Manage Artica PCAP filter via command-line

• Back to Artica PCAP filter main section

The engine is available for Debian versions 7 and later (GLIBC 2.14 or higher).
We have developed this tool to allow you to secure old servers, and to accompany them to a better life so that they get the latest updates of the lists of low-quality addresses.

First: Download and install the tool v1.0.40

Artica PCAP filter is available on all amd64 Linux distributions. We use Debian as our preferred distribution, but it works on Ubuntu, CentOS, Astra, RedHat...

• For old Systems like Debian 7.1x https://www.articatech.com/download/ArticaPCAP/articapsniffer-Debian7-1.0.32.tar.gz
• For modern systems Debian 10+ https://www.articatech.com/download/ArticaPCAP/articapsniffer-Debian10-1.0.42.tar.gz

Extract the tarball tar -xf articapsniffer-Debian10-1.0.38.tar.gz -C /usr/local/bin/

Set permissions: chmod 0755 /usr/local/bin/articapsniffer

Second: Define which network card to monitor

Use the -interface token to define the network card: 

articapsniffer -interface eth0

Set the Daemon parameters

Artica PCAP filter runs in daemon mode; tune the memory buffers according to your needs.

Quick setup

If you want to test the program easily, you can use:

./articapsniffer-quick-setup-ipset

Add predefined sources with IPSet remediation.

Manage sources

The second thing to do is to add HTTPS or RBL sources to instruct the engine which addresses to detect as malicious.
You can create rules using IP country geolocation to flag IP addresses as malicious.

Manage Whitelist

Whitelist is a software-internal database that automatically authorizes addresses, networks, and domains.

Remediation

Artica PCAP sniffer supports 5 remediation modes.

• Fail2Ban mode: 
  This is not really the responsibility of Artica PCAP sniffer. 
  The Fail2ban service simply needs to monitor the log file /var/log/articapsniffer.log and detect the 
  Detected bad IP [1.2.3.4] entries in the log file.
   
• IPSet mode: 
  This method consists of filling an “IPTables” ipset object with a time-limited duration. 
  Note that this is a "hard" method, meaning that an IP address detected by the sources will be automatically banned by your firewall without notice.
   
• ProxMox remediation
  This method consists of remotely filling a ProxMox IPSet object with a time-limited duration. 
   
• Fortigate remediation
  This method consists of remotely filling a Fortigate Address group object with a time-limited duration. 
   
• pfSense remediation
  This method consists of remotely filling a pfSense Address aliases object with a time-limited duration. 
   
• CrowdSec remediation
  For CrowdSec detection, create Parsers and scenarios according to the generated log file.
  Use Artica with the CrowdSec Custom Bouncer to apply CrowdSec decisions to pfSense, ProxMox, Fortigate or local iptables rules.

Logging 

Artica writes its logs to the /var/log/articapsniffer.log. The tokens -syslog-on or -syslog-off  make it possible to log suspicious addresses via syslog in kernel.log (like iptables).
The /var/log/articapsniffer.log is automatically rotated and compressed when it reaches a size of 100 MB. If you need to reduce or increase the log rotation size, use the token -max-logsize
 

Use the -log-status token to get the logging configuration

Testing and showing the configuration 

Testing an IP address

You can test if an IP address is detected by using the token  -test-ip

articapsniffer -test-ip 1.2.3.4

Results can be BAD or GOOD

Examples: 

~# ../articapsniffer -test-ip 5.42.199.2
5.42.199.2 is BAD

~# ./articapsniffer -test-ip 37.187.156.2
37.187.156.2 is GOOD

Show the configuration

The token -current-config displays all available settings.

  ./articapsniffer -current-config

Current Configuration of Artica PCAP Sniffer reputation checker:

NETWORK -----------
Packet Capture...: INACTIVE
Listen Interface.: eth0 (used to monitor Network interface)
Packets Timeout..: 4s

Remediation Mode-----------
White-listed.....: 8 record(s)
IPSet Mode.......: ACTIVE
IPSet Object.....: artica
IPSet Time-out...: 5mn

DAEMON Mode-----------
Daemon Mode......: ACTIVE
PID File path....: /var/run/articapsniffer.pid
Update schedule..: 10mn (*/10 * * * *)

DNS -----------
resolv.conf......: /etc/resolv.conf
DNS Timeout......: 2 seconds (Used for RBL queries)
DNS Server.......: 1.1.1.1 (Use for RBL query)
DNS Server.......: 8.8.8.8 (Use for RBL query)
RBL Server.......: b.barracudacentral.org expect 127.0.0.2
End of Configuration