ddos_detector.py to monitor DDOS attacks #2140

jugurthab · 2019-01-14T10:05:14Z

Written as a basic networking example of using ePBF to detect a potential DDOS attack against a system

yonghong-song · 2019-01-14T16:36:52Z

[buildbot, test this please]

yonghong-song · 2019-01-14T17:48:11Z

examples/tracing/ddos_detector.py

+// use perf buffer (avoid using /sys/kernel/debug/tracing/trace_pipe)
+BPF_PERF_OUTPUT(events);
+
+int detect_ddos(struct pt_regs *ctx, struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev){


For unused parameters like "pt", you can just do "void *pt" to avoid compilation warning.

yonghong-song

could you correct some format issues? removing unnecessary empty lines, make sure each line at most having 80 characters, removing any trailing spaces, etc? This will make reviews easier. Thanks!

yonghong-song · 2019-01-14T17:52:08Z

also could you change ddos_detector.py to be an executable?

jugurthab · 2019-01-15T08:45:05Z

I have made the changes, thank's a lot for your help.

yonghong-song · 2019-01-16T05:50:30Z

examples/tracing/ddos_detector.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python
+#
+# ddos_detector.py	DDOS dectection system.


pls chmod +x ddos_detector.py.

I have changed permissions and uploaded the file using "upload file option" but seems like this does not keep the permissions.

Okay, we can have a followup patch for this as there are a couple of scripts which need change as well.

yonghong-song · 2019-01-16T05:55:21Z

examples/tracing/ddos_detector.py

+
+/* If We receive more than 100 succesive packets with a difference of */ 
+/* timestamp between each one of them is less than 1000000ns */
+/* Trigger ALERT */


Could you give more explanation when this could be a real case or a false positive? I am assuming detecting a real ddos is more complex than this.

yonghong-song · 2019-01-16T05:58:47Z

examples/tracing/ddos_detector.py

+    struct detectionTimestamp detectionTs = {};
+    // Counts number of received packets
+    u64 rcv_packets_nb = 0, rcv_packets_nb_inter=1, *rcv_packets_nb_ptr;
+    // Measures elapsed time between 2 successive received packets


could you give more description of algorithms here?

Comments were added!

yonghong-song · 2019-01-16T06:00:06Z

examples/tracing/ddos_detector_example.txt

+3 - ddos_detector.py triggers alerts and reports a DDOS attack:
+DDOS detector started ... Hit Ctrl-C to end!
+TIME(s)            MESSAGE
+6714099756390      Attack detected


I think if you can somehow convert this TIME to a human understandable time, it would be great!

yonghong-song · 2019-01-16T06:00:40Z

examples/tracing/ddos_detector.py

+    u64 ts;
+};
+
+// use perf buffer (avoid using /sys/kernel/debug/tracing/trace_pipe)


this comment is not needed.

yes, removed!

jugurthab · 2019-01-16T20:30:45Z

Thank's a lot for your review

yonghong-song · 2019-01-16T21:18:43Z

examples/tracing/ddos_detector.py

@@ -0,0 +1,97 @@
+#!/usr/bin/env python


could you change this to #!/usr/bin/python? Sorry if this is what I suggested. We just formalized that all python script shebang should be #!/usr/bin/python instead of #!/usr/bin/env python.

yonghong-song · 2019-01-16T21:19:31Z

examples/tracing/ddos_detector.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python
+#
+# ddos_detector.py	DDOS dectection system.


Okay, we can have a followup patch for this as there are a couple of scripts which need change as well.

yonghong-song · 2019-01-16T21:20:22Z

examples/tracing/ddos_detector.py

+
+BPF_HASH(rcv_packets);
+
+// define C structure


This comment is not needed.

thank's, I have removed the comment!

yonghong-song · 2019-01-16T21:20:50Z

examples/tracing/ddos_detector.py

+import datetime
+prog = """
+#include <linux/skbuff.h>
+#include <uapi/linux/ip.h>


add an empty line here for readability?

yonghong-song · 2019-01-16T21:28:35Z

examples/tracing/ddos_detector.py

+BPF_PERF_OUTPUT(events);
+
+int detect_ddos(struct pt_regs *ctx, void *skb){
+    struct detectionPackets detectionPacket = {};


An empty line here?

Empty line added!

yonghong-song · 2019-01-16T21:30:44Z

examples/tracing/ddos_detector.py

+    /* (which is not like regular applications behaviour). */
+    /* This script looks for this difference in time and if it sees */
+    /* more than 1000 succesive packets with a difference */
+    /* of timestamp between each one of them less than 1000000ns, */


Please the above 1000 and 1000000 with macro names?

yonghong-song · 2019-01-16T21:31:10Z

examples/tracing/ddos_detector.py

+    rcv_packets_ts_inter = bpf_ktime_get_ns();
+    rcv_packets.update(&rcv_packets_nb, &rcv_packets_nb_inter);
+    rcv_packets.update(&rcv_packets_ts_index, &rcv_packets_ts_inter);
+    return 0; // always return 0


Comment // always return 0 is not needed.

Comment removed!

yonghong-song · 2019-01-16T21:32:01Z

examples/tracing/ddos_detector.py

+
+def trigger_alert_event(cpu, data, size):
+    event = ct.cast(data, ct.POINTER(DetectionTimestamp)).contents
+    print("%-26s %s %ld" % (datetime.datetime.now(), \


Most other python scripts in bcc does not use /?

I have just noticed that, thank you. "" removed!

I mean backslash removed!

yonghong-song · 2019-01-16T21:32:26Z

examples/tracing/ddos_detector_example.txt

@@ -0,0 +1,44 @@
+Demonstrations of ddos_detector.py, the Linux eBPF/bcc version.
+
+This tracks ip_rcv function (using kprobe) and elapsed time between received packets to detect potential DDOS attacks.


Break this into two lines?

yonghong-song · 2019-01-16T21:32:54Z

examples/tracing/ddos_detector_example.txt

+TIME(s)            MESSAGE
+
+
+


One extra line is enough. The same for below.

Extra lines removed!

brendangregg · 2019-01-18T07:28:55Z

Minor comment: if one day someone ever considers moving this from examples/tracing to /tools, then I'd ask to shorten the name to fit with the other /tools. Could call it dddos: short for detect ddos.

jugurthab · 2019-01-20T09:38:33Z

Thank's for your code review. I have made the changes as you have recommended.

yonghong-song · 2019-01-20T19:14:57Z

[buildbot, test this please]

yonghong-song · 2019-01-22T18:20:26Z

Looks good. Thanks!

* master: (609 commits) docs: references_guide.md: add/fix search examples/tools links (iovisor#2186) Fix misc file permissions (iovisor#2185) sync with latest bpf (iovisor#2184) sync with latest libbpf repo (iovisor#2183) docs: fix broken link of bpf_log2l(iovisor#2176) examples/tracing: some minor fixes Fix tools/syscount -l (iovisor#2180) examples/tracing/bitehist.py: add example of linear histogram (iovisor#2177) cachestat: bring back HITRATIO column Fix debuginfo search on Ubuntu Add installation instructions for Amazon Linux 1 AMI Sign-Off-By Travis Davies <trdavies@amazon.com> [iovisor/bcc] trace: Incorrect symbol offsets when using build_id (iovisor#2161) (iovisor#2162) profile: exclude CPU idle stacks by default (iovisor#2166) fix cpuunclaimed.py with cfs_rq structure change (iovisor#2164) tools: rename "deadlock_detector" to "deadlock" (iovisor#2152) (iovisor#2160) use libbpf api in bpf_attach_xdp (iovisor#2158) support symbol resolution of short-lived process. (iovisor#2144) profile.py: return kernel annotations for folded stacks use libbpf APIs from libbpf.c (iovisor#2156) ddos_detector.py to monitor DDOS attacks (iovisor#2140) ...

ddos_detector.py to monitor DDOS attacks

ddos_detector.py to monitor DDOS attacks

194bb57

jugurthab requested review from 4ast, brendangregg, drzaeus77, goldshtn and yonghong-song as code owners January 14, 2019 10:05

yonghong-song reviewed Jan 14, 2019

View reviewed changes

Fixing code alignment issues

d42194c

yonghong-song reviewed Jan 16, 2019

View reviewed changes

Adding code comments

57b80dc

yonghong-song reviewed Jan 16, 2019

View reviewed changes

jugurthab added 6 commits January 20, 2019 10:04

Add files via upload

f52f407

Code structure review

9ec199e

Code structure review

96a538b

ddos_detector.py renamed to dddos

dd0b0cf

Rename ddos_detector_example.txt to dddos_example.txt

abb61b6

Updating code comments for dddos

e788814

yonghong-song merged commit c77b158 into iovisor:master Jan 22, 2019

palexster pushed a commit to palexster/bcc that referenced this pull request Jul 7, 2019

ddos_detector.py to monitor DDOS attacks (iovisor#2140)

b1828a8

ddos_detector.py to monitor DDOS attacks

CrackerCat pushed a commit to CrackerCat/bcc that referenced this pull request Jul 31, 2024

ddos_detector.py to monitor DDOS attacks (iovisor#2140)

db6d37f

ddos_detector.py to monitor DDOS attacks

		@@ -0,0 +1,44 @@
		Demonstrations of ddos_detector.py, the Linux eBPF/bcc version.

		This tracks ip_rcv function (using kprobe) and elapsed time between received packets to detect potential DDOS attacks.

		TIME(s) MESSAGE

ddos_detector.py to monitor DDOS attacks #2140

ddos_detector.py to monitor DDOS attacks #2140

Conversation

jugurthab commented Jan 14, 2019

yonghong-song commented Jan 14, 2019

Choose a reason for hiding this comment

yonghong-song left a comment

Choose a reason for hiding this comment

yonghong-song commented Jan 14, 2019

jugurthab commented Jan 15, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jugurthab commented Jan 16, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brendangregg commented Jan 18, 2019

jugurthab commented Jan 20, 2019

yonghong-song commented Jan 20, 2019

yonghong-song commented Jan 22, 2019