Re: IDS 4240 IP Logging question

HEATH FREEL · ‎05-19-2005

Hi, I am using the IP Logging feature and have saved the file and used Ethereal to view it. Every time I open the file in Ethereal I get a message about the file being corrupt. I will usually give me the first 5 or 6 packets and then is says that the packet size is over the maximum of 65535.

I am using Etherral version 10.6

Can anyone give me some help on this?

Thanks,

brhamon · ‎05-19-2005

A number of defects in the protocol dissectors in Ethereal 0.10.10 and earlier were recently reported. As a first step, please upgrade. I have been using 0.10.11 with success.

Also, I do not know whether you are using IDSv4 or IPSv5. My examples are from 5.0(2).

Next, how are you getting the IP logs to the host where you are running Ethereal?

When I work in the CLI, I copy the iplogs off to a nearby Unix host running an SSH server using the following command:

copy iplog 1966115 scp://user@10.1.2.3/iplog-1966115.pcap

Next I use WinSCP to bring that file over to my PC where I analyze them in Ethereal.

HEATH FREEL · ‎05-20-2005

Thanks for the reply. I upgraded to Ethereal 10.11 and still get the same errors. I am using IPSv5 - 5.0(1) and I download using the GUI straight to my desktop and then open the file in Ethereal.

I would think that the process in which I download would be the issue, but stranger things have happened.

brhamon · ‎05-23-2005

I suspect that Internet Explorer is modifying the file as it is being downloaded. Here is a technique you can use that should work around the problem:

1) Log into the IPS CLI and issue the "iplog-status" command. Make a note of the "Log ID" for the IP Log you want to view.

2) Install and launch Mozilla Firefox 1.0.4. http://www.mozilla.org/products/firefox/

3) Type the following URL into the location text box in Firefox. Substitute your sensor's IP address and the Log ID from step 1 above:

https://10.1.2.3/cgi-bin/iplog-server?ipLogId=1566828

Note: the default IPS sensor setting is to have TLS enabled and the web server listening on port 443. If you have changed either of these settings, you will need to make corresponding changes to the URL above.

4) Accept the X.509 certificate after confirming its fingerprint.

5) Choose "save to disk" when prompted.

6) After file download is complete, locate the file "iplog-server" in the download directory (the Firefox default is to save it on the desktop) and rename it to "iplog-1566828.pcap". (Substitute your actual Log ID.)

7) Double-click on the file to open in Ethereal.

If the file is not corrupted by this process, then we have isolated the problem. Next try running IDM from Firefox. Follow your usual procedure for downloading the IP log file. If this works, the problem is definitely in Microsoft Internet Explorer.

If, however, when running IDM from Firefox, the log is corrupted, then the problem might be in IDM and we need to know about it. Please respond with your results.

BONUS:

The IP Log server accepts the parameter "index" and produces hyperlinked results. Just substitute your sensor's IP address in the following URL:

https://10.1.2.3/cgi-bin/iplog-server?index

HEATH FREEL · ‎05-24-2005

That did it. I would never of expected IE to be the issue. Thanks for all the help.