Adding Windows DHCP logs to Elastic – part 2

If you followed the previous blog, we have created a pipeline for sending Windows Server DHCP logs into Elastic. But that was just the basic logs. Suppose we want to enrich the logs with the Mac Address Vendor Information. So you will be able to monitor what devices appear on your network. Please note that Mac Addresses can be manipulated by 3 party.

A Mac Address consists of 2 parts . You have the Mac Vendor Prefix of 3 bytes followed by a unique identifier of another 3 bytes.

On a Windows computer you have multiple ways to display the Mac Address. These include:

  • ipconfig /all
  • getmac
ipconfig /all
Ipconfig /all

In this example , we have a Mac Address of A0-B3-CC-85-30-F4. Our Vendor prefix will be A0-B3-CC. But how to translate this prefix into Vendor information?

Fortunately we can download a list of known Vendors http://standards-oui.ieee.org/oui.txt

So we download that list and look for our example prefix, we find this prefix as registered by HP.

Vencor a0-b3-cc
Vendor a0-b3.cc

To be able to use the downloaded OUI list in logstash we need to convert the file to a YML file. The file will also contain some characters that logstash don’t appreciate, so we will try to strip those characters also. We will use a small powershell script to do this conversion. The script contains hardcoded locations, which you need to update.

# assume we have downloaded script to this location
$file = "c:\source\oui.txt"
# target location
$dest = "c:\source\oui.yml"

# regex to filter lines that contains the "(base 16)" wording
$regex = "(^.{6})\s+\(base 16\)\s+(.*)$"

if (Test-path $dest)
{
    remove-item $dest
}

$streamWriter = [System.IO.StreamWriter] "$dest"
foreach($line in Get-Content $file) 
{
    if($line -match $regex)
   {
       $company = $matches[2]
       # strip out strange characters
       $nice = $company -replace "[^0-9a-zA-Z ]+" , ""
       # write to dest YML file
       $streamWriter.WriteLine("`"$($matches[1])`": $($nice)");
    }
}
# we are done
$streamWriter.close();

We are now able to expand our logstash filter, to use our new Mac Address vendor lookup information. We will do this with the help of the translate filter. This allows us to lookup a value in the YML file.

if [Description] == "Assign" or [Description] == "Renew"
{
   grok 
   {
    # split the mac address into 2 elements
    match => [ "MAC_Address", "(?<ouiprefix>.{6})(?<ouisuffix>.*)" ]
   }
   # lookup the ouiprefix in the YML file and add new oui field
   translate 
   {
     dictionary_path => "c:\elastic\logstash\config\oui.yml"
     field      => "[ouiprefix]"
     destination => "[oui]"
     fallback => "N/A"
   }
}

That’s all you need to do to enrich the DHCP logs with Mac Address Vendor. As usual we leave it to you to make a visualization of this info and add that to your DHCP dashboard.

Next part of this series will adress trying to find unusual hostnames in the DHCP logs. We will try to develop a pattern on the typical hostname and use Elastic Machine Learning to find uncommon patterns.

Leave a Reply

Your email address will not be published. Required fields are marked *