Build a trigger to monitor responses to NTP monlist requests

In the following steps, you will configure the host, port, and protocol for the open data stream target.

1. Log in to the ExtraHop system that you want to send data from with an account that has system and access administration privileges.
2. Click the System Settings icon , and then click All Administration.
3. In the System Configuration section, click Open Data Streams.
4. Click Add Target.
5. Select Syslog from the Target Type drop-down list.
6. In the Name field, type NTP Syslog unless this is the first syslog target you have created. In that case, the target is automatically named "default" and cannot be renamed.
7. In the Host field, type the IP address or hostname of the syslog server you want to send data to.
8. In the Port field, type the port number you want to send data to.
9. From the protocol list, select UDP.

   Tip:	Click Test to establish a connection and send a test message from the ExtraHop system to the remote syslog server.

10. Select Local if you want to send syslog information with timestamps in the local timezone of the ExtraHop system. Otherwise, timestamps are sent in GMT.
11. Click Save.
    The target is added to the Syslog table on the Open Data Stream page.

In the following steps, you will write a trigger that specifies what data to examine from NTP server responses and whether to send the data to a remote syslog server.

1. Click the ExtraHop logo in the upper left corner to return to the ExtraHop system.
2. Click the System Settings icon , and then click Triggers.
3. Click Create.
4. In the Name field, type Parse UDP payload for NTP responses.
5. Click Enable debug log to enable the debug log and trigger performance metrics.
6. In the Events field, select UDP_PAYLOAD.
7. Click Show advanced options and specify the following payload settings to look for NTP traffic only on UDP port 123:
   1. Select Run trigger on all UDP packets.
   2. In the Server Port Range Min field, type 123.
   3. In the Server Port Range Max field, type 123.
8. In the right pane, add the following trigger code to enable access to the NTP server response payload:

   //Capture the NTP server response
   let buf = Flow.server.payload;
   //Exit the trigger if the NTP server response cannot be captured
   if (buf === null) {
       return;
   }

   Copy
9. Add the following trigger code to the existing script to specify which fields the trigger will extract from the header of the payload and which fields to ignore:

   //Define the format of the NTP response
   let fmt = ('B' + // Flags (LI, Version, Mode)
              'x' + // Auth + Seq (ignore)
              'x' + // Implementations (ignore)
              'B' + // Request code
              'B'); // Error

   Copy
10. Add the following trigger code to the existing script to extract the fields from the payload:

    //Analyze the NTP response based on the defined format
    let values = buf.unpack(fmt);
    let mode = values[0] & 0x7;

    Copy
11. Add the following trigger code to the existing script to check the values of the following header fields:

    // Exit the trigger if the mode value is not 7.
    if (mode !== 7) {
        return;
    }
    let reqCode = values[1];
    
    //Save the last four bits of the error code as a variable
    let errorCode = values[2] >> 4;

    Copy

    The mode, located in the last three bits of the field, indicates the NTP mode of operation. A value of 7 specifies that the NTP server is responding to a private mode command, which includes the monlist command.

    The request code field indicates the request type. A value of 20 or 42 specifies a monlist request.

    The error code field, located in the last four bits, indicates the error type. A value of 0 specifies that the response is not an error.

12. Add the following trigger code to the existing script to send an alert-level message to the remote syslog server if the NTP server is responding to a monlist command and if the response is not an error.

    //Check that there is no error and that the monlist command has been run
    if ((errorCode === 0) && ((reqCode === 20) || (reqCode === 42))) {
        //If the monlist command has been run, send an alert level message with
        //the NTP server IP address to the Syslog server 
        Remote.Syslog('NTP Syslog').alert('monlist enabled on ' + Flow.server.ipaddr);
    }

    Copy

    The trigger sends messages that include the NTP server's IP address to the remote syslog server that you configured earlier. If the target you configured was automatically named, replace 'NTP Syslog' with 'default' in the code.

13. Add the following trigger code to the existing script to check whether debugging is enabled and send the specified output to the debug log.

    //Print the IP address, request code, and error code in the debug log
    debug('NTP Server ' + Flow.server.ipaddr +
          ' responded to mode 7 command ' + reqCode +
          ' with error code '  + errorCode + '.');

    Copy
14. Click Save.

Before the trigger can examine UDP response payloads, you must assign the trigger to at least one device. For this walkthrough, you will assign the trigger to NTP servers on your network.

1. Click Assets from the top menu.
2. From the left pane, click Devices.
3. In the Name column, locate at least one NTP server and select the checkbox.
4. Click Assign Trigger at the top of the page.
5. Click the checkbox next to the Parse UDP payload for NTP responses trigger, and then click Assign Triggers.