Cloning traffic to simulate attacks/vulnerabilities

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Cloning traffic to simulate attacks/vulnerabilities

Not applicable

Hi,

Has anyone ever tried to clone malicious traffic sent through the palo-alto firewall to try to re-simulate attacks or exploit vulnerabilities?

If you have, can you share your experience in how you did it?

Just trying to research on some ideas of how to seek exploit possibile vulnerabilities based on traffic that I might think is malicious.

If you need some more info, let me know.

Thanks.

BA

6 REPLIES 6

L0 Member

This is something to look at.

http://tomahawk.sourceforge.net/

Keith

Not applicable

Is it possible to use the PA-2xxx series to span/mirror traffic from one port to another? 

Either in PanOS 3.1 or 4.0?
   
It would be very handy since we have so many unused ports on the device, and don't have any taps lying around.

Any info you can provide on this would be great.

Thank You.

BA 
   

We currently do not support spanning/mirroring traffic from the PAN device today.  Please contact your local Palo Alto SE to submit this feature as a feature request.  In the meantime, you can use our packet capture feature to help during troubleshooting.

Thank you very much for your spanning suggestion!!

Actually, Virtual Wire acts a bit like an inline tap.  Any packets that are seen on the interface are forwarded out the second interface in the Virtual Wire.  If you are out of SPAN ports you can put the PAN device in between an existing SPAN port and another device using the SPAN with a couple interfaces in Virtual Wire mode and allowing all traffic to pass via open security policy.

Cheers,

Kelly

I usually use "Colasoft Packet Player".

if you have exploit packet capture like exploit.pcap, then , use that tool. you can 'replay' that packet capture by sending it to the PA in TAP mode interface.

then PA will detect the attack.

thank you

BH Lee

L0 Member

You can always get a packet capture of the specific traffic you want and replay it through a device with TCPreplay or Scapy.

  • 3571 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!