                     Synlog
                     ------

Contents:

1) Introduction.
2) Problems.
3) Porting synlog (internals).

Introduction
------------

  Synlog was written as a diagnostic tool, to constantly keep track of
half open TCP connections on network. Half open connections can result
from numerous circumstances. Anything from a connection failing
because the destination host is unreachable, or a connection giving up
before the initial 3-way handshake is completed.
  It can however, be the result of a "syn scan" or "syn flood". Syn
flooding is when a malicious network entity sends off fake packets
originating from unreachable addresses with the SYN flag set on the
packet. It would appear to the victim that the packets are legitimate
connection requests. The victim then sends back an acknowledgement and
awaits the reply. This "waiting" period can go for some time depending
on the victim in question. Most Operating Systems have a limit of how
many half open connections they can take on a tcp port before not
accepting anymore before the handshake completes or expires. So this
can render a TCP service on a host to be useless for a period of
time. Not accepting any more connections, and not replying at
all. This attack is lethal because it doesnt require alot of packets
to break a TCP service.
  A syn scan however is a stealthy method of tcp port scanning. Here
the attacker attempts to probe your host silently for open tcp
ports. Only the behaviour is more different. In order for the attacker
to "know" if a tcp port is open or not, it sends the syn packet
awaiting for the acknowledgement or denial of connection
acceptance. If a denial is sent the attacker marks the port closed, if
an acknowledgement is sent, the attacker marks it open. Most
conventional connection logging tools require the handshake to finish
to actually log anything, since they run in user space, and can't get
information from the kernel without it finishing the handshake. Synlog
monitors your network rawly, thus not requiring any handshake to
complete.

Problems
--------

Since half open connections are infact an everyday occurance, synlog
can only report them. What the user can do is watch for suspicious
activity by summarizing the logs.
A margin of error exists when packets are lost. Synlog logs the amount
of lost packets if the underlining network tapping API allows it to.

Porting Synlog
--------------

The only non portable part of Synlog is the parse_packet() routine
found in sniff.c It basically attempts to extract the relevant data
from the ip packet and send it back to the storing agent.

I've currently coded support for a 10Mbs/Ethernet network, and PPP
which is probably only limited to FreeBSD 2.1

The data structures I use here may or may not be portable. You'll want
to concentrate on that for any porting you wish to do.

If you want to port it for another link level type, sniff.c is the
only file that requires modification.

Libpcap will hopefully keep the underlining network tapping facility
portable to numerous Operating Systems.

Dont forget to send me the patches!!!!

shadows@whitefang.com
