Skip to content

Network Agent

Package name: intrudect-netagent

This package listens on network interface where network traffic is mirrored from switches and attempts to identify anomalies or IOCs. It centrally logs metadata about TCP, UDP, DNS, DHCP and HTTP traffic.

Considerations

Before deploying Network Agent, consider the following:

  • If you haven't done it recently, start by reviewing your network documentation.
  • Consider the amount of network traffic on your LAN. Do you need 10G/25G network cards and matching hardware, or is it a typical office network with low Office 365 traffic?
  • If network traffic volume is unknown, it's best to install LibreNMS or Cacti to determine the actual traffic load.
  • Evaluate how the network is segmented and decide how many Network Agent instances you need to install.
  • If installing on a VM, ensure that a separate physical Ethernet adapter is directly assigned to the VM.

Configuration

The initial example (not default) configuration for Network Agent can be created in the web UI under Agents > Add new network agent. After saving and downloading it, store the configuration on the machine running the agent at /opt/intrudect-netagent/etc/config.json. Once in place, Network Agent will request an updated configuration from the web UI regularly.

All monitoring options are configured via Web UI -> Monitoring menu.

Network interface

The NetworkInterface defines the network adapter(s) used by Netagent.

 "NetworkInterfaces": [
    "enx00e04c02eb61",
    "docker0"
  ],

Logging

Packets related to alert can be saved to PCAP file. SendPCAP indicates if related packets are sent as an attachemnt with alert or no. Should always be true. SaveLocalPCAP option to save alert related PCAP files into machine running network agent. They may have more information as alert is sent when incidend is detected, but when alerted activity is still ongoing packets are added to the PCAP file. 

"SendPCAP": true,
"SaveLocalPCAP": false

Metadata logging.

Remote indicates that metadata is sent to Web UI. Local can point to local file, empty value disables local logging.

ReverseLookups enables PTR enrichment. For TLS/QUIC traffic where the ClientHello is visible, the agent can usually extract SNI and store it as the destination hostname.

Note

It is good idea to exclude traffic from network agent machine to web UI. Also exclude IP camera -> DVR and other similar high volume known good traffic.

"ReverseLookups": true,
"DNSFlow": {
  "Local": "",
  "Remote": true,
  "IgnoreDomains": [
    "unifi"
  ],
  "Exclude": [
    {
      "SrcCIDR": ["10.0.0.0/8"],
      "DstIP": "8.8.8.8",
      "Qtype": ["A", "AAAA"]
    }
  ],
  "BatchSize": 5000,
  "BatchTimeM": 5
},
"TCPFlow": {
  "Local": "",
  "Remote": true,
  "Exclude": [
    {
      "SrcCIDR": "10.0.0.0/8",
      "DstCIDR": "192.168.19.0/24",
      "DstPortSpec": "8000,8080-8090"
    }
  ],
  "BatchSize": 5000,
  "BatchTimeM": 5
},
"UDPFlow": {
  "Local": "",
  "Remote": false,
  "Exclude": [],
  "BatchSize": 1000,
  "BatchTimeM": 5,
  "IdleTimeoutS": 120,
  "UnrepliedTimeoutS": 30,
  "ActiveTimeoutS": 600,
  "RecordValidDNS": false
},
"HTTPFlow": {
  "Local": "",
  "Remote": true,
  "BatchSize": 1000,
  "BatchTimeM": 5
},
"DHCPFlow": {
  "Local": "",
  "Remote": true,
  "BatchSize": 500,
  "BatchTimeM": 1
},
"SendPCAP": true,
"SaveLocalPCAP": false

TCPFlow Exclude

Exclude rules prevent matching TCP connections from being logged. Each rule has three optional fields — all non-empty fields must match for a connection to be excluded.

Field Description Example
SrcCIDR Source network in CIDR notation. Empty matches all sources. "10.0.0.0/8"
DstCIDR Destination network in CIDR notation. Empty matches all destinations. "192.168.1.0/24"
DstPortSpec Destination port specification. Supports single ports, comma-separated lists, ranges, and "*" for all. Empty matches all ports. "443,8080-8090"

UDPFlow

UDP is connectionless, so the agent groups packets into flows by their source/destination IP and port 4-tuple and logs each flow when it ends. Since there is no connection teardown to observe, flow lifetime is controlled by timeouts:

Field Description Default
IdleTimeoutS A bidirectional flow (replies seen) is closed and logged after this many idle seconds. 120
UnrepliedTimeoutS A one-directional flow (no replies seen) is closed and logged after this many idle seconds. 30
ActiveTimeoutS Maximum flow duration. A long-lived flow (VPN tunnel, QUIC session) is logged after this many seconds and a new flow record is started, so ongoing traffic shows up before it ends. 600
RecordValidDNS Port-53 flows in which every packet parses as valid DNS are not logged unless this is true — the DNS metadata module already covers real DNS traffic. Non-DNS traffic riding on port 53 (e.g. tunneling) is always logged regardless of this setting. false

For outbound QUIC (UDP port 443) flows, the agent extracts the server name (SNI) from the ClientHello and records it as the destination hostname.

When Remote is true, UDP flow records are sent to the Web UI and appear under UDP log. The same search, export, and report views used for TCP flow metadata are available for UDP: endpoint and port filters, top IPs, services, ASN, pairs, map, volume, and interval statistics.

Exclude rules use the same fields and matching as TCPFlow Exclude.

DNSFlow Exclude

Exclude rules prevent matching DNS queries from being logged. Works alongside IgnoreDomains which filters by domain name.

Field Description Example
SrcCIDR Source networks in CIDR notation (array). Empty matches all sources. ["10.0.0.0/8"]
DstIP Destination IP (DNS server). Empty matches all. "8.8.8.8"
Qtype DNS query types (array). Empty matches all types. ["A", "AAAA"]