Passive OS fingerprint, smartphone detection

I recently started a service that allows smartphone users to connect to one of my networks over PPTP to hide their origins. To ensure users are not trying to use the service on computers, I figured some passive OS fingerprinting would be in place.

p0f -i ppp0
p0f - passive os fingerprinting utility, version 2.0.8
(C) M. Zalewski , W. Stearns
p0f: listening (SYN) on 'ppp0', 262 sigs (14 generic, cksum 0F1F5CA2), rule: 'all'.

# Iphone 3GS, iOS 4.1
10.100.200.100:52900 - UNKNOWN [65535:64:1:64:M1404,N,W2,N,N,T,S,E:P:?:?] (up: 121 hrs)
-> 1.2.3.4:80 (link: unknown-1444).

# android 2.2, HTC Desire
10.100.200.100:48885 - UNKNOWN [S44:64:1:60:M1356,S,T,N,W1:.:?:?] (NAT!) (up: 3 hrs)
-> 1.2.3.4:80 (link: unknown-1396)

syslog-ng by example

1) make sure udp listener is on
netstat -anop|grep 514

2) If not, add udp(); as source to syslog-ng.conf

# udp source
source s_udp {
udp();
};

3) create a destination
destination d_name { file("/var/log/file.log"); };

4) create a filter
filter f_name {
host("192.168.123.123")
and facility(auth,authpriv);
};

5) Create the logging for the filter to the destination
log {
source(s_udp);
filter(f_name);
destination(d_name);
};

Do add the remote logging on the servers, if needed tcpdump on the syslog-ng server to verify that log entries come in.

Narrowing down processes using loads of disk I/O

iostat shows you the reads and writes

# iostat -m
Linux 2.6.28-11-generic (rant-e-minor) 12/04/2009 _i686_ (2 CPU)

avg-cpu: %user %nice %system %iowait %steal %idle
9.20 0.01 2.76 1.10 0.00 87.02

Device: tps MB_read/s MB_wrtn/s MB_read MB_wrtn
sda 8.26 0.19 0.03 3443 642
sda1 8.25 0.19 0.03 3442 642
sda2 0.00 0.00 0.00 0 0
sda5 0.00 0.00 0.00 0 0


Enable block dump to see which processes writes data, and then tail the kern.log or equivalent:

# echo 1 > /proc/sys/vm/block_dump
# tail -f /var/log/kern.log
Dec 4 14:09:33 rant-e-minor kernel: [18343.000899] kjournald(772): WRITE block 237973000 on sda1
Dec 4 14:09:33 rant-e-minor kernel: [18343.000902] kjournald(772): WRITE block 237973008 on sda1
Dec 4 14:09:33 rant-e-minor kernel: [18343.000905] kjournald(772): WRITE block 237973016 on sda1
Dec 4 14:09:33 rant-e-minor kernel: [18343.001365] kjournald(772): WRITE block 237973024 on sda1
Dec 4 14:09:37 rant-e-minor kernel: [18346.074288] wpa_supplicant(7871): dirtied inode 8742018 (wpa_supplicant.log) on sda1
Dec 4 14:09:37 rant-e-minor kernel: [18346.074297] wpa_supplicant(7871): dirtied inode 8742018 (wpa_supplicant.log) on sda1
Dec 4 14:09:37 rant-e-minor kernel: [18346.074299] wpa_supplicant(7871): dirtied inode 8742018 (wpa_supplicant.log) on sda1

Don't forget to 'echo 0 > /proc/sys/vm/block_dump'

Killing disgusting zombie processes

I had a dead rsync that refused to die even with kill -9. After some google research, I found that 'ps -l' can show parent process of a zombie.

First some background; A zombie is basically a dead process, and they reason they exist is so that the parent process can retrieve the zombie's exit status and such. If you kill the parent process, the zombie will become a child process of PID 1 (init), and init is always waiting for children to die, so that they don't remain zombies. Note, zombies consumes almost no resources.

# ps ax |grep rsync
4337 pts/3 Z 0:00 [rsync]
# kill -9 4337
# ps ax |grep rsync
4337 pts/3 Z 0:00 [rsync]
# ps -l
F S UID PID PPID C PRI NI ADDR SZ WCHAN TTY TIME CMD
4 S 0 2678 2654 0 75 0 - 1016 wait pts/3 00:00:00 bash
0 T 0 4335 2678 0 75 0 - 904 finish pts/3 00:00:00 nfs2local.sh
0 Z 0 4337 4335 0 75 0 - 0 exit pts/3 00:00:00 rsync

# kill 4335
# ps ax |grep rsync
#

Voila!

VLAN tagging in Debian GNU/Linux

$ sudo apt-get install vlan

edit /etc/network/interfaces:

auto vlan150
iface vlan150 inet static
address 172.0.0.150
netmask 255.255.255.0
vlan_raw_device eth0

As root, bring the interface up:
# ifup vlan150

You can also use vconfig and ifconfig:

# vconfig add eth0 150
Added VLAN with VID == 150 to IF -:eth0:-
# ifconfig eth0.150

Now you could try tcpdumping on it for example:

# tcpdump -i eth0 vlan 150