Juniper防火墙下抓包方法

作者：易隐者发布于：2012-3-16 17:44 Friday 分类：参考资料

debug flow basic

       相对于其他防火墙而言，Juniper防火墙提供许多有效的查错工具，其中之一就是debug flow basic，应用方式举例如下:
1. 先设置过滤列表，使得防火墙只对需要的数据包进行分析. 即set ffilter命令:
ns208-> set ffilter ?
dst-ip      flow filter dst ip
dst-port    flow filter dst port
ip-proto    flow filter ip proto
src-ip       flow filter src ip
src-port    flow filter src port
=DBtZ|~4f@
ns208-> set ffilter src-ip 192.168.1.10
filter added
ns208-> get ff
Flow filter based on:
id:0 src ip 192.168.1.10
ns208-> set ffilter src-ip 192.168.1.11
filter added
ns208-> get ff
Flow filter based on:
id:0 src ip 192.168.1.10
id:1 src ip 192.168.1.11
看出来了吗? 设置两次ffilter的结果是两个过滤列表之间是OR的关系. 如果直接设

set ffilter src-ip 192.168.1.11 dst-ip 194.73.82.242 就是AND的关系了.
2. 开启debug
ns208-> debug flow basic
3. 发送测试数据包或让小部分流量穿越防火墙
4. 停止debug
ns208-> undebug all
5. 检查防火墙对所转发的符合过滤条件的数据包的分析结果: }
ns208-> get db stream
****** 12553.0: packet received [60]****** Packet arrived on the eth1 interface tF(UJO xk
ipid = 29503(733f)， @d7806910 IP id
packet passed sanity check. I rbyB6. ¬
ethernet1:192.168.1.10/1280->194.73.82.242/512，1(8/0) Src IP， Port， Dst IP， port incl Protocol 1
chose interface ethernet1 as incoming nat if. Int eth1 is placed in NAT mode s<`Nxz@0
search route to (192.168.1.10->194.73.82.242) in vr trust-vr for vsd-0/flag-0/ifp-null Route lookup in trust-vr
route 194.73.82.242->1.1.1.2， to ethernet3 route found to gateway 1.1.1.2 exiting interface int eth3
routed (194.73.82.242， 0.0.0.0) from ethernet1 (ethernet1 in 0) to ethernet3 packet routed
policy search from zone 2-> zone 1 Policy lookup performed from Trust (2) to Untrust (1)
Permitted by policy 3 matched policy ID 3
choose interface ethernet3 as outgoing phy if choose physical interface eth3
no loop on ifp ethernet3. r4Ok(8f6¬D
session application type 0， name None， timeout 60sec session time created as 60 seconds for ICMP
service lookup identified service 0. service lookup performed
existing vector list 1-559ef00.
Session (id:76) created for first pak 1 Create session with ID 76
route to 1.1.1.2 Routed packet to 1.1.1.2
arp entry found for 1.1.1.2 Already had ARP entry for 1.1.1.2
nsp2 wing prepared， ready
cache mac in the session Cached MAC address in the session
flow got session.
flow session id 76
post addr xlation: 1.1.1.1->194.73.82.242. Translate src address to egress interface IP
packet send out to 0010db103041 through ethernet3 Packet sent out on the wire
6. 清除防火墙缓存的debug结果:
ns208-> clear db
7. 清除防火墙的过滤设置
ns208->unset ffilter 0
ns208->get ffilter

Snoop

        Snoop 是Juniper防火墙另外一个有效的查错工具，它和debug flow basic的区别是: snoop类似于在防火墙的接口上抓包，可以根据具体接口，数据包的方向，协议等等要素进行过滤抓包; debug flow basic则对数据包如何穿越防火墙进行分析，将防火墙的对数据包的处理过程显示出来. Snoop的使用举例如下: 1. 先设置过滤列表，使得防火墙只对需要的数据包进行分析. 即snoop filter命令:
ns208-> snoop filterdelete          delete snoop filter >
ethernet        snoop specified ethernet
id            snoop filter id |
ip            snoop ip packet ?YcG
off            turn off snoop filter dwjYU\on            turn on snoop filter
tcp            snoop tcp packet udp            snoop udp packet 7

ns208-> snoop filter ip
direction        snoop direction
dst-ip          snoop filter dst ip dst-port        snoop filter dst port
interface        interface name
ip-proto        snoop filter ip proto a port          src or dst port Pv
src-ip          snoop filter src ip 1)TEIsrc-port        snoop filter src port
    IPv4 Address
offset          ip offset UqDqF
ns208-> snoop info
Snoop: OFF
Filters Defined: 2， Active Filters 2
Detail: OFF， Detail Display length: 96 EE
Snoop filter based on: id 1(on): IP dir(I) qc
id 2(on): IP dst-ip 172.27.68.1 dir(B) :WdL
RHtx3{S/
2. 开启snoop 进行抓包 YC
ns208-> snoopStart Snoop， type ESC or 'snoop off' to stop， continue? [y]/n y
3. 发送测试数据包或让小部分流量穿越防火墙
4. 停止snoop ns208-> snoop off
5. 检查防火墙对所转发的符合过滤条件的数据包的分析结果(非采用上面的filter，而是采用另外的filter):
ns208-> get db stream 5Y =M <ZEC&NBSP; q#I>m¬u=JJ
          1.    The packet comes into the Netscreen from the Trusted side client.            55864.0: 0(i):005004bb815f->0010db00ab30/0800    D *MoEd
            10.0.0.36->10.10.10.14/1， tlen=60    vhl=45， id=31489， frag=0000， ttl=32
          2.    The packet then leaves the Netscreen， on it’s way to the destination host.      55864.0: 1(o):0010db00ab31->00104bf3d073/0800            10.10.10.10->10.10.10.14/1， tlen=60 uS
            vhl=45， id=31489， frag=0000， ttl=31 r
          3.    The packet then returns to the Netscreen from the host. &W          55864.0: 1(i):00104bf3d073->0010db00ab31/0800 |_+% 'XtU
              10.10.10.14->10.10.10.10/1， tlen=60 |yxLm              vhl=45， id=12289， frag=0000， ttl=128
          4.    Finally， the packet is returned to the client on the trusted side. -
          55864.0: 0(o):0010db00ab30->005004bb815f/0800 4 /W|~=y            10.10.10.14->10.0.0.36/1， tlen=60
            vhl=45， id=12289， frag=0000， ttl=127 6，19usXw:M
6. 清除防火墙缓存的debug结果:ns208-> clear db W7. 清除防火墙的snoop过滤设置
ns208-> snoop filter delete
All filters removed