Hello, I'm new here. I've been using wireshark more and more recently to help with diagnose industrial automation protocol issues. Currently, I'm running dumpcamp on a ring keeping 30days worth of data in 50M files. What I really need to do is find a way to trigger a notification if a certain type of packet is found during the live scan. This specific network is using Profinet. I'm looking for a precursor that tends to indicate the network is having issues. I find these precursor events with the PN_DCP filter in Wireshark. How could I use some variation of the script above to alert upon seeing one of these frames? Would it be possible to create some sort of counter to indicate the amount of times a pn_dcp frame has been seen? Of course, I don't want to really launch notepad, but some other application that could be used as an alert to the problem. I tried run this script, but it doesn't seem to work. Am I doing something wrong?
The test.bat file is the following:
Any help you may be able to offer would be greatly appreciated! asked 29 Mar ‘17, 09:31 profiteam edited 29 Mar ‘17, 10:11 |
One Answer:
Alerting is usually best done with a deep packet inspection tool, e.g. an IDS. You can use Snort or Suricata to create a rule that triggers an alert an whatever pattern you need to look for. In your situation I'd probably go and install a capture PC with the SecurityOnion live distribution, which can capture full packet data while also matching Snort rules. That way you can check alerts for your custom pattern and then grab the relevant packets from the PCAPs. The only problem would be to define the pattern you are looking for, but depending on how complex it is, a Snort filter is probably not that hard to create. answered 30 Mar '17, 14:56 Jasper ♦♦ |
If you can figure out how to convert the “pn_dcp” display filter into a capture filter, then you might be able to make use of the
dumpcap.bat
file available for download on the Wireshark Tools wiki page. The batch file uses mailsend to send an e-mail notification when a particular event occurs (or when a certain number of those events occur). It does not work with display filters though, only capture filters.