Ourmon: Network Monitoring and Anomaly Detection System


introduction

Ourmon is an open-source network management and anomaly detection system. It collects data using both multiple instances of the Berkeley Packet Filter, and also various hashed top N lists and then displays the data using RRDTOOL graphs, histograms, and perl reports. Data is produced in near realtime every thirty seconds. Hourly reports are also produced from some of the top N lists and summarized on a daily basis, giving approximately one week of summarized logging reports. Ourmon is customizable and allows the user to create his or her own graphs by grouping BPF expressions (as used in tcpdump) into RRDTOOL-style graphs. It provides graphs, logging, and reports concerning various kinds of flow lists including conventional IP flows, top N syns, top N ports, ICMP and UDP errors, and syn scanners including 1-N ip src to ip dst, and 1-N ip src to L4 ports. It also provides information about coordinated attacks and various kinds of worms.

Ourmon runs on Linux and FreeBSD. This page updates every thirty seconds with fresh information. A copy of this page that does NOT update every 30 seconds may be found here:

static index page .

For more information see the

technical info page ,

Current samples of "ourmon" (rmon-like) data from your core network are shown below in graphs and reports. Ourmon output is roughly organized as a high-level web page that shows "current" graphs, and second-level web pages that provide more information on a given filter. See the technical info page for more information.


quick jump directory

important security and availability reports/web pages
portreport.txt (tcp worm info) tcpworm.txt (detailed tcp worm info) event log for today (front-end events) new port signatures (TCP scanners) for today p2p and irc host port report irc stats page
udpreport.txt (udp-based worm info) top udpreport weight graph weekly event logs/tcpworm summarization last time run probe #1 mon.lite icmp codes cheatsheet

main page sections
pkts/drops bpf-protocols bpf-errors topn reports topn tcpsyn tcpworm icmperrors udperrors topn-ports scanning

basic network information

help/probe #1 pkts/drops:

Major IP Protocols bits/sec:

Major IP Protocols pkts/sec:

L2 unicast/multicast/broadcast bits/sec:

L2 protocol types pkts/sec:

L2 packet size distribution pkts/sec:


protocol and subnet statistics

news versus web traffic plus remainder:

major tcp port traffic:

estimate of p2p traffic based on BPF/ports:

campus email TCP connection count:

VPN traffic


network error graphs:

total campus network errors

total campus ICMP unreachable errors:

total campus TCP control packet counts:


top talker pages (top N, top ports, top syn etc.)


topn_ip flow information

RRDTOOL graph of topn ip basic flow counts (flows/sec):

RRDTOOL graph of topn hash inserts (inserts/30 sec):


top talker (top_n) flows based on IP source


top_n TCP flows


top_n UDP flows


top_n ICMP flows


top TCP syn generating IP sources

The syn scanner filter includes many features including the port signature report and a more detailed version of the port report found below called the "tcpworm.txt" report. We also show the RRDTOOL "worm" activity graph, which shows the total count of TCP syn-sending IP sources that have exceeded a certain baseline threshold. This graph is used to indicate the existance of large (often botnet-controlled) attacks. After that one finds a graph that shows the average work weight for the network as a whole (all hosts), worms, and P2P apps. Last we show the topn_syn histogram which displays the top syn sending hosts. Here is the port signature report (portreport.txt) and its longer cousin (tcpworm.txt).

tcp worm graph:

topn syns generated:



top ICMP and UDP error generators

top ICMP senders:

top udp weight graph

The following graph uses a weighted scheme to show which particular IP source is generating UDP packets which cause the most ICMP errors. It has two forms: first you may view the information as an ASCII report which has more details. This report is called the udp port signature report . Second, you may view the information in the histogram graph below.

top/current UDP error generators


top TCP and UDP ports

top TCP ports:

top UDP ports:


top scanners

Here we have top talker histograms showing scanning activity. These graphs are all 1 source to many destinations. These include one IP source to many IP destinations, all L4 port sources to L4 destinations (combined TCP/UDP), and specific TCP and UDP port scanning graphs.

One IP src to many IP destinations:

One IP src to many L4 ports (udp or tcp):


TCP Port scanning:

UDP Port scanning:


summarized top talker reports for the day/week

topn_ip flow summarization

Note that the current daily summarization is run hourly "today". Previous days represent the midnight final summarization and thus are daily reports. IP/UDP/ICMP flows are bits/second. Syns are counted per sample period, and sorted by max syn count with total syn count, fin count, and resets shown. The "flow id" for syns is simply an ip address.

today, yesterday, day before yesterday, etc.
today (run hourly) yesterday (run daily) today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days
UDP today (hourly) yesterday (run daily) today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days
ICMP today (hourly) yesterday (run daily) today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days
top syn count today (hourly) yesterday (run daily) today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days


top IP/UDP/ICMP IP src/dst summarization

ip/udp/icmp src today, yesterday, day before yesterday, etc.
today (run hourly) yesterday (run daily) today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days
UDP today (run hourly) yesterday (run daily) today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days
ICMP today (run hourly) yesterday (run daily) today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days
ip/udp/icmp dst today, yesterday, day before yesterday, etc.
today (run hourly) yesterday day (run daily) today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days
UDP today (run hourly) yesterday (run daily) today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days
ICMP today (run hourly) yesterday (run daily) today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days


top TCP port signature (worm) summarizations

all worm port signatures, today, yesterday, etc.
all worms today (run hourly) yesterday (run daily) today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days


weekly event logs

event log, today, and previous days
front-end events for today yesterday today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days


tcpworm/p2p - daily and weekly summarization

portsigs unfiltered
summarization for today (run hourly) yesterday today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days
port 445 summarization
summarization for today (run hourly) yesterday today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days
work weight >= 40
summarization for today (run hourly) yesterday today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days
p2p summarization
summarization for today (run hourly) yesterday today - 2 days today - 3 days today - 4 days today - 5 days today - 6 days today - 7 days today - 8 days