Network Security Toolkit on a Raspberry Pi

Question

I am planning on putting either the NST (http://www.networksecuritytoolkit.org/nst/index.html) on my Pi or just downloading a lot of similar tools and then using my Pi as a security device to monitor all the traffic on my network. Has anyone done anything like this and does anyone know if you can boot this version of Fedora onto the Pi?

Answer 1

Here's the cite from the NST website:

The toolkit was designed to provide easy access to best-of-breed Open Source Network Security Applications and should run on most x86/x86_64 platforms.

RaspberryPi uses ARM CPU so it's not possible to directly use NST on it. You would have to recompile everything and probably do some other changes in order to run this distribution.

Most of the tools should be available in Raspbian (or other RaspberryPi's distributions so that would be easier way to use the tools.

You can also take a look at PwnPi distribution which claims to have 200+ network security tools preinstalled.

Answer 2

The basis of monitoring a network is packet sniffing. As you may or may not be aware, all traffic on a network is inevitably received by all computers on that network -- the reason for this is kind of obvious WRT to wireless,¹ but the same principle applies to wired systems. All messages are received by everybody, but normally an OS kernel ignores messages not addressed to it.

However, since all systems receive all packets,² any system can examine any packet (this is why encryption is so important to security). By default, the linux kernel includes a userspace interface for doing so. The normal way to do this programmatically is with libpcap, which is the basis of tools like tcpdump and wireshark. apt-cache search tcpdump on a pi running raspbian yields:

apt-cache search tcpdump
argus-client - IP network transaction auditing tool
argus-server - IP network transaction auditing tool
bittwist - libpcap-based Ethernet packet generator
dhcpdump - Parse DHCP packets from tcpdump
hlbr - IPS that runs over layer 2 (no TCP/IP stack required)
ipgrab - tcpdump-like utility that prints detailed header information
libncap-dev - static library and header files for libncap
libncap44 - network capture library
libnet-pcap-perl - Perl binding to the LBL pcap packet capture library
libpcapnav0 - wrapper to libpcap
libpcapnav0-dev - development files for libpcapnav
mitmproxy - SSL-capable man-in-the-middle HTTP proxy
ncaptool - network capture tool
net-acct - User-mode IP accounting daemon
netsed - network packet-altering stream editor
ngrep - grep for network traffic
nstreams - network streams - a tcpdump output analyzer
p0f - Passive OS fingerprinting tool
picviz - Parallel coordinates plotter
python-ncap - Python bindings for libncap
ssldump - An SSLv3/TLS network protocol analyzer
tcpdump - command-line network traffic analyzer
tcpflow - TCP flow recorder
tcpreplay - Tool to replay saved tcpdump files at arbitrary speeds
tcpslice - extract pieces of and/or glue together tcpdump files
tcpspy - Incoming and Outgoing TCP/IP connections logger
tcpstat - network interface statistics reporting tool
tcptrace - Tool for analyzing tcpdump output
tcpxtract - extracts files from network traffic based on file signatures
ulogd-pcap - pcap extension to ulogd

So, there is no shortage of packet sniffing tools. Wireshark is also available. Wireshark itself is a GUI but includes a CLI tool, tshark.

The wireshark tools in particular are very well documented.

---

^{1. Actually, although it may be easier to understand WRT wifi, sniffing on a wired network is easier because wired ethernet networks are seldom if ever completely encrypted (this is distinct from TLS/SSL encryption, which is applied to specific message contents, and not outer protocols used for addressing, etc). To so this on an encrypted wifi network you need to be able to observe all parties connect to the network, whereas with ethernet, you can do it at any point and process packets from anyone regardless of when they connected.}

^{2. As bobstro points out in comments, uses of switches and bridges in the network can impact this. You will know if you are using something like this. The same applies to using routers to divide into subnets; the way I am using "network" here really refers to individual subnets.}

Answer 3

You could also consider setting your device up to be monitored by a cloud security monitoring service like siemless (which operates a freemium model - so free for home users). They have an interesting blog piece on setting this up on a Raspberry Pi: https://siemless.com/blog/raspberry/ Their threat use cases appear quite basic at present, although their contextual rules look to be interesting.

Answer 4

The NST page mentions including many of the sectools.org tools, and many of those are available on Raspbian. I have installed many of those on RPis and used them during network configuration and security testing work. They work well, so long as you are cognizant of the limitations of the RPi in terms of network throughput.

You are not going to be able to sniff traffic on a busy network that saturates the RPi interface reliably, especially at 1 Gbps+ speeds. It really depends on how busy your home network is. If you're willing to live with possibly missing some traffic, it's probably more than adequate for such use.

It works very well for things like scanning (nmap), limited traffic sniffing that doesn't saturate the interface (tcpdump, tshark), firewall testing (portsentry). snort should work within bandwidth limits, although I haven't tried it yet on the RPi myself.