Problem description
This gives the procedure to capture packets and sftp it to U2000. This procedure is helpful in situations such as:
- When an attack is observed on a port on a router and packets needs to be captured for further analysis.
- Packets drops are experienced for a service and further deep dive needed to understand how those packets are handled when they enter or leave the router ports.
- Deep dive to understand why a newly configured service is not going through.
- Investigate if there is a Layer 2 or a Layer 3 loop after analysis a packet capture.
Below, we will focus our attention on the capturing of packets when an attack happens on a router port which we will term “Procedure of blackhole”
Below is an example of graph showing an unusual traffic received on the port of a router which gives suspicion of an attack.
Handling Process for Procedures of blackhole
When you see the continuous attacking traffic chocking on one port, for example inbound traffic on the port GiX/Y/Z of a router, you need to capture the packet of the inbound traffic (you need to capture the outbound if the attacking traffic is on the outbound direction of the port) and then sftp it to U2000. Below is a step-by-step process on how to go about it:
STEP 1 : Capture the packets using the command below and save on using a file name with extension *.pcap:
#
capture-packet forwarding interface GigabitEthernet x/y/z inbound time-out 36000 packet-num 1000 packet-len 64 file filename.pcap
#
STEP 2 : Check the packet capture status by issuing the command below
#
display capture-packet information
#
This will help confirm if you already capturing packets or not.
STEP 3 : In step 2 above, when you see the “instance saved packet number” is 1000, use below command to release the capturing task
#
undo capture-packet forwarding interface GigabitEthernet x/y/z inbound
#
capture-packet free all
#
The above 3 steps were to capture the packet. The following steps below are to SFTP the captured packets to the U2000.
STEP 4 : Define the path of the captured packets on the router by using the command below :
#
cd cfcard2:/capture
#
View the directory to confirm captured file is present.
#
Dir cfcard2/:
#
STEP 5 : SFTP the captured packets to the U2000 Server.
#
System-view
sftp U2000_Server_IP
#
Username is “root”, password is “*************”
binary
#
put filename.zip
#
STEP 6 : Download captured packets to PC and confirm the attacking packet and ip with WiresharkCreate the session of U2000. Username is “root”, password is “***********”
Open the U2000 session and choose your local disk C, right click the captured file and download to your local disk C.
You now successfully have the *.pcap file on your PC which you can use any packet analyzer such as wireshark to analyze the packets.
