Hi. This is Angela Horneman of the SEI's Situational Awareness team. I've generated service specific network flows to use as baseline examples for network analysis and am sharing them since others may find them helpful.

We have been looking at implementing Network Profiling in Analysis Pipeline to automatically generate lists of active servers and to alert when new IPs start acting as servers. As part of this initiative, we started looking at alternatives to using flags in the identification process, since not all collection methods capture TCP flag data. In this process, I looked for example network flows for verified services.

I found pcaps and some network flows that probably had the examples of the services, but I didn't find any network flows explicitly for most of the services we are profiling. Because of that, I generated my own examples and am sharing them since I am sure others will find them helpful. Stay tuned since further developments related to profiling methods should be coming in the near future.

I generated flows for TELNET, FTP, PPTP, DNS, HTTP, SSH, and NTP as services we are working to profile. For each TELNET, FTP, PPTP, DNS, and SSH, the servers were configured on a Fedora LinuxVM, equipped with YAF and SiLK. I generated flows with a Fedora Linux box as the client, and I repeated this with a Windows 7 Enterprise box as the client for most services. Flow fields in the examples are as seen in SiLK.

The examples appear below. Do you have samples of other services or do you access these services with other operating systems? If so, please share! Reach us online at http://www.cert.org/netsa/contact.cfm.

OpenSSH server, accessed with ssh command. Server is 10.10.0.1.

Client logged in, listed the directory, and then exited.

OpenSSH server, accessed with Putty. Server is 10.10.0.1.

Client logged in, listed the directory, and then exited.

Accessed with telnet command. Server is 10.10.0.1.

Client logged in, listed the directory, and then exited.

Accessed with Putty. Server is 10.10.0.1.

Client logged in, listed the directory, and then exited.

VSFTP server, accessed with ftp command. Server is 10.10.0.2.

Client logged in, listed the directory, and then exited.

Flow 1 is command channel. Flow 2 is data channel.

VSFTP server, accessed with ftp command. Server is 10.10.0.2.

Client logged in, listed the directory, and then exited.

Flow 1 is command channel. Flow 2 is data channel.

VSFTP server, accessed with cURL. Server is 10.10.0.2.

Client logged in, checked the current path, listed the directory, and then exited.

Flow 1 is command channel. Flow 2 is data channel.

Created connection with pppd call pptpserver command. Server is 10.10.0.2.

Client created connection and then closed connection. Client closing connection did not immediately close the flow.

Used Network and Sharing Center to create a connection. Server is 10.10.0.2.

Client created connection and then closed connection. Client closing connection did not immediately close the flow.

Generated with ping command. Server is 10.10.0.2.

Client pinged google.com.

Generated with ping command. Client is 10.10.0.1.

Client pinged google.com.

Accessed with cURL. Client is 10.10.0.1.

Client got www.cmu.edu.

Accessed with cURL. Client is 10.10.0.1.

Client got www.cmu.edu.

Client is 10.10.0.1.

Client automatically checked time. Note: Both client and server used port 123, instead of client using an ephemeral port.

Client is 10.10.0.1.

Client automatically checked time. Received unreachable message.