Cloning traffic to simulate attacks/vulnerabilities

[ikinnexi]

Hi,

Has anyone ever tried to clone malicious traffic sent through the palo-alto firewall to try to re-simulate attacks or exploit vulnerabilities?

If you have, can you share your experience in how you did it?

Just trying to research on some ideas of how to seek exploit possibile vulnerabilities based on traffic that I might think is malicious.

If you need some more info, let me know.

Thanks.

BA

[cl.tech]

This is something to look at.

http://tomahawk.sourceforge.net/

Keith

[ikinnexi]

Is it possible to use the PA-2xxx series to span/mirror traffic from one port to another? 

Either in PanOS 3.1 or 4.0?
   
It would be very handy since we have so many unused ports on the device, and don't have any taps lying around.

Any info you can provide on this would be great.

Thank You.

BA 
   

[rmonvon]

We currently do not support spanning/mirroring traffic from the PAN device today.  Please contact your local Palo Alto SE to submit this feature as a feature request.  In the meantime, you can use our packet capture feature to help during troubleshooting.

Thank you very much for your spanning suggestion!!

[kbrazil]

Actually, Virtual Wire acts a bit like an inline tap.  Any packets that are seen on the interface are forwarded out the second interface in the Virtual Wire.  If you are out of SPAN ports you can put the PAN device in between an existing SPAN port and another device using the SPAN with a couple interfaces in Virtual Wire mode and allowing all traffic to pass via open security policy.

Cheers,

Kelly

[bhlee]

I usually use "Colasoft Packet Player".

if you have exploit packet capture like exploit.pcap, then , use that tool. you can 'replay' that packet capture by sending it to the PA in TAP mode interface.

then PA will detect the attack.

thank you

BH Lee

[migration]

You can always get a packet capture of the specific traffic you want and replay it through a device with TCPreplay or Scapy.