-
Notifications
You must be signed in to change notification settings - Fork 0
Canary Shark
The python script for the base canary service using pyshark
The core-daemon must be running before executing this script in order for it to successfully monitor bridges in a CORE network. This script must be run from the terminal after a network has been manually created in the CORE GUI or initialized using the network_initializer. This script will automatically terminate after 330 seconds. By default this script will spawn canary processes for each CORE bridge it finds on the system. Each of these canary process will be handed a bridge id, a shared reporting queue, a list of interfaces for that bridge, a time interval of 330 seconds, and a threshold value of 3.5. Each of these canaries will then listen to the interfaces of their assigned bridge and compute the IP address entropy every 50 packets. They will report back to the parent every packet seen, everytime they compute entropy, and if they have 5 consecutive entropy computations lower than their provided threshold. After the time interval elapses all of these canary child processes will terminate and free up the shared queue object for the parent. The parent will then use the shared queue to dump a log file which contains detailed information from each canary child process in order. However this canary_shark script is usually run with optional parameters to allow the experimenter or canary_driver to specify some of the variables discussed above.
The canary_shark script accepts 4 parameters. An float -t which is entropy threshold each canary should compare its entropy computations against. An integer -n which defines the number of canaries that should be deployed across a simulated network. This parameter should always be less than or equal to the number of bridges in a network. A comma separated list -a of hosts where attackers are deployed. This parameter is not used by the canaries themselves but can be leveraged by the canary_driver so that this information is in the log file dumped by this script upon completion. The last optional parameter is a string -l which defines an optional label to be included in the log file. Like the -a parameter the -l parameter is not used by the canaries themselves but rather is useful for when the canary_driver is conducting the simulation of a large number of trials.
| entropy threshold | number of canaries | list of attackers | report label |
|---|---|---|---|
| -t | -n | -a | -l |