才会显示上下文、命中和关联数据。不会捕获实时流量统计信息。馈入数据包时，请确保将数据包馈送到接口的子网 IP。如果将数据包馈送到接口 IP，IDP 安全处理可能无法检测到上下文。您可以使用所有其他子网 IP 地址，接口 IP 地址除外。
在通过数据包捕获馈送器实用工具运行新的PCAP之前，请使用以下清除上下文命令清除现有上下文和数据：
[edit security] user@host> clear security idp attack context user@host> clear security flow session interface <intf1> user@host> clear security flow session interface <intf2> user@host> clear security flow session idp user@host> clear security idp attack table
用于 Inet 模式数据包捕获馈送器的示例命令：
% pcapfeed –verbose --interface-ip1 5.0.0.13 --interface-ip2 15.0.0.14 --pcap-ip1 6.0.0.1 --pcap-ip2 7.0.0.1 --interface1 ge-0/0/6 --interface2 ge-0/0/7 --pcap /var/tmp/http.pcap
或者
% pcapfeed –quiet --interface-ip1 5.0.0.13 --interface-ip2 15.0.0.14 --pcap-ip1 6.0.0.1 --pcap-ip2 7.0.0.1 --interface1 ge-0/0/6 --interface2 ge-0/0/7 --pcap /var/tmp/http.pcap
用于透明模式数据包捕获馈送器的示例命令：
% pcapfeed –verbose –transparent --pcap-ip1 6.0.0.1 --pcap-ip2 7.0.0.1 --interface1 ge-0/0/6 --interface2 ge-0/0/7 --pcap /var/tmp/http.pcap
或者
% pcapfeed –quiet –transparent --pcap-ip1 6.0.0.1 --pcap-ip2 7.0.0.1 --interface1 ge-0/0/6 --interface2 ge-0/0/7 --pcap /var/tmp/http.pcap
表 1 定义了上述示例输出中的 PCAP 馈线工具字段。
Fields |
Description |
pcap --安静 |
禁止日志显示在控制台中 |
pcap --详细 |
使日志能够显示在控制台中 |
接口-IP1 |
第一个用于馈送数据包捕获数据包的接口的 IP 地址 |
接口-IP2 |
另一个接口的 IP 地址，用于向数据包捕获数据包发送数据包 |
PCAP-IP1 |
数据包捕获中看到的 IP 地址 |
PCAP-IP2 |
在数据包捕获中看到的另一个 IP 地址 |
接口 1 |
安全设备上的接口 1 |
接口 2 |
安全设备上的接口 1 |
数据包捕获馈送器不支持：
IPv6
多通道协议，例如 FTP
示例：配置数据包捕获馈送器
此示例说明如何在 inet 模式下运行数据包捕获 （PCAP） 馈线以生成协议上下文。
要求
开始之前：
配置网络接口。
概述
使用相关 IDP 策略运行 PCAP 馈线，以获取关联的协议上下文。在此示例中，在静音模式下使用 pcap-ip1 6.0.0.1 和 pcap-ip2 7.0.0.1 馈电 PCAP。
配置
过程
CLI 快速配置
要快速配置此示例，请复制以下命令，将其粘贴到文本文件中，删除所有换行符，更改详细信息，以便与网络配置匹配，然后将命令复制并粘贴到层次结构级别的 [edit] CLI 中，然后从配置模式进入。commit
set security idp idp-policy idppolicy rulebase-ips rule 1 match from-zone any set security idp idp-policy idppolicy rulebase-ips rule 1 match source-address any set security idp idp-policy idppolicy rulebase-ips rule 1 match to-zone any set security idp idp-policy idppolicy rulebase-ips rule 1 match destination-address any set security idp idp-policy idppolicy rulebase-ips rule 1 match application default set security idp idp-policy idppolicy rulebase-ips rule 1 match attacks predefined-attack-groups “HTTP - All” set security idp idp-policy idppolicy rulebase-ips rule 1 then action close-client-and-server set security idp idp-policy idppolicy rulebase-ips rule 1 then notification log-attacks set security forwarding-options family inet6 mode flow-based set security policies from-zone trust to-zone untrust policy 1 match source-address any set security policies from-zone trust to-zone untrust policy 1 match destination-address any set security policies from-zone trust to-zone untrust policy 1 match application any set security policies from-zone trust to-zone untrust policy 1 then permit application-services idp-policy idppolicy set security policies from-zone untrust to-zone trust policy 1 match source-address any set security policies from-zone untrust to-zone trust policy 1 match destination-address any set security policies from-zone untrust to-zone trust policy 1 match application any set security policies from-zone untrust to-zone trust policy 1 then permit application-services idp-policy idppolicy set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust host-inbound-traffic protocols all set security zones security-zone untrust interfaces ge-0/0/0.0 set security zones security-zone untrust application-tracking set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces ge-0/0/2.0 set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.15/24 set interfaces ge-0/0/2 unit 0 family inet address 10.0.0.16/24
分步程序
下面的示例要求您在各个配置层级中进行导航。有关如何执行此操作的说明，请参阅《CLI 用户指南》中的在配置模式下使用 CLI 编辑器。
要创建应用程序并将其与 IDP 策略相关联，请执行以下操作：
通过为策略分配有意义的名称来创建策略，将规则库与策略相关联，将规则添加到规则库，并为规则定义匹配标准。
[edit security] user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match from-zone any user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match source-address any user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match to-zone any user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match destination-address any user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match application default user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match attacks predefined-attack-groups “HTTP - All” user@host#set idp idp-policy idppolicy rulebase-ips rule 1 then action close-client-and-server user@host#set idp idp-policy idppolicy rulebase-ips rule 1 then notification log-attacks user@host#set forwarding-options family inet6 mode flow-based
配置策略。
[edit security] user@host#set policies from-zone trust to-zone untrust policy 1 match source-address any user@host#set policies from-zone trust to-zone untrust policy 1 match destination-address any user@host#set policies from-zone trust to-zone untrust policy 1 match application any user@host#set policies from-zone trust to-zone untrust policy 1 then permit application-services idp-policy idppolicy user@host#set policies from-zone untrust to-zone trust policy 1 match source-address any user@host#set policies from-zone untrust to-zone trust policy 1 match destination-address any user@host#set policies from-zone untrust to-zone trust policy 1 match application any user@host#set policies from-zone untrust to-zone trust policy 1 then permit application-services idp-policy idppolicy
配置区域和分配接口。
[edit security] user@host# set zones security-zone untrust host-inbound-traffic system-services all user@host# set zones security-zone untrust host-inbound-traffic protocols all user@host# set zones security-zone untrust interfaces ge-0/0/0.0 user@host# set zones security-zone untrust application-tracking user@host# set zones security-zone trust host-inbound-traffic system-services all user@host# set zones security-zone trust host-inbound-traffic protocols all user@host# set zones security-zone trust interfaces ge-0/0/2.0
配置转发接口。
[edit] user@host# set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.15/24 user@host# set interfaces ge-0/0/2 unit 0 family inet address 10.0.0.16/24
结果
在配置模式下，输入和show security idpshow applications命令以确认您的配置。如果输出未显示预期的配置，请重复此示例中的配置说明进行更正。
[edit]
user@host# show security idp
idp-policy idppolicy {
rulebase-ips {
rule 1 {
match {
from-zone any;
source-address any;
to-zone any;
destination-address any;
application default;
}
then {
action {
close-client-and-server;
}
notification {
log-attacks;
}
}
}
}
}
[edit]
user@host# show security policies
from-zone trust to-zone untrust {
policy 1 {
match {
source-address any;
destination-address any;
application any;
}
then {
permit {
application-services {
idp-policy idppolicy;
}
}
}
}
[edit]
user@host# show security zones
security-zone untrust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/0.0;
}
application-tracking;
}
[edit]
user@host# show interfaces
ge-0/0/0 {
unit 0 {
family inet {
address 10.0.0.15/24;
}
}
}
ge-0/0/2 {
unit 0 {
family inet {
address 10.0.0.16/24;
}
}
}
如果完成设备配置，请从配置模式进入。commit
验证
要确认配置工作正常，请执行以下任务：
验证配置
目的
使用 PCAP 馈送程序工具运行 PCAP 后，验证 IDP 攻击上下文。
行动
在操作模式下，输入命令 show security idp attack context 。
示例输出
user@host> show security idp attack context IDP context statistics: Context name #Hits #Data http-url 1 / http-get-url 1 / http-header-host 1 7.0.0.1 http-header-user-agent 1 lwp-request/5.827 libwww-perl/5.833 http-header 2 te: deflate,gzip;q=0.3 && connection: TE, close http-request 1 GET / HTTP/1.1 http-request-method 1 GET / HTTP/1.1
示例：在透明模式下配置数据包捕获馈送器
此示例说明如何在透明模式下运行数据包捕获 （PCAP） 馈线以生成协议上下文。
要求
开始之前：
配置网络接口。
概述
要运行具有相关 IDP 策略的 PCAP 馈线，以便从从数据包捕获运行的数据包中获取关联的协议上下文。在此示例中，PCAP 馈线 pcap-ip 2 7.0.0.1 在静默模式下用于馈送数据包。
配置
过程
CLI 快速配置
要快速配置此示例，请复制以下命令，将其粘贴到文本文件中，删除所有换行符，更改详细信息，以便与网络配置匹配，然后将命令复制并粘贴到层次结构级别的 [edit] CLI 中，然后从配置模式进入。commit
set groups global protocols l2-learning global-mode transparent-bridge set security idp idp-policy idppolicy rulebase-ips rule 1 match from-zone any set security idp idp-policy idppolicy rulebase-ips rule 1 match source-address any set security idp idp-policy idppolicy rulebase-ips rule 1 match to-zone any set security idp idp-policy idppolicy rulebase-ips rule 1 match destination-address any set security idp idp-policy idppolicy rulebase-ips rule 1 match application default set security idp idp-policy idppolicy rulebase-ips rule 1 match attacks predefined-attack-groups “HTTP - All” set security idp idp-policy idppolicy rulebase-ips rule 1 then action close-client-and-server set security idp idp-policy idppolicy rulebase-ips rule 1 then notification log-attacks set security policies from-zone trust to-zone untrust policy 1 match source-address any set security policies from-zone trust to-zone untrust policy 1 match destination-address any set security policies from-zone trust to-zone untrust policy 1 match application any set security policies from-zone trust to-zone untrust policy 1 then permit application-services idp-policy idppolicy set security policies from-zone untrust to-zone trust policy 1 match source-address any set security policies from-zone untrust to-zone trust policy 1 match destination-address any set security policies from-zone untrust to-zone trust policy 1 match application any set security policies from-zone untrust to-zone trust policy 1 then permit application-services idp-policy idppolicy set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust host-inbound-traffic protocols all set security zones security-zone untrust interfaces ge-0/0/0.0 set security zones security-zone untrust application-tracking set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces ge-0/0/2.0 set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 301 set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members 301 set interfaces irb unit 301 family inet address 10.1.1.11/8 set vlans bd-vlan-301 vlan-id 301 set vlans bd-vlan-301 l3-interface irb.301
分步程序
下面的示例要求您在各个配置层级中进行导航。有关如何执行此操作的说明，请参阅《CLI 用户指南》中的在配置模式下使用 CLI 编辑器。
要创建应用程序并将其与 IDP 策略相关联，请执行以下操作：
设置配置组。
[edit] user@host#set groups global protocols l2-learning global-mode transparent-bridge
通过为策略分配有意义的名称来创建策略，将规则库与策略相关联，将规则添加到规则库，并为规则定义匹配标准。
[edit security] user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match from-zone any user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match source-address any user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match to-zone any user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match destination-address any user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match application default user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match attacks predefined-attack-groups “HTTP - All” user@host# set idp idp-policy idppolicy rulebase-ips rule 1 then action close-client-and-server user@host# set idp idp-policy idppolicy rulebase-ips rule 1 then notification log-attacks user@host# set forwarding-options family inet6 mode flow-based
配置策略。
[edit security] user@host# set policies from-zone trust to-zone untrust policy 1 match source-address any user@host# set policies from-zone trust to-zone untrust policy 1 match destination-address any user@host# set policies from-zone trust to-zone untrust policy 1 match application any user@host# set policies from-zone trust to-zone untrust policy 1 then permit application-services idp-policy idppolicy user@host# set policies from-zone untrust to-zone trust policy 1 match source-address any user@host# set policies from-zone untrust to-zone trust policy 1 match destination-address any user@host# set policies from-zone untrust to-zone trust policy 1 match application any user@host# set policies from-zone untrust to-zone trust policy 1 then permit application-services idp-policy idppolicy
配置区域和分配接口。
[edit security] user@host# set zones security-zone untrust host-inbound-traffic system-services all user@host# set zones security-zone untrust host-inbound-traffic protocols all user@host# set zones security-zone untrust interfaces ge-0/0/0.0 user@host# set zones security-zone untrust application-tracking user@host# set zones security-zone trust host-inbound-traffic system-services all user@host# set zones security-zone trust host-inbound-traffic protocols all user@host# set zones security-zone trust interfaces ge-0/0/2.0
配置转发接口。
[edit] user@host# set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode access user@host# set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 301 user@host# set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access user@host# set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members 301 user@host# set interfaces irb unit 301 family inet address 10.1.1.11/8
配置 VLAN ID。
[edit] user@host# set vlans bd-vlan-301 vlan-id 301 user@host# set vlans bd-vlan-301 l3-interface irb.301
结果
在配置模式下，输入和show security idpshow applications命令以确认您的配置。如果输出未显示预期的配置，请重复此示例中的配置说明进行更正。
[edit]
user@host# show security idp
idp-policy idppolicy {
rulebase-ips {
rule 1 {
match {
from-zone any;
source-address any;
to-zone any;
destination-address any;
application default;
}
then {
action {
close-client-and-server;
}
notification {
log-attacks;
}
}
}
}
}
[edit]
user@host# show security policies
from-zone untrust to-zone trust {
policy 1 {
match {
source-address any;
destination-address any;
application any;
}
then {
permit {
application-services {
idp-policy idppolicy;
}
}
}
}
}
default-policy {
permit-all;
}
[edit]
user@host# show security zones
security-zone trust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/0.0;
ge-0/0/2.0;
}
advance-policy-based-routing-profile {
p1;
}
}
security-zone untrust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/1.0;
ge-0/0/2.0;
ge-0/0/3.0;
ge-0/0/0.0;
}
application-tracking;
}
[edit]
user@host# show interfaces
ge-0/0/0 {
unit 0 {
family inet {
address 14.0.0.1/24;
}
family ethernet-switching {
interface-mode access;
vlan {
members 301;
}
}
}
}
ge-0/0/2 {
unit 0 {
family inet {
address 192.0.3.1/24;
}
family ethernet-switching {
interface-mode access;
vlan {
members 301;
}
}
}
}
如果完成设备配置，请从配置模式进入。commit
验证
要确认配置工作正常，请执行以下任务：
验证配置
目的
使用 PCAP 馈送程序工具运行 PCAP 后，验证 IDP 攻击上下文。
行动
在操作模式下，输入命令 show security idp attack context 。
示例输出
user@host> show security idp attack context IDP context statistics: Context name #Hits #Data http-url 1 / http-get-url 1 / http-header-host 1 7.0.0.1 http-header-user-agent 1 lwp-request/5.827 libwww-perl/5.833 http-header 2 te: deflate,gzip;q=0.3 && connection: TE, close http-request 1 GET / HTTP/1.1 http-request-method 1 GET / HTTP/1.1
特定于平台的数据包捕获行为
使用 功能资源管理器 确认平台和版本对特定功能的支持。
使用下表查看平台的特定于平台的行为。
| 平台 |
差异 |
|---|---|
| SRX 系列防火墙 |
支持数据包捕获的 SRX300、SRX320、SRX340 和 SRX345 防火墙支持以下 |