Other Techniques That Detect Active Worms
Internet service providers (ISP) use other techniques to detect an active worm that propagates in their networks. Actually, ISP can detect network scanning to random IP addresses.
The trick is to forward all packets to nonexisting addresses, such as nonallocated IP addresses, to a single host that can be monitored for traffic surge. If this host receives too much traffic, this means that many packets are sent to nonexisting hosts. This is most probably the result of a worm randomly scanning the network to propagate itself.
More on Nonallocated IP Addresses
In the case of an ISP, all the address space received indirectly from Internet Assigned Numbers Authority (IANA) is not fully allocated to the ISP infrastructure or to ISP customers. The addresses received but not allocated are actually nonexistent and, therefore, should never receive any traffic if the network is well configured and if the traffic is normal. In the case of an enterprise using a block of IP addresses received through its ISP, the same reasoning applies: Not all received IP addresses are allocated, and there should be no traffic destined to the nonallocated IP addresses.
In the case of an enterprise using RFC 1918 private addresses, such as network 10.0.0.0/8 or 192.168.0.0/16, not all those private addresses are actually used by the network infrastructure or are assigned to subnets. Again, all traffic destined to those nonallocated IP addresses is suspicious because there should be no traffic to nonallocated addresses in well-configured networks.
In addition to the nonallocated IP addresses, several IP addresses don't exist in the Internet;
o they are called bogons. (For an updated list, see The Team Cymru Bogon List.o
Figure 15-7 depicts how a sink hole is set up in a network. The sink-hole router announces a default route to all other routers. (It is assumed that no default route is announced in this network.)
Figure 15-7 Sink Hole Receives Worm Scans
Figure 15-7 Sink Hole Receives Worm Scans
When no worm is in the network, existing hosts (clients and servers) exchange all IP packets; therefore, all packets have a valid destination IP address (that is, one existing in the routing tables). They always reach their destination. Hence, the sink-hole router never gets any traffic.
When a worm is active on some infected hosts, it tries to propagate itself by generating random IP addresses and by trying to connect to those random addresses to infect more machines. When the worm connects to a valid address—that is, an address existing in the routers' routing tables—the IP packets are actually forwarded to their destination. But, when the worm tries to send IP packets to a nonexistent address, those packets follow the default route announced by the sink-hole router and reach this router. If the router itself is configured with a default route to a next hop (which is a sniffer), the sniffer analyzes the incorrectly addressed packets.
To summarize:
• No worm. The sink-hole router does not receive any packet.
• Active worm. The sink-hole router receives many packets (that is, the incorrectly addressed ones).
When the network already announces a default route (for example, a firewall connecting to the Internet), it is still possible to use the sink-hole technique. Instead of announcing a default route, the sink-hole router must announce several nonexistent prefixes:
• Prefixes not allocated by IANA or other registries. For example, 0.0.0.0/7, 2.0.0.0/ 8, and so on. These prefixes are called bogons.
• Prefixes of your network that are not in use. For example, if the network is using RFC 1918 private addressing with prefix 10.0.0.0/8, and if 10.254.0.0/16 and 10.255.0.0/16 are not used, the sink-hole router advertises those two prefixes.
Because DoS attacks and worms increase network traffic, this traffic surge can also be detected by simple tools, such as Multirouter Traffic Grapher9 (MRTG). MRTG collects interface statistics with the help of SNMP and presents them in detailed graphs.
Figure 15-8 displays a normal behavior of traffic on a low-speed link, while Figure 15-9 exhibits unusual behavior around 9 A.M. with a peak in traffic of 80 Mbps. In both figures, time flows from right to left, and the numbers below the X axis represent the hour in the day.
Alas, MRTG has no provision to generate alerts and gives little clue about what is actually happening in the network: no information about protocol, source and destination addresses, and so on. Also, MRTG uses the amount of traffic rather than the amount of new flows, and traffic does not clearly indicate a worm.
Figure 15-8 MRTG Graph for Normal Traffic
- Figure 15-9 MRTG Graph for Unusual Traffic Pattern
Continue reading here: Protecting the Infrastructure Using ACLs
Was this article helpful?