NetWitness Community

RSAAdmin · ‎2012-09-17

I recently got the attached perl script from a Netwitness Engineer (he's not the author and is unable to provide direct assistance; I'm not terribly good at scripting either). It's built to extract files or other data out of Netwitness via CLI, but I'm unable to get it functioning correctly. One of the biggest issues I'm having is with the use of option '-l'. I've used the script to set the .lastmeta file to the latest meta session ID. When using the -l option, the search does nothing. If I don't use the -l option it starts processing at session 1 which means I'm searching through all 25 billion meta sessions which never finishes before the server runs out of memory. If anyone with more experience can take a look and let me know if you have any suggestions I would appreciate it. This is the only utility I've seen that can rip out exe's, pdf's, etc. through CLI for analysis. I would really like to get it working but if someone has something better, I'm open to all suggestions. Thanks!

I've tested the following queries (sensitive data removed)

./cli_inv.pl -m "alias.host" -u username -p password -i xxx.xxx.xxx.xxx:50105 -l -a query -o summary "service=53"

--This query does nothing

./cli_inv.pl -m "alias.host" -u username -p password -i xxx.xxx.xxx.xxx:50105 -t -a query -o summary "service=53"

--This query works, starts processing data from the beginning of time

./cli_inv.pl -m "alias.host" -u username -p password -i xxx.xxx.xxx.xxx:50105 -l 25037950437 -a query -o summary "service=53"

--Here I tried specifying the session I wanted it to start on but I get the following CLI error:

400 Bad Request

session info failed

--This command generates an SDK query such as the following

xxx.xxx.xxx.xxx:50105/sdk?msg=session&id1=25037950438&id2=&force-content-type=text/plain (no id2 is specified and I get the following error)

<html>

<head>

<title>Bad Request</title>

</head>

<body>

<h1>Bad Request</h1>

<p id="string-error"><span style="color:red;">Parameter id2: Value '' is not a valid unsigned integer</span>

</p>

</body>

</html>

RSAAdmin · ‎2012-09-18

Just an FYI, I really dislike perl...

I reviewed the REST commands in the NW help file on page 314 and found this:

The session command provides the valid session and/or meta ranges (field1 and field2) of

the service (the same functionality as the standard SDK NwSession). The parameters id1

and id2 are the starting and ending session range. The command returns the starting

and ending session and the valid starting and ending meta range. If you pass zero for

both id1 and id2, the command returns the full valid session range with the full valid

meta range. If you pass any other numbers, it reduces the meta range to match the

session range.

From what it looks like, you are starting at session 25037950438 and going to infinity which NW doesn't know how to handle. I believe if you put 2000000000 in for id1 and 25037950438 for id2, it should work without going through all 25 billion sessions.

I am not exactly sure how to make the call using the perl script. I am sure you found a bug. (Should give Sconzo a talking too... or ask Rui to update it).

REST query:

xxx.xxx.xxx.xxx:50105/sdk?msg=session&id1=20000000000&id2=25037950438&force-content-type=text/plain

Jonathan

Anonymous · ‎2012-09-18

I don't know anyone called Sconzo or Rui but just add "$ID2 = 0;" after "$ID1 = $opts{l} + 1;"

It should look something like this:

if ($opts{l})

{

$ID1 = $opts{l} + 1;

$ID2 = 0;

}

That's the quickest fix and it should work other options are possible.

RSAAdmin · ‎2012-09-18

My first piece of advice is ignore Jonathan, he probably likes Ruby.

My second is listen to Rui (or the guy who says he doesn't know himself or me). There are a few bug fixes that I've made, and I think some feature enhancements as well. I've sent you a PM to help get you and updated version of the script and/or (not) Rui's fix should address this issue. The documentation is non-existent but I'd be happy to work with you in getting it to work correctly. I find some level of amusement that this script is still being distributed (but that's ok, I'm still using it too).

I'll also say you owe Rui a beer for letting me know you had this question.

NetWitness Community

File Extraction Script