1
1
I'm trying to do deep packet inspection on HTTP packets. The purpose of this is to collect HTTP payload data and then create some proxy/cache-independent reports. Following this, the idea is to develop specific proxy/cache plug-ins (e.g. Squid) to use the reports.
I'm using the following testing scenario (VirtualBox machines, all machines are CentOS 6.3):
ROUTER:
Interfaces:
eth0 connected to 192.168.1.0/24 network (ip 192.168.1.10)
eth1 connected to 192.168.2.0/24 network (ip 192.168.2.20)
eth2 connected to 192.168.3.0/24 network (ip 192.168.3.30)
eth3 Internet access
PC1 (deep packet inspection - DPI PC):
Interfaces:
eth0 connected to 192.168.1.0/24 network (ip 192.168.1.1)
HTTP requests from PCs in 192.168.2.0 and 192.168.3.0 networks are marked with iptables and then routed to DPI PC.
ROUTER iptables script:
#ALL CHAINS POLICY = ACCEPT
# DPI PC IP
IP_DPI=192.168.1.1
# Interface to reach DPI PC from router
IF_DPI_OUT=eth0
# Internet access interface
IF_MASQ=eth3
# Flush everything
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle -X
# Zero counters
iptables -Z
iptables -t nat -Z
iptables -t mangle -Z
# Enable MASQUERADING
iptables -t nat -A POSTROUTING -s 192.16.1.0/24 -o $IF_MASQ -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -o $IF_MASQ -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.3.0/24 -o $IF_MASQ -j MASQUERADE
### HTTP packets redirection
# Mark HTTP packets
iptables -t mangle -A PREROUTING -p tcp --dport 80 -m state --state NEW -s 192.168.2.0/24 -i eth1 -j MARK --set-mark 7
iptables -t mangle -A PREROUTING -p tcp --dport 80 -m state --state NEW -s 192.168.3.0/24 -i eth2 -j MARK --set-mark 7
# Create routing table named "http_redirect"
echo 202 http_redirect >> /etc/iproute2/rt_tables
# Marked packets use "http_redirect" table
ip rule add fwmark 7 table http_redirect
# Sent packets to DPI PC
ip route add default via $IP_DPI dev $IF_DPI_OUT table http_redirect
# Flush route cache
ip route flush cache
In DPI PC I do the same thing, packets are redirected to Router again:
DPI PC iptables script:
#ALL CHAINS POLICY = ACCEPT
IP_ROUTER=192.168.1.10
IF_ROUTER_OUT=eth0
# Flush everything
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle -X
# Zero counters
iptables -Z
iptables -t nat -Z
iptables -t mangle -Z
### HTTP packets redirection
# Mark HTTP packets
iptables -t mangle -A PREROUTING -p tcp --dport 80 -i eth0 -j MARK --set-mark 7
# Create routing table named "http_redirect"
echo 202 http_redirect >> /etc/iproute2/rt_tables
# Marked packets use "http_redirect" table
ip rule add fwmark 7 table http_redirect
# Sent packets back to ROUTER
ip route add default via $IP_ROUTER dev $IF_ROUTER_OUT table http_redirect
# Flush route cache
ip route flush cache
Using iptables log I see that only the first packet (packet with SYN on) is redirected from ROUTER to DPI PC, and from DPI PC back to ROUTER, but once the packet gets ROUTER again it doesn't get routed through eth3 (Internet access). Then a new packet with SYN on and ID=previous_ID+1 is generated and the steps are repated again.
With the following on a local PC (ip 192.168.3.3):
wget www.yahoo.com
Log of DPI PC:
Jan 8 19:29:03 localhost kernel: D:IN:eth0:HTTP:d80: IN=eth0 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=48079 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139AFDB0000000001030305)
Jan 8 19:29:03 localhost kernel: D:IN:eth0:MARK-1.0 IN=eth0 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=48079 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139AFDB0000000001030305)
Jan 8 19:29:03 localhost kernel: D:OUT:eth0:HTTP:d80: IN= OUT=eth0
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=48079 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139AFDB0000000001030305) MARK=0x7
Jan 8 19:29:04 localhost kernel: D:IN:eth0:HTTP:d80: IN=eth0 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=48080 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139B3C30000000001030305)
Jan 8 19:29:04 localhost kernel: D:IN:eth0:MARK-1.0 IN=eth0 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=48080 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139B3C30000000001030305)
Jan 8 19:29:04 localhost kernel: D:OUT:eth0:HTTP:d80: IN= OUT=eth0
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=48080 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139B3C30000000001030305) MARK=0x7
Jan 8 19:29:06 localhost kernel: D:IN:eth0:HTTP:d80: IN=eth0 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=48081 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139BB930000000001030305)
Jan 8 19:29:06 localhost kernel: D:IN:eth0:MARK-1.0 IN=eth0 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=48081 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139BB930000000001030305)
Jan 8 19:29:06 localhost kernel: D:OUT:eth0:HTTP:d80: IN= OUT=eth0
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=48081 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139BB930000000001030305) MARK=0x7
Log of ROUTER:
Jan 8 19:28:48 localhost kernel: R:IN:eth2:HTTP:d80: IN=eth2 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48079 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139AFDB0000000001030305)
Jan 8 19:28:48 localhost kernel: R:IN:eth2:MARK-3.0 IN=eth2 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48079 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139AFDB0000000001030305)
Jan 8 19:28:48 localhost kernel: R:OUT:eth0:HTTP:d80: IN= OUT=eth0
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=48079 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139AFDB0000000001030305) MARK=0x7
Jan 8 19:28:48 localhost kernel: R:IN:eth0:HTTP:d80: IN=eth0 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=48079 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139AFDB0000000001030305)
Jan 8 19:28:49 localhost kernel: R:IN:eth2:HTTP:d80: IN=eth2 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48080 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139B3C30000000001030305)
Jan 8 19:28:49 localhost kernel: R:IN:eth2:MARK-3.0 IN=eth2 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48080 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139B3C30000000001030305)
Jan 8 19:28:49 localhost kernel: R:OUT:eth0:HTTP:d80: IN= OUT=eth0
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=48080 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139B3C30000000001030305) MARK=0x7
Jan 8 19:28:49 localhost kernel: R:IN:eth0:HTTP:d80: IN=eth0 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=48080 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139B3C30000000001030305)
Jan 8 19:28:51 localhost kernel: R:IN:eth2:HTTP:d80: IN=eth2 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48081 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139BB930000000001030305)
Jan 8 19:28:51 localhost kernel: R:IN:eth2:MARK-3.0 IN=eth2 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48081 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139BB930000000001030305)
Jan 8 19:28:51 localhost kernel: R:OUT:eth0:HTTP:d80: IN= OUT=eth0
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=48081 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139BB930000000001030305) MARK=0x7
Jan 8 19:28:51 localhost kernel: R:IN:eth0:HTTP:d80: IN=eth0 OUT=
SRC=192.168.3.3 DST=200.152.175.146 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=48081 DF PROTO=TCP SPT=49268 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405B40402080A0139BB930000000001030305)
Packet with ID=48079:
1. Gets to ROUTER's eth2 from host 192.168.3.3
2. Gets marked with 0x7
3. Gets routed to DPI PC via ROUTER's eth0
4. Gets to DPI PC's eth0 (incoming)
5. Gets marked with 0x7
6. Gets routed back to ROUTER via DPI PC's eth0 (outgoing)
7. Gets back to ROUTER's eth0
(packets doesn't get routed through eth3 and the steps are repeated again, with a new packet with ID=48080)
Deep packet inspection is intended to be done between steps 4-6 once this schema works.
Packets necesarilly have to be routed from ROUTER TO DPI PC and from DPI PC back to ROUTER because later I'll use Squid on DPI PC.
I'd appreciate anyone orientation,
Thanks in advance
Tucano
Posted 2013-01-09T01:36:06.217
Reputation: 11
