MARS - TOR Client Monitoring

[jnlawrence76]

I am looking for any recommendations on how to monitor for users using TOR on my network.

Thanks in Advance.

[Scott Fringer · Accepted solution]

CS-MARS relies on external reporting devices to generate incidents, malicious activity and traffic anomaly detection.

Cisco's IPS sensors have two signatures (both enabled by default) that can detect potential TOR traffic:

5816/0 - TOR Client Activity

5816/1 - TOR Client Activity

It may also be possible to write additional custom signatures if additional TOR traffic fingerprinting is available.

With the IPS reporting to CS-MARS, it should be possible to be notified when potential TOR activity is detected on the network.

Scott

[jnlawrence76]

I have that setup, but not getting any reporting on it when I run my TOR client so I am afraid something isn't working properly.

I have IPSs all over my network, but never seem to see any TOR alerts.

[jnlawrence76]

Scott,

Seeing I have this report setup and it runs every 24 hours but not generating any events even though I run TOR from a test box, what could be the problem?  Is it something that needs to be setup differently on the IPS sensors as I am sure its probably not a MARS issue.  Thanks in advance.

[Scott Fringer]

Jeremy;

  As I answered in your post to the IPS community, you will need to verify the TOR traffic your client is generating matches what the two signatures are expecting.  Once the IPS is successfully detecting the traffic, your CS-MARS report should begin providing output.

Scott