Same 5 tuples for encrypted and decrypted traffic

[masedira]

Hi All,

I am doing inline SSL decryption and also collecting traffic from SPAN ports.

Decrypted traffic copy and SPAN ports are all aggregated on a packet broker which supports dedup, vlan addition/stripping etc..

The challenge I am facing is that the decrypted traffic copy has the same 5 tuples like the encrypted traffic that I am receiving from SPAN ports.

In traditional/standalone ZEEK I can send the traffic to 2 separate physical interfaces with separate workers, so no problem there, however with SO-zeek in SO all interfaces are under the same bond0.

Some options that I could do with the packet broker:

• send decrypted traffic to separate physical interface from encrypted traffic
• add a vlan tag to decrypted traffic - double tagged packets would be received on the physical interface
• replace vlan tag with another unique vlab tag for decrypted traffic.

What would be the best way to tell SO-Zeek to treat the decrypted flows separately form the encrypted flows that have the same 5 tuples?

[triggerman86]

I think replacing the VLAN tag with another unique tag is the cleanest option that avoids complexity.

Just need to make sure policy/frameworks/conn_key/vlan_fivetuple.zeek is loaded.

The other benefit to this approach is the encrypted session, decrypted session and embedded network protocol logs that have a 5 tuple should also get the same community_id adding another nice pivot for correlation.