| SC_FILTERPOLICY(1) | General Commands Manual | SC_FILTERPOLICY(1) |
sc_filterpolicy —
scamper driver to test systems for congruent filtering
policy
sc_filterpolicy |
[-D]
[-a input-file]
[-l log-file]
[-o output-file]
[-O options]
[-p scamper-port]
[-t host-type]
[-T test]
[-U scamper-unix] |
sc_filterpolicy |
[-r data-file] |
The sc_filterpolicy utility provides the
ability to connect to a running scamper(1) instance and
use that instance to test systems for congruent filtering policy. The
utility tests each system specified in the input file by probing for
application reachability with ICMP, UDP, and TCP probes, using both IPv4 and
IPv6 where applicable. Each system in the input file should have multiple IP
addresses specified; the driver probes each IP address on each system one at
a time to avoid causing the remote system to rate-limit responses.
sc_filterpolicy obtains speed by probing systems in
parallel, though it may appear to operate slowly because no progress is
reported until all addresses belonging to a device have been tested one at a
time.
The applications supported by
sc_filterpolicy to test filtering policy are:
The options supported by sc_filterpolicy
are as follows:
-?-a
input-file-Dsc_filterpolicy will detach
and become a daemon.-l
log-filesc_filterpolicy generated at run time.-o
output-file-O
optionssc_filterpolicy to be
further tailored. The current choices for this option are:
-p
scamper-port-r
data-file-t
probe-class-T
test-U
scamper-unixsc_filterpolicy requires a
scamper(1) instance listening on a port or unix domain
socket for commands in order to collect data:
scamper -P 31337
will start a scamper(1) instance listening on
port 31337 on the loopback interface. To use
sc_filterpolicy to test the filtering policy of a
set of routers specified in a file named routers.txt and formatted as rows
as follows:
foo.example.com 192.0.2.1 2001:DB8::1 bar.example.com 192.0.2.2 2001:DB8::2
the following command will test these routers for responsiveness to ICMP, SSH, Telnet, HTTPS, HTTP, BGP, NTP, DNS, and SNMP probes, recording raw data into example-routers.warts:
sc_filterpolicy -p 31337 -a routers.txt -t router -o example-routers.warts
Including the name of each device in the input file is optional.
The following command will only test the routers for responsiveness to SSH:
sc_filterpolicy -p 31337 -a routers.txt -T +ssh -o example-ssh.warts
To use sc_filterpolicy to test the
filtering policy of a set of servers specified in a file named servers.txt
and formatted as tuples as follows:
db.example.com 192.0.2.3 db.example.com 2001::DB8::3 corp.example.com 192.0.2.4 corp.example.com 2001::DB8::4
the following command will test these servers for responsiveness to ICMP, FTP, SSH, Telnet, MySQL, RDP, HTTPS, SMB, HTTP, NTP, DNS, and SNMP probes, recording raw data into example-servers.warts:
sc_filterpolicy -p 31337 -a servers.txt -t server -o example-servers.warts -O tuples
In an input file formatted as tuples, the name (or an identifier) for each device is mandatory, and is used to ensure only one probe is sent to any one device at a time, and to collate responses from different addresses to the same device for reporting.
Once raw data has been collected,
sc_filterpolicy can be used to analyse the collected
data. For the example-routers.warts file, the following command dumps a
summary of the data collected for each router:
sc_filterpolicy -r example-routers.warts : T : e H : I l T H S : C S n T T B N D N : M S e P T G T N M : P H t S P P P S P ======================================== 192.0.2.1 : O O O O O 2001:DB8::1 : O O O O O 192.0.2.2 : O X 2001:DB8::2 : O O
The first router is responsive (O) for ICMP, SSH, HTTP, DNS, and SNMP probes on all addresses. The second router is responsive (O) to ICMP probes on both addresses is unresponsive (X) to SSH on the IPv4 address, but is responsive (O) to SSH on the IPv6 address and possibly represents a filtering policy that is incongruent and requires attention. Note that the empty cells in the table represent a router that was unresponsive (X) to that protocol for all addresses tested; the cells are left empty to allow the user to focus on open and incongruent application services.
The command:
sc_filterpolicy -O incongruent -r example-routers.warts
will only show routers with an incongruent filtering policy.
J. Czyz, M. Luckie, M. Allman, and M. Bailey, Don't Forget to Lock the Back Door! A Characterization of IPv6 Network Security Policy, Proc. Network and Distributed Systems Security (NDSS) Conference 2016. scamper(1), sc_wartsdump(1), sc_warts2json(1), warts(5)
sc_filterpolicy was written by Matthew
Luckie <mjl@luckie.org.nz> and Jakub Czyz.
| December 2, 2015 | Debian |