I uploaded the attached PCAP which has a session (including a TCP SYN packet), and it

Fixed -- <a class="issue-link js-issue-link" data-error-text="Failed to load title" da

Dalton seems to not recognize IPv6 packets as having a session about dalton HOT 2 CLOSED

secureworks commented on August 11, 2024

Dalton seems to not recognize IPv6 packets as having a session

from dalton.

Comments (2)

whartond commented on August 11, 2024

Good catch, thanks for the feedback.

Dalton uses a tcpdump pcap filter to see if there are any TCP packets in the pcap and if so, verify that there is at least one TCP packet with the SYN flag set:

dalton/dalton-agent/dalton-agent.py

Line 534 in 53e8c90

 if len(subprocess.Popen("%s -nn -q -c 1 -r %s \"tcp[tcpflags] & tcp-syn != 0\" 2>/dev/null" % (TCPDUMP_BINARY, pcap), shell=True, stdout=subprocess.PIPE).stdout.read()) == 0: 

Turns out that this syntax isn't supported with IPv6; from https://www.tcpdump.org/manpages/pcap-filter.7.html:

To access data inside the packet, use the following syntax:

proto [ expr : size ]

Proto is one of ether, fddi, tr, wlan, ppp, slip, link, ip, arp, rarp, tcp, udp, icmp, ip6 or radio, and indicates the protocol layer for the index operation. (ether, fddi, wlan, tr, ppp, slip and link all refer to the link layer. radio refers to the "radio header" added to some 802.11 captures.) Note that tcp, udp and other upper-layer protocol types only apply to IPv4, not IPv6 (this will be fixed in the future)....

I can address in a future update but for now you can just ignore that warning; it's a check that runs after the job has finished and doesn't affect the results.

from dalton.

whartond commented on August 11, 2024

Fixed -- #133

from dalton.

Recommend Projects