]]> http://www.aaviso.com/archives/27/feed http://www.aaviso.com/archives/26 http://www.aaviso.com/archives/26#comments Mon, 31 Dec 2007 01:22:08 +0000 klard http://www.aaviso.com/archives/26 I have completely switched focus in the last year from primarily development to security. That being said I have been struggling with getting snort to run on a gigabit ethernet tap. I compiled pf ring into a redhat kernel on a quad core 64 bit Opteron platform. While the platform and the network interface can keep up snort is really struggling to keep up.
In an effort to find out what snort is doing I enabled the performance monitor but had a darned struggle figuring out exactly what was being logged in Snort 2.8.1. The fields are defined in perf-base.c in the snort code but I have taken the liberty of copying and pasting them here to possibly save someone some time.
I will post later on the steps to get pf ring runnign on a 64 bit platform.

* unixtime(in secs since epoch)
* %pkts dropped
* mbits/sec (wire)
* alerts/sec
* K-Packets/Sec (wire)
* Avg Bytes/Pkt (wire)
* %bytes pattern matched
* syns/sec
* synacks/sec
* new-sessions/sec (tcp stream cache)
* del-sessions/sec (tcp stream cache)
* total-sessions open (tcp stream cache)
* max-sessions, lifetime (tcp stream cache)
* streamflushes/sec
* streamfaults/sec
* streamtimeouts
* fragcreates/sec
* fragcompletes/sec
* fraginserts/sec
* fragdeletes/sec
* fragflushes/sec
* current-frags open (frag cache)
* max-frags (frag cache)
* fragtimeouts
* fragfaults
* num cpus (following triple is repeated for each CPU)
* %user-cpu usage
* %sys-cpu usage
* %idle-cpu usage
* mbits/sec (wire)
* mbits/sec (ip fragmented)
* mbits/sec (ip reassembled)
* mbits/sec (tcp stream rebuilt)
* mbits/sec (app layer)
* Avg Bytes/Pkt (wire)
* Avg Bytes/Pkt (ip fragmented)
* Avg Bytes/Pkt (ip reassembled)
* Avg Bytes/Pkt (tcp stream rebuilt)
* Avg Bytes/Pkt (app layer)
* K-Packets/Sec (wire)
* K-Packets/Sec (ip fragmented)
* K-Packets/Sec (ip reassembled)
* K-Packets/Sec (tcp stream rebuilt)
* K-Packets/Sec (app layer)
* Pkts recieved
* Pkts dropped
* Blocked-KPackets (wire)
* udp-sessions
* max-udp-sessions
* del-udp-sessions/sec (udp stream cache)
* new-udp-sessions/sec (udp stream cache)
* max-sessions, interval (tcp stream cache)
* curr-tcp-sessions-initializing (tcp stream cache, of total-sessions open)
* curr-tcp-sessions-established (tcp stream cache, of total-sessions open)
* curr-tcp-sessions-closing (tcp stream cache, of total-sessions open)
* tcp-sessions-mistream/sec (tcp stream cache, of new-sessions/sec)
* tcp-sessions-closed/sec (tcp stream cache, of del-sessions/sec)
* tcp-sessions-timedout/sec (tcp stream cache, of del-sessions/sec)
* tcp-sessions-pruned/sec (tcp stream cache, of del-sessions/sec)
* tcp-sessions-dropped_async/sec (tcp stream cache, of del-sessions/sec)
* hosts in attribute table
* attribute table reloads

Install Expat from here
Install the XML::Parser from CPAN like soo “cpan install XML::Parser”
Install the libmysqlclient-dev from apt “apt-get install libysqlclient-dev”
Install DBD::mysql from CPAN “cpan install DBD::mysql”

Then you have to modify the nagios commands.cfg by adding

define command{
command_name check_mysql
command_line $USER1$/check_mysql -H $HOSTADDRESS$ -u $ARG1$ -p $ARG2$
}

And modify the localhost.cfg with the service check info

define service{
use local-service
host_name blah
check_command check_mysql!USERNAME!PASSWORD
service_description MYSQL
}

   Once you get the headers installed and of course you have downloaded vmware the you have to install all the packages vmware requires.

sudo apt-get install linux-headers-`uname -r` build-essential xinetd

Then try

sudo ./vmware-install.pl

which will fail with a vmmon error along the lines of “make: *** [vmmon.ko] Error 2
make: Leaving directory `/tmp/vmware-config4/vmmon-only’ Unable to build the vmmon module.”

To fix this download the VMWare any any update from here and run the runme.pl. When it asks if you want to run configure type yes. This will over come the vmmon error and you will be all set.

The bigger issue is how to fix it. There are some instructions here about downloading the vpnc source and making a change. However, you have to enable “universe” in /etc/apt/sources.list in order to get the source. Then of course there was some problem trying to update the rules in binary and I kept getting this error “make: dh_testdir: Command not found” which I never was able to overcome. Then for awhile I tried to dpatch the source as it appears there is a patch included in the source, which of course there are no friggin instructions on how to do it. In the end I removed vpnc 0.4.0 and reinstall vpnc 0.3.3 using this package, with the caveat that I need to watch my updates and make sure 0.3.3 doesn’t get overwritten until it is fixed.

What a cluster. I consider myself reasonably well versed in some of this stuff, I cannot imagine a regular user trying to overcome the hurdles that are put out there even with the most user friendly distributions.

Just to give you an idea of what I am talking about let me give you some information to support my assertion. My data suggests that pure online lead generation accounts for approximately 25% of sales, note that we are on the first page for our primary keyword “(city) real estate” for a google search and we also rank very well for a plethora of other keyword phrases…so I am talking about a well developed site with good optimization and good backlinks. To get that 25% of sales we spend 40% of our total marketing budget on things like hardware, software, hosting and on occasion outside development (which by the way is very expensive and only worthwhile for targeted projects). This 40% does not account for any outlay for inside development work, if inside development was factored the ROI would be considerably lower.

Traditional marketing efforts including post cards, magazines, newsletters etc account for approximately 35% of total sales for the company. These efforts may also factor in to online efforts from the standpoint that a postcard may drive traffic to the website that may eventually turn into a sale. These types of sales are very difficult to track back to post cards and we are working on ways to more closely track this data including using tracking numbers on post cards so that when the user visits the website they can be associated with the postcard instead of being labeled a “direct visit”, once again Google Anayltics will help tremendously with this effort. The 35% of sales generated by traditional marketing accounts for another 40% of our marketing budget.

The other 20% of our marketing budget accounts for 40% of sales…you might be wondering what this could possibly be. Marketing to past clients. It’s pretty simple, marketing to past clients is fairly cheap but generates a significant portion of sales, we simply send them cards and magazines bi-monthly and their additional sales and referrals help the bottom line by 40%.

The bottom line….despite what lead generation websites and email spam tell you, having a balanced marketing plan is the best way to spend your dollars. Also, unless you are going to go all out and spend $12,000/year or more on a website, do not bother with these guys that are going to “get you leads” for $49 dollars to start and $50/month. Your website will be invisible to anyone not looking for you specifically, what I mean is it will not be found in a search for anything meaningful. If you just want to have a web presence find a real estate template and throw something up on a $9.95/month hosting plan and walk away. Thanks for tuning in.

The html code that adds the radio buttons and calls the javascript:
<form method="get">
<p align="left">Rent Less Than</p>
<ul class="formlist">
<li class="rent"><label><input type="radio" value="1000" name="radios" />
onclick="return radioClick (event)" /> $1000</label></li>
<li class="rent"><label><input type="radio" value="1500" name="radios" />
onclick="return radioClick (event)" /> $1500</label></li>
<li class="rent"><label><input type="radio" value="2000" name="radios" />
onclick="return radioClick (event)" /> $2000</label></li>
<li class="rent"><label><input type="radio" value="100000" name="radios" />
onclick="return radioClick (event)" /> Any</label></li>
</ul>
<input type="hidden" disabled="disabled" size="10" class="notify" name="notify" id="notify" />
</form>

And the javascript that handles the event (reminder this is placed outside the onload function)
function radioClick(e) {
var obj = eventTrigger (e);
var notify = document.getElementById &&
document.getElementById ('notify');
if (notify)
rent = obj.value;
getMarkers();
return true;
}
function eventTrigger (e) {
if (! e)
e = event;
return e.target || e.srcElement;
}
After that it is just a matter of adding the rent number back to the query and adding thatas part of the mysql query.

You can see all the code by going to Orlando Rentals and viewing the source.