A topic that is not often talked about, maybe because it’s discounted as unnecessary is application dependency mapping. We only have to go back a few years to located the point at which things started to get more complicated than we really thought. More and more software is being written to automatically detect existing software/applications/services and make use of those services. This is the point and click era, where it’s assumed if the information has been entered anywhere else it should auto-magically exist in a fully reference way everywhere else in the enterprise. This creates some very interesting dilemmas when it comes to two key elements of managing an enterprise infrastructure, specifically change control and disaster recovery. Specifically evaluating the impact of a change, what will be affected or could be affected and disaster recovery in a corresponding fashion.
I routinely run into environments composed of hundreds of servers. The thought that anecdotally the inter-dependancies are know is almost laughable but surprising thought to be true. Now I’ll grant if there is traffic between to disparate VLANs and there is any security at all, the interdependencies between VLANs is if not know at least documented in a crude fashion as a result of the Access Control Lists (ACLs) and or explicit NAT/PAT mappings between the VLAN’s. This can though still be obscured by effective names space (DNS) mapping of those services which is increasingly more common in an enterprise. There are some great tool suites that create these dependency maps, however these tools are not free by any measure. There are however crude ways to get at this information using tools generically available or freely available.
Now I’m not implying that this is the most effective way to develop a dependancy map, but in a pinch or to achieve a 80/20 rule of accuracy the following crude approach has sufficed. For linux/unix there are not tools required. If a windows only environment you’ll need to obtain a compiled version of tcpdump. Every admin should of course be armed with tcpdump given it’s the TCP/IP utility knife of choice. One such tool (tcpdump) can be obtained at: http://www.microolap.com/products/network/tcpdump/download/. The other useful unix/linux equivalents for windows can be found at: http://unxutils.sourceforge.net/ .
In linux/unix;
sudo tcpdump -i {interface of choice}
e.g.: sudo tcpdump -i en1 | grep ‘who-has’
In windows you won’t need sued, since there is no concept of security regarding privilege access to the network interfaces.
The output will be similar to the following;
10:50:00.408525 ARP, Request who-has 192.168.1.103 tell 192.168.1.103 length 50
10:50:03.153795 ARP, Request who-has 192.168.1.106 tell 192.168.1.1 length 28
10:51:01.336871 ARP, Request who-has 192.168.1.103 tell 192.168.1.103 length 50
10:51:17.723448 ARP, Request who-has 192.168.1.106 tell 192.168.1.1 length 28
Import this file into excel using both command and spaces a delimiters and you will have a tidy file that looks like the following;
50:00.4
|
ARP
|
Request
|
who-has
|
192.168.1.103
|
tell
|
mujeres gordas desnudas dominicanas mujeres follando con fontaneros mujeres follando con perrostorrent mujeres guatemaltecas desnudas fotos mujeres follando con perros video mujeres haciendo el amor con un caballo akonami patch v4 00 mujeres infieles 1995 free online autocad_2007_key_generatorrar mujeres guapas en medias negras mujeres infieles cogiendo mujeres infieles 2004 megavideo 192.168.1.103
|
length
|
50
|
50:03.2
|
ARP
|
Request
|
who-has
|
192.168.1.106
|
tell
|
192.168.1.1
|
length
|
28
|
51:01.3
|
ARP
|
Request
|
who-has
|
192.168.1.103
|
tell
|
192.168.1.103
|
length
|
50
|
51:17.7
|
ARP
|
Request
|
who-has
|
192.168.1.106
|
tell
|
192.168.1.1
|
length
|
28
|
52:02.4
|
ARP
|
Request
|
who-has
|
192.168.1.103
|
tell
|
192.168.1.103
|
mujeres follando con perros perros mujeres fotos mujeres follando con monos mujeres infieles 3 torrent mujeres follando gratis length
|
50
|
52:17.7
|
ARP
|
Request
|
who-has
|
192.168.1.106
|
mujeres follando con pastor aleman mujeres infieles cojiendotorrent mujeres haciendo el amor durmiento mujeres hombres mujeres follando con monos videos tell
|
192.168.1.1
|
length
|
28
|
53:03.1
|
ARP
|
Request
|
who-has
|
192.168.1.103
|
tell
|
192.168.1.103
|
mujeres haciendo el amor con burros mujeres follando duro con animales praline pdf mujeres indias desnudas mujeres follando con su perro mujeres hermosas con medias negras length
|
50
|
Using a pivot table will create a nice map of the traffic between hosts and crude measure of how interactive they are between each other. Of course you’ll have to dig into what is going on between hosts.
Count of 192.168.1.1032
|
Column Labels
|
Row Labels
|
192.168.1.1
|
192.168.1.100
|
192.168.1.103
|
192.168.1.106
|
192.168.1.107
|
192.168.1.110
|
169.254.255.255
|
mujeres follando con sus mascotas mujeres fuertes desnudas ebook the precariat mujeres follando con un ponis mujeres infieles mujeres follando duro con animalestorrent 8
|
4
|
192.168.1.1
|
1
|
2
|
3
|
192.168.1.100
|
1
|
15
|
192.168.1.103
|
16
|
192.168.1.106
|
18
|
192.168.1.107
|
3
|
192.168.1.110
|
2
|
In this particular case, the default gateway is 192.168.1.1 and I can see quite quickly that only two hosts are really using the default gateway. Now the question is whom are they talking to? This can be derived from those hosts themselves once again using in this case tools that exist within the native OS, namely netstat. The challenge is of course netstat is a point in time tool. However, given we are trying to map application dependancies I find this tends to be accurate enough. It’s certainly not accurate enough as a forensic tool but in this case accurate enough.
using your approach of choice execute near continuously for a period of time netstat specifying your primary network port(s). This will give you output of the following flavour depending on the OS.
Active Internet connections
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 192.168.1.106.50594 yyz06s06-in-f6.1.http CLOSE_WAIT
tcp4 0 0 192.168.1.106.64711 17.172.34.30.imaps ESTABLISHED
tcp4 37 0 192.168.1.106.64633 v-client-1b.sjc..https CLOSE_WAIT
tcp4 37 0 192.168.1.106.64632 ec2-184-72-255-2.https CLOSE_WAIT
tcp4 0 0 192.168.1.106.64628 st11p01st-courie.https ESTABLISHED
tcp4 37 0 192.168.1.106.64592 a184-28-200-224..https CLOSE_WAIT
tcp4 0 0 192.168.1.106.64586 17.172.34.34.imaps ESTABLISHED
This is in essence showing you who this host is talking to in any active way. If it’s generally involved in an inter-application data flow you can be assured it’s dependant data/service sources are going to be listed unless they are extremely infrequently called. If you execute the command repeatedly over a period of time you’ll pretty much capture any recurring connections. Now this will generate a tonne of repeating information for which we are only interested in the unique conversations.
Using awk / gawk depending on the OS and the utility sources above create the awk command file uniq.awk;
/^tcp/ || /^udp/ {
if ( $5 !~ /localhost/ )
if (!($5 in unique)) {
print $5;
unique[$5] = 1;
}
}
if you captured netstat into a simple text file such as;
netstat >> ~/netstat.out.txt (linux)
netstat >> ./netstatout.txt (windows)
then,
awk -f uniqu.awk netstat.out.txt is going to give you the servers being utilized by this host over the period of time you were capturing the data….
e.g. in a more interactive way;
BLACKHOLE:~ rmcilmoyle$ netstat | awk -f uniq.awk
yyz06s06-in-f6.1.http
17.172.34.30.imaps
v-client-1b.sjc..https
ec2-184-72-255-2.https
st11p01st-courie.https
a184-28-200-224..https
17.172.34.34.imaps
17.172.34.29.imaps
qy-in-f109.1e100.imaps
lpp01m01-in-f109.imaps
Using these two crude tools I can develop a dependency map for the LAN or LAN segment by host without having to purchase a host of expensive tools. Generally speaking map from the most restricted hosts first, such as a database server and you will quickly derive who’s using it and there will be little need to map individual all the hosts on a LAN segment to establish a fairly reliable inter-dependency map.
