Scapy - examples / usage

A customer asked me at some point if we could evaluate how the CoPP DDOS automated filters on a Juniper MX are triggered and how fast they respond to different types of packets. As such I needed to craft custom traffic. I was not very good at coming up with it for Ostinato or Spirent so I used Scapy to craft the packet. Afterward I took the packet hexdump and input it into Spirent / Ostinato as what the streams from there should generate (that hexdump has indeed all data needed, source/dst addresses included which meant of course that it needs to match what Spirent thinks it has on the interface facing the Juniper device).

Examples of generated packets:

  • OSPFv3 IPSEC Encrypted Packets
  • BGP Open Packet
  • BGP IPv6 Open Packet
  • IPSEC ESP Packet
  • BGP Update Packet
  • ICMP Echo Request
  • BFD echo

Continue reading

This article means to show a simple way to create custom Firewall Tags for the new Contrail Security concept, apply them to an element (Virtual Network or Virtual Machine Interface == Neutron Port), create a Firewall rule that uses them, attach that rule to a Firewall Policy.

A few theoretical steps:

  • create custom tag + value
  • attach custom tag + value to port (VMI/Neutron Port)
  • read default policy management ID
  • create firewall rule attached to parent = default policy management ID
  • update firewall policy with the previously created firewall rule

This assumes that later we will map (not present in this article) the firewall policy to the Default Application Policy. To eliminate a bit the confusion, Juniper’s Contrail Security has the following structure:

  • Application policy
    • Default Application Policy = applies everywhere -> we map here 1 or More Firewall Policies
    • Custom Application Policy = applies mentioned Firewall Policies just to the elements (VNs/VMIs/Project/etc) where we put the matching application tags
  • Firewall policy List of firewall rules that apply.
  • Firewall rules

Continue reading

Gef

If any of you have played around with the Offensive Security certifications, then for sure you have discovered that they are quite creative and that the people administering them want to make you think by yourself with as little help as possible.
One of their courses, CTP (Cracking the Perimeter), even requires you to hack into a website, retrieve a code, decipher how to get a secret key and only then can you proceed with the registration which checks that you managed to fetch these values.
Without giving a way the challenge, I can only say that working with GDB is needed for the final tests and that I, being lazy, installed a plugin for it called GEF so that I could trace what happens with the registers and have the information visually displayed all the time.

Continue reading

Author's picture

Mihai Tanasescu

Network, Security, Servers, Openstack, Openshift. If there’s anything new and cool, then I like to learn about it. I’m also a fan of deep diving under the hood of a product to see what makes it tick, what leftovers from programming make it break and how it does its stuff.

SE @ Cisco

Switzerland