iPhone Honeypot Project

July 7, 2010

Building Bridges with Iron, Braun and Steel

After much pain, I’ve managed to build myself a network tap or bridge as it’s more commonly known using FreeBSD 8.0 and an array of network interfaces. I haven’t posted in a bit but I’ve been doing a lost of testing with various techniques to record network traffic wired and wireless bridges, various router firmwares, port spanning using additional interfaces etc. Currently, I have a basic set up working using two wired network interfaces. I abandoned the wireless interface bridging the WAN to the LAN using a network hub due to support (or lackthereof rather) issues in FreeBSD. It seemed to be working but I couldn’t associate with the network. Attempting various configurations open, closed, ad-hoc, wep enabled, wpa, wpa2[personal/enterprise] etc. to no avail. Taking bits from the attic, I’ve managed to build a box. The specs are primitive but usable; Pentium III Xeon/Celeron processor, 447.69MHz, 40GB hard drive, 2 network interfaces (rl0, vr0), video card, and power supply. A picture of this can be found below.

Using a Zyxel Prestiage router, a Linksys WRT54G and heaps of cables the netowrk was created. This included a hub and a wireless network to allow people in the house use the internet as normal.  The bridge needed to be configured correctly first. The following are the commands required to set up a bridge after the network interfaces were tested by assigning an addresses and pinging various machines around the netowrk both wired and on the wireless interfaces.

# ifconfig bridge create
bridge0
# ifconfig bridge0
bridge0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 96:3d:4b:f1:79:7a
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
        root id 00:00:00:00:00:00 priority 0 ifcost 0 port 0

Add the member network interfaces to the bridge. For the bridge to forward packets all member interfaces and the bridge need to be up:

# ifconfig bridge0 addm rl0 addm vr0 up
# ifconfig rl0 up
# ifconfig vr0 up

The bridge is now forwarding Ethernet frames between rl0 and vr0. The equivalent configuration in /etc/rc.conf so the bridge is created at startup is:

cloned_interfaces="bridge0"
ifconfig_bridge0="addm rl0 addm vr0 up"
ifconfig_rl0="up"
ifconfig_fvr0="up"

Finally, enabling IP forwarding by modifying the kernel parameters using sysctl:

# sysctl -w net.inet.ip.forwarding=1

Thus leaving us with a functioning bridge:

I need to start working on some keystroke logging. I have looked at several options; either hacking openssh to log keystrokes, writing a patch for bash to record it, or launching a script which uses tee() to record everything to a file. I’m currently running tests by seeing if i can get the bash patch to log via syslog-ng to a remote logging server. In the meantime, I shall complete a test of recording traffic to see the average data collected etc and then conduct a pilot when the ssh server is ready. I may write my own server in python also using the twisted framework – I’ve found some tutorials on this.

Leave a Comment »

No comments yet.

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Create a free website or blog at WordPress.com.

%d bloggers like this: