Greynets Toolkit Documentation

Version 0.5.8

Getting Started

Using the Demo Greynet

If you would just like to explore what the Greynet toolkit does, you may like to start by using the demo Greynet.

To create a demo greynet, simply go to the 'Greynets' page (under the 'System' heading) and click on 'Add demo greynet'. This will create a new greynet on VLAN 2341 with a network of 10.234.123.0/24.

Fifteen Greynet hosts will be created and these can be viewed by selecting 'DEMO' (under the 'Greynet Hosts' heading). Once you have applied the new configuration (with the link in the left hand column) you have a Greynet that is configured and ready to monitor traffic.

Traffic can now be sent to the greynet on VLAN 2341. This script can be used on another FreeBSD machine to configure the correct VLAN interface and continuously ping greynet hosts. (You will need to ensure no firewall is blocking ICMP traffic either on this host or between this host and the Greynets system.) Additionally, after running the script (which configures the VLAN), if you have nmap you can run 'nmap 10.234.123.1-240' to scan the entire network. You can confirm traffic is being detected by the greynet by viewing the 'Greynet Hosts' listing for the DEMO Greynet. The PPS and BPS values should indicate the amount of traffic being detected at each greynet host. You may now like to consider other ways of viewing greynet statistics.

Configuration Concepts

This section outlines what you need to know in order to deploy a Greynet system alongside your existing network.

VLAN Configuration

To use this toolkit successfully, there are two options for physical network configuration. Either one network interface is used for management and all Greynet networks, or one interface is used for management and a second interface is used for all Greynet networks. This requires that the switch connecting the Greynet system is 802.1Q compliant. All greynet VLANs must be tagged. The management network must be native (untagged) regardless of whether or not a separate network interface is being used for management.

Address Allocation Methods

How your Greynet(s) are deployed will depend on the IP allocation stragegy in use on your network and whether you intend to configure static greynet hosts, or dynamic hosts which 'flow around' your existing hosts on the network.

Manual Static Address Allocation

The simplest way to use the toolkit is to manually set the IP address for each greynet host. This method is suitable when you know specific IP addresses that you would like to turn into greynet hosts and there will be no chance that some other normal host will be assigned the same address.

Manual static address allocation is suitable if you do not use or intend to use DHCP at all or if you will only assign addresses that are not managed by the DHCP server.

DHCP Assigned Static Address Allocation

If you want to have specific greynet host addresses and have an external ISC DHCP Server that is responsible for allocating addresses on your Greynet Network, you can configure your external ISC DHCP Server to assign the greynet hosts fixed addresses. To do this, set the host allocation mode to 'Dynamic', setting the preferred address to the address you wish to assign to that host. Set the greynet to use External DHCP. Copy the ready made ISC DHCP Server configuration from the 'External DHCP Server' page and add it to you DHCP server configuration file.

DHCP Assigned Dynamic Address Allocation

This option requires minimal configuration and will provide seamless integration with any existing DHCP Server. Hosts are set to Dynamic allocation and the Greynet is set to use External DHCP.

Once you have decided on your IP allocation method you are ready to procede in configuring the system via the web interface.

Using the Web Interface

Adding a Greynet

The first step to setting up a Greynet involves configuring the basic information such as the VLAN and network address.

1. Select 'Greynets' on the System Menu.
2. Click the 'New Greynet' Tab
3. Enter a name for this network (this name will be used to refer to the network from the GUI)
4. Enter the VLAN to which you will connect this Greynet
5. Enter the network address and subnet mask of the network.
6. Optionally enter a longer description. (This field is not used anywhere and is for your reference only).
7. Decide on which type of Address allocation method you will use for this Greynet.
8. If using External DHCP or using manual static address allocation, select External. If you wish to use the build in DHCP Server, select Internal.
9. If using the Internal DHCP server, configure the server address. (The IP address to which the DHCP server will bind) and the dynamic allocation range.
10. Click Save at the bottom of the page to save the Greynet.
11. You should now see an entry for your new Greynet on the Overview tab.

Adding Greynet Hosts

Before a Greynet is useful, Greynet hosts must be added.

1. Select the name of your new Greynet as defined in 'Adding a Greynet' under the Greynet Hosts menu.
2. You should now see an empty table which will soon hold your Greynet Hosts.
3. Click the small icon with a '+' symbol in order to create a new host.
4. Select host IP address allocation method. The simplest method is static. If selected, the IP address of this host will be set to whatever is entered in the 'Preferred IP Address' field. If set to Dynamic, the IP address will be determined by a DHCP server. (Either Internal or External depending on the Greynet configuration).
5. Enter the preferred IP address. If using a DHCP Server, this address may or may not be used, depending on the DHCP Server configuration.
6. Click Save to add the host to the Greynet.

Applying Configuration

To apply the new configuration, select 'Apply Configuration' from the menu. This will reload most of the components of the Greynet system, including the system network configuration, firewall, DHCP Server, DHCP Client and greynetd.