Showing posts with label Gcloud-CLI. Show all posts

Gcloud commands

ketan_patel@cloudshell:~ (new-user-learning)$ gcloud config list compute/region

[compute]

region (unset)

Your active configuration is: [cloudshell-22327]

ketan_patel@cloudshell:~ (new-user-learning)$ gcloud config list compute/zone

[compute]

zone (unset)

Your active configuration is: [cloudshell-22327]

ketan_patel@cloudshell:~ (new-user-learning)$ gcloud config set compute/region us-west1

Updated property [compute/region].

ketan_patel@cloudshell:~ (new-user-learning)$ gcloud config set compute/zone us-west1-b

Updated property [compute/zone].

ketan_patel@cloudshell:~ (new-user-learning)$ gcloud config list

[accessibility]

screen_reader = True

[component_manager]

disable_update_check = True

[compute]

gce_metadata_read_timeout_sec = 30

region = us-west1

zone = us-west1-b

[core]

account = ketan.patel@supernal.aero

disable_usage_reporting = True

project = new-user-learning

[metrics]

environment = devshell

Your active configuration is: [cloudshell-22327]

ketan_patel@cloudshell:~ (new-user-learning)$

ketan_patel@cloudshell:~ (new-user-learning)$ gcloud init

Welcome! This command will take you through the configuration of gcloud.

Settings from your current configuration [cloudshell-27741] are:

accessibility:

screen_reader: 'True'

component_manager:

disable_update_check: 'True'

compute:

gce_metadata_read_timeout_sec: '30'

core:

account: ketan.patel@supernal.aero

disable_usage_reporting: 'True'

project: new-user-learning

metrics:

environment: devshell

Pick configuration to use:

[1] Re-initialize this configuration [cloudshell-27741] with new settings

[2] Create a new configuration

Please enter your numeric choice: 1

Your current configuration has been set to: [cloudshell-27741]

You can skip diagnostics next time by using the following flag:

gcloud init --skip-diagnostics

Network diagnostic detects and fixes local network connection issues.

Checking network connection...done.

Reachability Check passed.

Network diagnostic passed (1/1 checks passed).

Choose the account you would like to use to perform operations for this configuration:

[1] ketan.patel@supernal.aero

[2] Log in with a new account

Please enter your numeric choice: 1

You are logged in as: [ketan.patel@supernal.aero].

Pick cloud project to use:

[1] dosmic350

[2] d-dev

[3] dv

[4] new-user-learning

[11] Enter a project ID

[12] Create a new project

Please enter numeric choice or text value (must exactly match list item): 4

Your current project has been set to: [new-user-learning].

Do you want to configure a default Compute Region and Zone? (Y/n)? Y

Which Google Compute Engine zone would you like to use as project default?

If you do not specify a zone via a command line flag while working with Compute Engine resources, the default is assumed.

[1] us-east1-b

[11] us-west1-b

[12] us-west1-c

[13] us-west1-a

[50] asia-northeast3-a

Did not print [66] options.

Too many options [116]. Enter "list" at prompt to print choices fully.

Please enter numeric choice or text value (must exactly match list item): 13

Your project default Compute Engine zone has been set to [us-west1-a].

You can change it by running [gcloud config set compute/zone NAME].

Your project default Compute Engine region has been set to [us-west1].

You can change it by running [gcloud config set compute/region NAME].

Your Google Cloud SDK is configured and ready to use!

* Commands that require authentication will use ketan.patel@supernal.aero by default

* Commands will reference project `new-user-learning` by default

* Compute Engine commands will use region `us-west1` by default

* Compute Engine commands will use zone `us-west1-a` by default

Run `gcloud help config` to learn how to change individual settings

This gcloud configuration is called [cloudshell-27741]. You can create additional configurations if you work with multiple accounts and/or projects.

Run `gcloud topic configurations` to learn more.

Some things to try next:

* Run `gcloud --help` to see the Cloud Platform services you can interact with. And run `gcloud help COMMAND` to get help on any gcloud command.

* Run `gcloud topic --help` to learn about advanced features of the SDK like arg files and output formatting

* Run `gcloud cheat-sheet` to see a roster of go-to `gcloud` commands.

ketan_patel@cloudshell:~ (new-user-learning)gcloud cheat-sheet

NAME

gcloud cheat-sheet - display gcloud cheat sheet

SYNOPSIS

gcloud cheat-sheet [GCLOUD_WIDE_FLAG ...]

DESCRIPTION

A roster of go-to gcloud commands for the gcloud tool, Google Cloud's

primary command-line tool.

Getting started

Get going with the gcloud command-line tool

o gcloud init: Initialize, authorize, and configure the gcloud tool.

o gcloud version: Display version and installed components.

o gcloud components install: Install specific components.

o gcloud components update: Update your Google Cloud CLI to the latest

version.

o gcloud config set project: Set a default Google Cloud project to work

on.

o gcloud info: Display current gcloud tool environment details.

Help

Google Cloud CLI is happy to help

o gcloud help: Search the gcloud tool reference documents for specific

terms.

o gcloud feedback: Provide feedback for the Google Cloud CLI team.

o gcloud topic: Supplementary help material for non-command topics like

accessibility, filtering, and formatting.

Personalization

Make the Google Cloud CLI your own; personalize your configuration with

properties

o gcloud config set: Define a property (like compute/zone) for the

current configuration.

o gcloud config get: Fetch value of a Google Cloud CLI property.

o gcloud config list: Display all the properties for the current

configuration.

o gcloud config configurations create: Create a new named

configuration.

o gcloud config configurations list: Display a list of all available

configurations.

o gcloud config configurations activate: Switch to an existing named

configuration.

Credentials

Grant and revoke authorization to Google Cloud CLI

o gcloud auth login: Authorize Google Cloud access for the gcloud tool

with Google user credentials and set current account as active.

o gcloud auth activate-service-account: Like gcloud auth login but with

service account credentials.

o gcloud auth list: List all credentialed accounts.

o gcloud auth print-access-token: Display the current account's access

token.

o gcloud auth revoke: Remove access credentials for an account.

Projects

Manage project access policies

o gcloud projects describe: Display metadata for a project (including

its ID).

o gcloud projects add-iam-policy-binding: Add an IAM policy binding to

a specified project.

Identity & Access Management

Configuring Cloud Identity & Access Management (IAM) preferences and

service accounts

o gcloud iam list-grantable-roles: List IAM grantable roles for a

resource.

o gcloud iam roles create: Create a custom role for a project or org.

o gcloud iam service-accounts create: Create a service account for a

project.

o gcloud iam service-accounts add-iam-policy-binding: Add an IAM policy

binding to a service account.

o gcloud iam service-accounts set-iam-policy: Replace existing IAM

policy binding.

o gcloud iam service-accounts keys list: List a service account's keys.

Docker & Google Kubernetes Engine (GKE)

Manage containerized applications on Kubernetes

o gcloud auth configure-docker: Register the gcloud tool as a Docker

credential helper.

o gcloud container clusters create: Create a cluster to run GKE

containers.

o gcloud container clusters list: List clusters for running GKE

containers.

o gcloud container clusters get-credentials: Update kubeconfig to get

kubectl to use a GKE cluster.

o gcloud container images list-tags: List tag and digest metadata for a

container image.

Virtual Machines & Compute Engine

Create, run, and manage VMs on Google infrastructure

o gcloud compute zones list: List Compute Engine zones.

o gcloud compute instances describe: Display a VM instance's details.

o gcloud compute instances list: List all VM instances in a project.

o gcloud compute disks snapshot: Create snapshot of persistent disks.

o gcloud compute snapshots describe: Display a snapshot's details.

o gcloud compute snapshots delete: Delete a snapshot.

o gcloud compute ssh: Connect to a VM instance by using SSH.

Serverless & App Engine

Build highly scalable applications on a fully managed serverless platform

o gcloud app deploy: Deploy your app's code and configuration to the

App Engine server.

o gcloud app versions list: List all versions of all services deployed

to the App Engine server.

o gcloud app browse: Open the current app in a web browser.

o gcloud app create: Create an App Engine app within your current

project.

o gcloud app logs read: Display the latest App Engine app logs.

Miscellaneous

Commands that might come in handy

o gcloud kms decrypt: Decrypt ciphertext (to a plaintext file) using a

Cloud Key Management Service (Cloud KMS) key.

o gcloud logging logs list: List your project's logs.

o gcloud sql backups describe: Display info about a Cloud SQL instance

backup.

o gcloud sql export sql: Export data from a Cloud SQL instance to a SQL

file.

EXAMPLES

To view this cheat sheet, run:

$ gcloud cheat-sheet

GCLOUD WIDE FLAGS

These flags are available to all commands: --access-token-file, --account,

--billing-project, --configuration, --flags-file, --flatten, --format,

--help, --impersonate-service-account, --log-http, --project, --quiet,

--trace-token, --user-output-

ketan_patel@cloudshell:~ (new-user-learning)$ gcloud source repos clone simulation --project=new-user-learning

Cloning into '/home/ketan_patel/simulation'...

remote: Total 5 (delta 0), reused 5 (delta 0)

Receiving objects: 100% (5/5), 4.25 KiB | 4.25 MiB/s, done.

Project [new-user-learning] repository [simulation] was cloned to [/home/ketan_patel/simulation].

ketan_patel@cloudshell:~ (new-user-learning)$ cd simulation/

ketan_patel@cloudshell:~/simulation (new-user-learning)$ ls

plannerlite.py planner.m planner_types.py

ketan_patel@cloudshell:~/simulation (new-user-learning)$

Bitnami Compute Instance.

How to use Google Cloud Marketplace to quickly and easily deploy a LAMP stack on a Compute Engine instance.

The Bitnami LAMP Stack provides a complete web development environment for Linux that can be launched in one click.

Component Role

Linux Operating system

Apache HTTP Server Web server

MySQL Relational database

PHP Web application framework

phpMyAdmin PHP administration tool

Bitnami makes it easy to get your favorite open source software up and running on any platform, including your laptop, Kubernetes and all the major clouds.

In addition to popular community offerings, Bitnami, now part of VMware, provides IT organizations with an enterprise offering that is secure, compliant, continuously maintained and customizable to your organizational policies.

student_02_3793a581291f@cloudshell:~ (qwiklabs-gcp-02-d2deaff99833)$ gcloud compute ssh --zone "us-east4-b" "lampstack-1-vm" --project "qwiklabs-gcp-02-d2deaff99833"

WARNING: The private SSH key file for gcloud does not exist.

WARNING: The public SSH key file for gcloud does not exist.

WARNING: You do not have an SSH key for gcloud.

WARNING: SSH keygen will be executed to generate a key.

This tool needs to create the directory [/home/student_02_3793a581291f/.ssh] before being able to generate SSH keys.

Do you want to continue (Y/n)? Y

Generating public/private rsa key pair.

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

Your identification has been saved in /home/student_02_3793a581291f/.ssh/google_compute_engine

Your public key has been saved in /home/student_02_3793a581291f/.ssh/google_compute_engine.pub

The key fingerprint is:

SHA256:3tyRqZEhvMD82wyaPnOdc9bkWls2lVtjX8WMoNQJYOs student_02_3793a581291f@cs-994566895530-default

The key's randomart image is:

+---[RSA 3072]----+

| o.oo.. |

| o o o .o. + |

| + + o . +|

| + o o o o|

| E o + ++|

| + B + .o B|

| o o.*..+.o+|

| .o . + o.o+.|

| .+ +... |

+----[SHA256]-----+

Warning: Permanently added 'compute.7447842227785294401' (ECDSA) to the list of known hosts.

Linux lampstack-1-vm 5.10.0-23-cloud-amd64 #1 SMP Debian 5.10.179-3 (2023-07-27) x86_64

The programs included with the Debian GNU/Linux system are free software;

the exact distribution terms for each program are described in the

individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent

permitted by applicable law.

___ _ _ _

| _ |_) |_ _ _ __ _ _ __ (_)

| _ \ | _| ' \/ _` | ' \| |

|___/_|\__|_|_|\__,_|_|_|_|_|

*** Welcome to the LAMP packaged by Bitnami 8.2.9-0 ***

*** Documentation: https://docs.bitnami.com/google/infrastructure/lamp/ ***

*** https://docs.bitnami.com/google/ ***

*** Bitnami Forums: https://github.com/bitnami/vms/ ***

Creating directory '/home/student-02-3793a581291f'.

student-02-3793a581291f@lampstack-1-vm:~$

student-02-3793a581291f@lampstack-1-vm:~$ cd /opt/bitnami

student-02-3793a581291f@lampstack-1-vm:/opt/bitnami$

student-02-3793a581291f@lampstack-1-vm:/opt/bitnami$ sudo sh -c 'echo "<?php phpinfo(); ?>" > apache2/htdocs/phpinfo.php'

student-02-3793a581291f@lampstack-1-vm:/opt/bitnami$

student-02-3793a581291f@lampstack-1-vm:/opt/bitnami$ cat apache2/htdocs/phpinfo.php

<?php phpinfo(); ?>

student-02-3793a581291f@lampstack-1-vm:/opt/bitnami$

http://35.230.181.112/phpinfo.php

Gcloud Config - Set

ketan_patel@cloudshell:~$ gcloud config list

[accessibility]

screen_reader = True

[component_manager]

disable_update_check = True

[compute]

gce_metadata_read_timeout_sec = 30

[core]

account = ketan.patel@supernal.aero

disable_usage_reporting = True

[metrics]

environment = devshell

Your active configuration is: [cloudshell-3398]

ketan_patel@cloudshell:~$ gcloud config set project new-user-learning

Updated property [core/project].

ketan_patel@cloudshell:~ (new-user-learning)$ gcloud config list

[accessibility]

screen_reader = True

[component_manager]

disable_update_check = True

[compute]

gce_metadata_read_timeout_sec = 30

[core]

account = ketan.patel@supernal.aero

disable_usage_reporting = True

project = new-user-learning

[metrics]

environment = devshell

Your active configuration is: [cloudshell-3398]

ketan_patel@cloudshell:~ (new-user-learning)$ gcloud config set compute/zone us-central1

WARNING: us-central1 is not a valid zone. Run `gcloud compute zones list` to get all zones.

Are you sure you wish to set property [compute/zone] to us-central1?

Do you want to continue (Y/n)? Y

Updated property [compute/zone].

ketan_patel@cloudshell:~ (new-user-learning)$ gcloud config list

[accessibility]

screen_reader = True

[component_manager]

disable_update_check = True

[compute]

gce_metadata_read_timeout_sec = 30

zone = us-central1

[core]

account = ketan.patel@supernal.aero

disable_usage_reporting = True

project = new-user-learning

[metrics]

environment = devshell

Your active configuration is: [cloudshell-1884]

ketan_patel@cloudshell:~ (new-user-learning)$

Install the gcloud CLI on Ubuntu

It has apt-transport-https and curl installed:

sudo apt-get update

sudo apt-get install apt-transport-https ca-certificates gnupg curl sudo

===============

echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list

curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key --keyring /usr/share/keyrings/cloud.google.gpg add -

sudo apt-get update && sudo apt-get install google-cloud-cli

gcloud version

gcloud init

gcloud config list

gcloud auth list

=====================

Installation

1) Add the gcloud CLI distribution URI as a package source.

If your distribution supports the signed-by option, run the following command

$ echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list

2)Import the Google Cloud public key.

If your distribution's apt-key command supports the --keyring argument, run the following command:

$ curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key --keyring /usr/share/keyrings/cloud.google.gpg add -

3) Update and install the gcloud CLI:

$ sudo apt-get update && sudo apt-get install google-cloud-cli

ketan@ketanvm1:~$

ketan@ketanvm1:~$ sudo apt-get update

Hit:1 http://azure.archive.ubuntu.com/ubuntu focal InRelease

Hit:2 http://azure.archive.ubuntu.com/ubuntu focal-updates InRelease

Hit:3 http://azure.archive.ubuntu.com/ubuntu focal-backports InRelease

Hit:4 http://azure.archive.ubuntu.com/ubuntu focal-security InRelease

Hit:5 https://apt.releases.hashicorp.com focal InRelease

Hit:6 https://packages.microsoft.com/repos/azure-cli focal InRelease

Reading package lists... Done

ketan@ketanvm1:~$

ketan@ketanvm1:~$ sudo apt-get install apt-transport-https ca-certificates gnupg curl sudo

Reading package lists... Done

Building dependency tree

Reading state information... Done

ca-certificates is already the newest version (20230311ubuntu0.20.04.1).

ca-certificates set to manually installed.

curl is already the newest version (7.68.0-1ubuntu2.19).

gnupg is already the newest version (2.2.19-3ubuntu2.2).

sudo is already the newest version (1.8.31-1ubuntu1.5).

sudo set to manually installed.

apt-transport-https is already the newest version (2.0.9).

0 upgraded, 0 newly installed, 0 to remove and 14 not upgraded.

ketan@ketanvm1:~$ echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list

deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main

ketan@ketanvm1:~$ cd /etc/apt/sources.list.d/

ketan@ketanvm1:/etc/apt/sources.list.d$ ls -l

total 12

-rw-r--r-- 1 root root 76 Jun 23 17:27 azure-cli.list

-rw-r--r-- 1 root root 106 Aug 20 20:52 google-cloud-sdk.list

-rw-r--r-- 1 root root 112 Jun 23 18:07 hashicorp.list

ketan@ketanvm1:/etc/apt/sources.list.d$ cat google-cloud-sdk.list

deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main

ketan@ketanvm1:$ curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key --keyring /usr/share/keyrings/cloud.google.gpg add -

% Total % Received % Xferd Average Speed Time Time Time Current

Dload Upload Total Spent Left Speed

100 2659 100 2659 0 0 40907 0 --:--:-- --:--:-- --:--:-- 40907

ketan@ketanvm1:/etc/apt/sources.list.d$ sudo apt-get update && sudo apt-get install google-cloud-cli

Hit:1 https://apt.releases.hashicorp.com focal InRelease

Hit:2 https://packages.microsoft.com/repos/azure-cli focal InRelease

Get:3 https://packages.cloud.google.com/apt cloud-sdk InRelease [6361 B]

Hit:4 http://azure.archive.ubuntu.com/ubuntu focal InRelease

Hit:5 http://azure.archive.ubuntu.com/ubuntu focal-updates InRelease

Hit:6 http://azure.archive.ubuntu.com/ubuntu focal-backports InRelease

Hit:7 http://azure.archive.ubuntu.com/ubuntu focal-security InRelease

Get:8 https://packages.cloud.google.com/apt cloud-sdk/main amd64 Packages [497 kB]

Fetched 503 kB in 1s (575 kB/s)

Reading package lists... Done

Building dependency tree

Reading state information... Done

Suggested packages:

google-cloud-cli-app-engine-java google-cloud-cli-app-engine-python

google-cloud-cli-pubsub-emulator google-cloud-cli-bigtable-emulator

google-cloud-cli-datastore-emulator kubectl

The following NEW packages will be installed:

google-cloud-cli

0 upgraded, 1 newly installed, 0 to remove and 14 not upgraded.

Need to get 153 MB of archives.

After this operation, 754 MB of additional disk space will be used.

Get:1 https://packages.cloud.google.com/apt cloud-sdk/main amd64 google-cloud-cli all 443.0.0-0 [153 MB]

Fetched 153 MB in 4s (40.7 MB/s)

Selecting previously unselected package google-cloud-cli.

(Reading database ... 157479 files and directories currently installed.)

Preparing to unpack .../google-cloud-cli_443.0.0-0_all.deb ...

Unpacking google-cloud-cli (443.0.0-0) ...

Setting up google-cloud-cli (443.0.0-0) ...

Processing triggers for man-db (2.9.1-1) ...

ketan@ketanvm1:/etc/apt/sources.list.d$

Initialize the Google Cloud environment

CONNECT TO GCP

GCLOUD INIT:

ketan@ketanvm1:$ gcloud init

Welcome! This command will take you through the configuration of gcloud.

Your current configuration has been set to: [default]

You can skip diagnostics next time by using the following flag:

gcloud init --skip-diagnostics

Network diagnostic detects and fixes local network connection issues.

Checking network connection...done.

Reachability Check passed.

Network diagnostic passed (1/1 checks passed).

You must log in to continue. Would you like to log in (Y/n)? Y

Go to the following link in your browser:

https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=32555940559.apps.googleusercontent.com&redirect_uri=https%3A%2F%2Fsdk.cloud.google.com%2Fauthcode.html&scope=openid+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcloud-platform+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fappengine.admin+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fsqlservice.login+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcompute+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Faccounts.reauth&state=HB8P9CYVuo1HZZexWhJkT3LWOPWDCS&prompt=consent&access_type=offline&code_challenge=4G42sXXXXXXXXXXXXXXXXXXXXXXdpZaBWI&code_challenge_method=S256

COPY AND PASTE ABOVE URL IN BROWSER AND GET AUTHORIZATION KEY:

Enter authorization code: 4/0AdeuxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxkunJW6TReCIPVxxxxxxxX

You are logged in as: [ketan@ABC.COM].

Pick cloud project to use:

[1] cosm

[2] dvs

[3] dv

[4] new-user

[5] sim-

[6] sim-p

[7] sim-s

[8] sp-g

[9] svo-m

[10] ucsd-b

[11] Enter a project ID

[12] Create a new project

Please enter numeric choice or text value (must exactly match list item): 4

Your current project has been set to: [new-user-learning].

Do you want to configure a default Compute Region and Zone? (Y/n)? Y

Which Google Compute Engine zone would you like to use as project default?

If you do not specify a zone via a command line flag while working with Compute Engine resources, the default is assumed.

[1] us-east1-b

[2] us-east1-c

[3] us-east1-d

[4] us-east4-c

[5] us-east4-b

[6] us-east4-a

[7] us-central1-c

[8] us-central1-a

[9] us-central1-f

[10] us-central1-b

[11] us-west1-b

[12] us-west1-c

[13] us-west1-a

[14] europe-west4-a

[15] europe-west4-b

[16] europe-west4-c

[17] europe-west1-b

[18] europe-west1-d

[19] europe-west1-c

[20] europe-west3-c

[21] europe-west3-a

[22] europe-west3-b

[23] europe-west2-c

[24] europe-west2-b

[25] europe-west2-a

[26] asia-east1-b

[27] asia-east1-a

[28] asia-east1-c

[29] asia-southeast1-b

[30] asia-southeast1-a

[31] asia-southeast1-c

[32] asia-northeast1-b

[33] asia-northeast1-c

[34] asia-northeast1-a

[35] asia-south1-c

[36] asia-south1-b

[37] asia-south1-a

[38] australia-southeast1-b

[39] australia-southeast1-c

[40] australia-southeast1-a

[41] southamerica-east1-b

[42] southamerica-east1-c

[43] southamerica-east1-a

[44] asia-east2-a

[45] asia-east2-b

[46] asia-east2-c

[47] asia-northeast2-a

[48] asia-northeast2-b

[49] asia-northeast2-c

[50] asia-northeast3-a

Did not print [66] options.

Too many options [116]. Enter "list" at prompt to print choices fully.

Please enter numeric choice or text value (must exactly match list item): 13

Your project default Compute Engine zone has been set to [us-west1-a].

You can change it by running [gcloud config set compute/zone NAME].

Your project default Compute Engine region has been set to [us-west1].

You can change it by running [gcloud config set compute/region NAME].

Created a default .boto configuration file at [/home/ketan/.boto]. See this file and

[https://cloud.google.com/storage/docs/gsutil/commands/config] for more

information about configuring Google Cloud Storage.

Your Google Cloud SDK is configured and ready to use!

* Commands that require authentication will use ketan.patel@supernal.aero by default

* Commands will reference project `new-user-learning` by default

* Compute Engine commands will use region `us-west1` by default

* Compute Engine commands will use zone `us-west1-a` by default

Run `gcloud help config` to learn how to change individual settings

This gcloud configuration is called [default]. You can create additional configurations if you work with multiple accounts and/or projects.

Run `gcloud topic configurations` to learn more.

Some things to try next:

* Run `gcloud --help` to see the Cloud Platform services you can interact with. And run `gcloud help COMMAND` to get help on any gcloud command.

* Run `gcloud topic --help` to learn about advanced features of the SDK like arg files and output formatting

* Run `gcloud cheat-sheet` to see a roster of go-to `gcloud` commands.

ketan@ketanvm1:~$ gcloud auth list

Credentialed Accounts

ACTIVE ACCOUNT

* ketan@abc.com

To set the active account, run:

$ gcloud config set account `ACCOUNT`

ketan@ketanvm1:~$ gcloud config list

[compute]

region = us-west1

zone = us-west1-a

[core]

account = ketan@abc.com

disable_usage_reporting = True

project = new-user

Your active configuration is: [default]

ketan@ketanvm1:~$

GCLOUD CLI COMMANDS

ketan@ketanvm1:~$ echo `date` > ketandate

ketan@ketanvm1:~$ cat ketandate

Sun Aug 20 21:26:48 UTC 2023

ketan@ketanvm1:~$ gsutil ls

gs://ketanlearningbucket0818/

ketan@ketanvm1:~$ gsutil cp ketandate gs://ketanlearningbucket0818/

Copying file://ketandate [Content-Type=application/octet-stream]...

/ [1 files][ 29.0 B/ 29.0 B]

Operation completed over 1 objects/29.0 B.

ketan@ketanvm1:~$ gsutil ls gs://ketanlearningbucket0818/

gs://ketanlearningbucket0818/ketandate

ketan@ketanvm1:~$ gcloud compute networks list

NAME SUBNET_MODE BGP_ROUTING_MODE IPV4_RANGE GATEWAY_IPV4

default AUTO REGIONAL

ketan@ketanvm1:~$ gcloud components list

Your current Google Cloud CLI version is: 443.0.0

The latest available version is: 443.0.0

┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐

│ Components │

├───────────────┬──────────────────────────────────────────────────────┬──────────────────────────────┬──────────┤

│ Status │ Name │ ID │ Size │

├───────────────┼──────────────────────────────────────────────────────┼──────────────────────────────┼──────────┤

│ Not Installed │ App Engine Go Extensions │ app-engine-go │ 4.5 MiB │

│ Not Installed │ Appctl │ appctl │ 21.0 MiB │

│ Not Installed │ Artifact Registry Go Module Package Helper │ package-go-module │ < 1 MiB │

│ Not Installed │ Cloud Bigtable Command Line Tool │ cbt │ 11.4 MiB │

│ Not Installed │ Cloud Bigtable Emulator │ bigtable │ 7.0 MiB │

│ Not Installed │ Cloud Datastore Emulator │ cloud-datastore-emulator │ 36.2 MiB │

│ Not Installed │ Cloud Firestore Emulator │ cloud-firestore-emulator │ 42.5 MiB │

│ Not Installed │ Cloud Pub/Sub Emulator │ pubsub-emulator │ 61.2 MiB │

│ Not Installed │ Cloud Run Proxy │ cloud-run-proxy │ 13.4 MiB │

│ Not Installed │ Cloud SQL Proxy │ cloud_sql_proxy │ 7.8 MiB │

│ Not Installed │ Cloud Spanner Emulator │ cloud-spanner-emulator │ 31.4 MiB │

│ Not Installed │ Cloud Spanner Migration Tool │ harbourbridge │ 20.9 MiB │

│ Not Installed │ Google Container Registry's Docker credential helper │ docker-credential-gcr │ 1.8 MiB │

│ Not Installed │ Kustomize │ kustomize │ 4.3 MiB │

│ Not Installed │ Log Streaming │ log-streaming │ 13.9 MiB │

│ Not Installed │ Minikube │ minikube │ 34.6 MiB │

│ Not Installed │ Nomos CLI │ nomos │ 26.4 MiB │

│ Not Installed │ On-Demand Scanning API extraction helper │ local-extract │ 14.4 MiB │

│ Not Installed │ Skaffold │ skaffold │ 22.7 MiB │

│ Not Installed │ Spanner migration tool │ spanner-migration-tool │ 20.9 MiB │

│ Not Installed │ Terraform Tools │ terraform-tools │ 66.1 MiB │

│ Not Installed │ anthos-auth │ anthos-auth │ 20.4 MiB │

│ Not Installed │ config-connector │ config-connector │ 56.7 MiB │

│ Not Installed │ enterprise-certificate-proxy │ enterprise-certificate-proxy │ 8.2 MiB │

│ Not Installed │ gcloud app Java Extensions │ app-engine-java │ 64.9 MiB │

│ Not Installed │ gcloud app Python Extensions │ app-engine-python │ 8.5 MiB │

│ Not Installed │ gcloud app Python Extensions (Extra Libraries) │ app-engine-python-extras │ 27.3 MiB │

│ Not Installed │ gke-gcloud-auth-plugin │ gke-gcloud-auth-plugin │ 7.9 MiB │

│ Not Installed │ kpt │ kpt │ 14.5 MiB │

│ Not Installed │ kubectl │ kubectl │ < 1 MiB │

│ Not Installed │ kubectl-oidc │ kubectl-oidc │ 20.4 MiB │

│ Not Installed │ pkg │ pkg │ │

│ Installed │ BigQuery Command Line Tool │ bq │ 1.6 MiB │

│ Installed │ Bundled Python 3.9 │ bundled-python3-unix │ 63.6 MiB │

│ Installed │ Cloud Storage Command Line Tool │ gsutil │ 11.3 MiB │

│ Installed │ Google Cloud CLI Core Libraries │ core │ 21.5 MiB │

│ Installed │ Google Cloud CRC32C Hash Tool │ gcloud-crc32c │ 1.2 MiB │

│ Installed │ gcloud Alpha Commands │ alpha │ < 1 MiB │

│ Installed │ gcloud Beta Commands │ beta │ < 1 MiB │

└───────────────┴──────────────────────────────────────────────────────┴──────────────────────────────┴──────────┘

To install or remove components at your current SDK version [443.0.0], run:

$ gcloud components install COMPONENT_ID

$ gcloud components remove COMPONENT_ID

To update your SDK installation to the latest version [443.0.0], run:

$ gcloud components update

ketan@ketanvm1:~$ gcloud compute firewall-rules list

NAME NETWORK DIRECTION PRIORITY ALLOW DENY DISABLED

default-allow-icmp default INGRESS 65534 icmp False

default-allow-internal default INGRESS 65534 tcp:0-65535,udp:0-65535,icmp False

default-allow-rdp default INGRESS 65534 tcp:3389 False

default-allow-ssh default INGRESS 65534 tcp:22 False

To show all fields of the firewall, please show in JSON format: --format=json

To show all fields in table format, please see the examples in --help.

ketan@ketanvm1:~$ gcloud compute instances list

Listed 0 items.

ketan@ketanvm1:~$

Google Cloud Packet Mirroring with OpenSource IDS

Traffic Mirroring is a key feature in Google Cloud networking for security and network analysis. Its functionality is similar to that of a network tap or a span session in traditional networking. In short, Packet Mirroring captures network traffic (ingress and egress) from select "mirrored sources", copies the traffic, and forwards the copy to "collectors".

It is important to note that Packet Mirroring captures the full payload of each packet and thus consumes additional bandwidth. Because Packet Mirroring is not based on any sampling period, it is able to be used for better troubleshooting, security solutions, and higher layer application based analysis.

Packet Mirroring is founded on a "Packet Mirroring Policy", which contains the following attributes:

Region
VPC Network(s)
Mirrored Source(s)
Collector (destination)
Mirrored traffic (filter)

Here are a some key points that also need to be considered:

Only TCP, UDP and ICMP traffic may be mirrored. This, however, should satisfy the majority of use cases.
"Mirrored Sources" and "Collectors" must be in the SAME Region, but can be in different zones and even different VPCs, as long as those VPCs are properly Peered.
Additional bandwidth charges apply, especially between zones. To limit the traffic being mirrored, filters can be used.

One prime use case for "Packet Mirroring" is to use it in an Intrusion Detection System (IDS) solution. Some cloud-based IDS solutions require a special service to run on each source VM, or to put an IDS virtual appliance in-line between the network source and destination. Both of these have significant implications. For example, the service based solution, though fully distributed, requires that the guest operating system supports the software. The "in-line" solution can create a network bottleneck as all traffic must be funneled through the IDS appliance. The in-line solution will also not be able to capture "east-west" traffic within VMs in the same VPC.

Google Cloud Packet Mirroring does not require any additional software on the VMs and it is fully distributed across each of the mirrored virtual machines. The "Collector" IDS is placed out-of-path using an Internal Network Load Balancer (ILB) and will receive both "north-south" traffic and "east-west" traffic.

Packet Mirroring lab description

To demonstrate how Packet Mirroring can be used with an IDS consider this example using OpenSource IDS Suricata.

A single VPC with 2 subnets, one for mirrored sources and one for the collector
2 Web servers created with a public IP address
1 Collector server (IDS) created with NO public IP for security reasons
CloudNAT enabled for Internet access as needed
All VMs created in the same region and zone, for simplicity and cost reasons

In this lab you will create a Google Cloud environment, configure the "Collector" ILB, configure the Packet Mirror Policy, as well as install and configure [Suricata] (https://suricata-ids.org/) on a virtual instance to act as an IDS. Once complete, network tests will be performed to validate the configuration and use of Packet Mirroring with the Open Source IDS. A very stripped down rule-set and Suricata configuration is used to simplify the demonstration.

Google Cloud environment diagram

Objectives:

Build out a Google Cloud Networking environment as shown in the diagram above

Create 2 virtual machines with gcloud commands to act as WEB SERVERS

Create a single virtual machine with gcloud commands to act as IDS

Create an Internal LoadBalancer (ILB) to act as a "collector" for Packet Mirroring

Install and configure an Open Source IDS (Suricata) on the IDS VM

Review some basic IDS alert rules

Create a Packet Mirror Policy

Test Packet Mirroring by generating network traffic to the "mirrored" subnet

Test Suricata IDS by generating network traffic to simulate an IDS event and review IDS logging

BUILD LAB:

student_04_6d7b0b6748d9@cloudshell:~ (qwiklabs-gcp-03-983f2e6b9894)$ history

1 gcloud compute networks create dm-stamford --subnet-mode=custom

2 gcloud compute networks subnets create dm-stamford-uswest4 --range=172.21.0.0/24 --network=dm-stamford --region=us-west4

3 gcloud compute networks subnets create dm-stamford-uswest4-ids --range=172.21.1.0/24 --network=dm-stamford --region=us-west4

4 gcloud compute firewall-rules create fw-dm-stamford-allow-any-web --direction=INGRESS --priority=1000 --network=dm-stamford --action=ALLOW --rules=tcp:80,icmp --source-ranges=0.0.0.0/0

5 gcloud compute firewall-rules create fw-dm-stamford-ids-any-any --direction=INGRESS --priority=1000 --network=dm-stamford --action=ALLOW --rules=all --source-ranges=0.0.0.0/0 --target-tags=ids

6 gcloud compute firewall-rules create fw-dm-stamford-iapproxy --direction=INGRESS --priority=1000 --network=dm-stamford --action=ALLOW --rules=tcp:22,icmp --source-ranges=35.235.240.0/20

7 gcloud compute routers create router-stamford-nat-west4 --region=us-west4 --network=dm-stamford

8 gcloud compute routers nats create nat-gw-dm-stamford-west4 --router=router-stamford-nat-west4 --router-region=us-west4 --auto-allocate-nat-external-ips --nat-all-subnet-ip-ranges

9 gcloud compute instance-templates create template-dm-stamford-web-us-west4 --region=us-west4 --network=dm-stamford --subnet=dm-stamford-uswest4 --machine-type=g1-small --image=ubuntu-1604-xenial-v20200807 --image-project=ubuntu-os-cloud --tags=webserver --metadata=startup-script='#! /bin/bash

apt-get update

apt-get install apache2 -y

vm_hostname="$(curl -H "Metadata-Flavor:Google" \

http://169.254.169.254/computeMetadata/v1/instance/name)"

echo "Page served from: $vm_hostname" | \

tee /var/www/html/index.html

systemctl restart apache2'

10 gcloud compute instance-groups managed create mig-dm-stamford-web-uswest4 --template=template-dm-stamford-web-us-west4 --size=2 --zone=us-west4-a

11 gcloud compute instance-templates create template-dm-stamford-ids-us-west4 --region=us-west4 --network=dm-stamford --no-address --subnet=dm-stamford-uswest4-ids --image=ubuntu-1604-xenial-v20200807 --image-project=ubuntu-os-cloud --tags=ids,webserver --metadata=startup-script='#! /bin/bash

apt-get update

apt-get install apache2 -y

vm_hostname="$(curl -H "Metadata-Flavor:Google" \

http://169.254.169.254/computeMetadata/v1/instance/name)"

echo "Page served from: $vm_hostname" | \

tee /var/www/html/index.html

systemctl restart apache2'

12 gcloud compute instance-groups managed create mig-dm-stamford-ids-uswest4 --template=template-dm-stamford-ids-us-west4 --size=1 --zone=us-west4-a

13 gcloud compute health-checks create tcp hc-tcp-80 --port 80

14 gcloud compute backend-services create be-dm-stamford-suricata-us-west4 --load-balancing-scheme=INTERNAL --health-checks=hc-tcp-80 --network=dm-stamford --protocol=TCP --region=us-west4

15 gcloud compute backend-services add-backend be-dm-stamford-suricata-us-west4 --instance-group=mig-dm-stamford-ids-uswest4 --instance-group-zone=us-west4-a --region=us-west4

16 gcloud compute packet-mirrorings create mirror-dm-stamford-web --collector-ilb=ilb-dm-stamford-suricata-ilb-us-west4 --network=dm-stamford --mirrored-subnets=dm-stamford-uswest4 --region=us-west4

17 gcloud compute instances list

18 sudo tcpdump -i ens4 -nn -n "(icmp or port 80) and net 172.21.0.0/24"

19 sudo apt install iputils-ping

20 ping -c 4 34.125.170.248

21 ping -c 4 34.125.91.185

22 history

student_04_6d7b0b6748d9@cloudshell:~ (qwiklabs-gcp-03-983f2e6b9894)$

INSTALL IDS software and test lab.

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ history

1 sudo apt-get update -y

2 sudo apt-get install libpcre3-dbg libpcre3-dev autoconf automake libtool libpcap-dev libnet1-dev libyaml-dev zlib1g-dev libcap-ng-dev libmagic-dev libjansson-dev libjansson4 -y

3 sudo apt-get install libnspr4-dev -y

4 sudo apt-get install libnss3-dev -y

5 sudo apt-get install liblz4-dev -y

6 sudo apt install rustc cargo -y

8 sudo add-apt-repository ppa:oisf/suricata-stable -y

9 sudo apt-get update -y

10 sudo apt-get install suricata -y

11 suricata -V

12 sudo systemctl stop suricata

13 sudo cp /etc/suricata/suricata.yaml /etc/suricata/suricata.backup

14 wget https://storage.googleapis.com/tech-academy-enablement/GCP-Packet-Mirroring-with-OpenSource-IDS/suricata.yaml

15 wget https://storage.googleapis.com/tech-academy-enablement/GCP-Packet-Mirroring-with-OpenSource-IDS/my.rules

16 sudo mkdir /etc/suricata/poc-rules

17 sudo cp my.rules /etc/suricata/poc-rules/my.rules

18 /etc/suricata/poc-rules/my.rules

19 sudo cp suricata.yaml /etc/suricata/suricata.yaml

20 sudo systemctl start suricata

21 sudo systemctl restart suricata

22 cat /etc/suricata/poc-rules/my.rules

23 sudo tcpdump -i ens4 -nn -n "(icmp or port 80) and net 172.21.0.0/24"

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ sudo add-apt-repository ppa:oisf/suricata-stable -ygpg: keyring `/tmp/tmpsvkw80sy/secring.gpg' created

gpg: keyring `/tmp/tmpsvkw80sy/pubring.gpg' created

gpg: requesting key 66EB736F from hkp server keyserver.ubuntu.com

gpg: /tmp/tmpsvkw80sy/trustdb.gpg: trustdb created

gpg: key 66EB736F: public key "Launchpad PPA for Peter Manev" imported

gpg: Total number processed: 1

gpg: imported: 1 (RSA: 1)

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ sudo apt-get update -y

Hit:1 http://us-west4.gce.archive.ubuntu.com/ubuntu xenial InRelease

Hit:2 http://us-west4.gce.archive.ubuntu.com/ubuntu xenial-updates InRelease

Hit:3 http://us-west4.gce.archive.ubuntu.com/ubuntu xenial-backports InRelease

Get:4 http://security.ubuntu.com/ubuntu xenial-security InRelease [99.8 kB]

Hit:5 http://archive.canonical.com/ubuntu xenial InRelease

Get:6 http://ppa.launchpad.net/oisf/suricata-stable/ubuntu xenial InRelease [17.5 kB]

Get:7 http://ppa.launchpad.net/oisf/suricata-stable/ubuntu xenial/main amd64 Packages [1,396 B]

Get:8 http://ppa.launchpad.net/oisf/suricata-stable/ubuntu xenial/main Translation-en [1,204 B]

Fetched 120 kB in 1s (109 kB/s)

Reading package lists... Done

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ sudo apt-get install suricata -y

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ suricata -V

This is Suricata version 6.0.3 RELEASE

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ sudo systemctl stop suricata

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ sudo cp /etc/suricata/suricata.yaml /etc/suricata/suricata.backup

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ wget https://storage.googleapis.com/tech-academy-enablement/GCP-Packet-Mirroring-with-OpenSource-IDS/suricata.yaml

--2023-08-05 22:08:51-- https://storage.googleapis.com/tech-academy-enablement/GCP-Packet-Mirroring-with-OpenSource-IDS/suricata.yaml

Resolving storage.googleapis.com (storage.googleapis.com)... 142.251.2.128, 74.125.137.128, 142.250.101.128, ...

Connecting to storage.googleapis.com (storage.googleapis.com)|142.251.2.128|:443... connected.

HTTP request sent, awaiting response... 200 OK

Length: 70565 (69K) [application/x-yaml]

Saving to: ‘suricata.yaml’

suricata.yaml 100%[==========================================>] 68.91K --.-KB/s in 0.001s

2023-08-05 22:08:51 (96.8 MB/s) - ‘suricata.yaml’ saved [70565/70565]

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ wget https://storage.googleapis.com/tech-academy-enablement/GCP-Packet-Mirroring-with-OpenSource-IDS/my.rules

--2023-08-05 22:09:05-- https://storage.googleapis.com/tech-academy-enablement/GCP-Packet-Mirroring-with-OpenSource-IDS/my.rules

Resolving storage.googleapis.com (storage.googleapis.com)... 142.251.2.128, 74.125.137.128, 142.250.101.128, ...

Connecting to storage.googleapis.com (storage.googleapis.com)|142.251.2.128|:443... connected.

HTTP request sent, awaiting response... 200 OK

Length: 422 [application/octet-stream]

Saving to: ‘my.rules’

my.rules 100%[==========================================>] 422 --.-KB/s in 0s

2023-08-05 22:09:05 (49.1 MB/s) - ‘my.rules’ saved [422/422]

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ sudo mkdir /etc/suricata/poc-rules

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ sudo cp my.rules /etc/suricata/poc-rules/my.rules

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ sudo cp suricata.yaml /etc/suricata/suricata.yaml

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ sudo systemctl start suricata

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ sudo systemctl restart suricata

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ cat /etc/suricata/poc-rules/my.rules

####RULES#####

#UDP ALERTS

alert udp $HOME_NET any -> 8.8.8.8 53 (msg:"BAD UDP DNS REQUEST"; sid:99996; rev:1;)

#HTTP ALERTS

alert http any any -> $HOME_NET 80 (msg:"BAD HTTP PHP REQUEST"; http.uri; content:"index.php"; sid:99997; rev:1;)

#ICMP ALERTS

alert icmp any any -> $HOME_NET any (msg:"BAD ICMP"; sid:99998; rev:1;)

#TCP ALERTS

alert tcp $HOME_NET any -> any 6667 (msg:"BAD TCP 6667 REQUEST"; sid:99999; rev:1;)student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ sudo tcpdump -i ens4 -nn -n "(icmp or port 80) and net 172.21.0.0/24"

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on ens4, link-type EN10MB (Ethernet), capture size 262144 bytes

22:13:25.844115 IP 35.230.28.46 > 172.21.0.3: ICMP echo request, id 65442, seq 1, length 64

22:13:25.845292 IP 172.21.0.3 > 35.230.28.46: ICMP echo reply, id 65442, seq 1, length 64

22:13:26.845271 IP 35.230.28.46 > 172.21.0.3: ICMP echo request, id 65442, seq 2, length 64

22:13:26.845374 IP 172.21.0.3 > 35.230.28.46: ICMP echo reply, id 65442, seq 2, length 64

22:13:27.846825 IP 35.230.28.46 > 172.21.0.3: ICMP echo request, id 65442, seq 3, length 64

22:13:27.846917 IP 172.21.0.3 > 35.230.28.46: ICMP echo reply, id 65442, seq 3, length 64

22:13:28.848784 IP 35.230.28.46 > 172.21.0.3: ICMP echo request, id 65442, seq 4, length 64

22:13:28.848899 IP 172.21.0.3 > 35.230.28.46: ICMP echo reply, id 65442, seq 4, length 64

22:13:43.538816 IP 35.230.28.46 > 172.21.0.2: ICMP echo request, id 296, seq 1, length 64

22:13:43.540182 IP 172.21.0.2 > 35.230.28.46: ICMP echo reply, id 296, seq 1, length 64

22:13:44.539496 IP 35.230.28.46 > 172.21.0.2: ICMP echo request, id 296, seq 2, length 64

22:13:44.539648 IP 172.21.0.2 > 35.230.28.46: ICMP echo reply, id 296, seq 2, length 64

22:13:45.541106 IP 35.230.28.46 > 172.21.0.2: ICMP echo request, id 296, seq 3, length 64

22:13:45.541236 IP 172.21.0.2 > 35.230.28.46: ICMP echo reply, id 296, seq 3, length 64

22:13:46.542448 IP 35.230.28.46 > 172.21.0.2: ICMP echo request, id 296, seq 4, length 64

22:13:46.542565 IP 172.21.0.2 > 35.230.28.46: ICMP echo reply, id 296, seq 4, length 64

22:14:13.612270 IP 136.226.79.33.29119 > 172.21.0.3.80: Flags [S], seq 177583878, win 65535, options [mss 1460,nop,wscale 5,sackOK,TS val 17006898 ecr 0], length 0

22:14:13.613553 IP 172.21.0.3.80 > 136.226.79.33.29119: Flags [S.], seq 3771805674, ack 177583879, win 64768, options [mss 1420,sackOK,TS val 1341901328 ecr 17006898,nop,wscale 7], length 0

22:14:13.629772 IP 136.226.79.33.29119 > 172.21.0.3.80: Flags [.], ack 1, win 2068, options [nop,nop,TS val 17006901 ecr 1341901328], length 0

22:14:13.629802 IP 136.226.79.33.29119 > 172.21.0.3.80: Flags [P.], seq 1:470, ack 1, win 2068, options [nop,nop,TS val 17006901 ecr 1341901328], length 469: HTTP: GET / HTTP/1.1

22:14:13.629890 IP 172.21.0.3.80 > 136.226.79.33.29119: Flags [.], ack 470, win 503, options [nop,nop,TS val 1341901345 ecr 17006901], length 0

22:14:13.630326 IP 172.21.0.3.80 > 136.226.79.33.29119: Flags [P.], seq 1:335, ack 470, win 503, options [nop,nop,TS val 1341901346 ecr 17006901], length 334: HTTP: HTTP/1.1 200 OK

22:14:13.731802 IP 136.226.79.33.29119 > 172.21.0.3.80: Flags [.], ack 335, win 2068, options [nop,nop,TS val 17006913 ecr 1341901346], length 0

22:14:13.927417 IP 136.226.79.33.29119 > 172.21.0.3.80: Flags [P.], seq 470:882, ack 335, win 2068, options [nop,nop,TS val 17006934 ecr 1341901346], length 412: HTTP: GET /favicon.ico HTTP/1.1

22:14:13.927735 IP 172.21.0.3.80 > 136.226.79.33.29119: Flags [P.], seq 335:827, ack 882, win 501, options [nop,nop,TS val 1341901643 ecr 17006934], length 492: HTTP: HTTP/1.1 404 Not Found

22:14:14.028150 IP 136.226.79.33.29119 > 172.21.0.3.80: Flags [.], ack 827, win 2068, options [nop,nop,TS val 17006946 ecr 1341901643], length 0

22:14:14.439507 IP 64.227.150.86.55489 > 172.21.0.2.80: Flags [S], seq 2437880717, win 65535, length 0

22:14:14.441258 IP 172.21.0.2.80 > 64.227.150.86.55489: Flags [S.], seq 235362896, ack 2437880718, win 65320, options [mss 1420], length 0

22:14:14.642951 IP 64.227.150.86.55489 > 172.21.0.2.80: Flags [R], seq 2437880718, win 0, length 0

22:14:18.834628 IP 172.21.0.3.80 > 136.226.79.33.29119: Flags [F.], seq 827, ack 882, win 501, options [nop,nop,TS val 1341906549 ecr 17006946], length 0

22:14:18.850822 IP 136.226.79.33.29119 > 172.21.0.3.80: Flags [.], ack 828, win 2068, options [nop,nop,TS val 17007481 ecr 1341906549], length 0

22:14:18.850834 IP 136.226.79.33.29119 > 172.21.0.3.80: Flags [R.], seq 882, ack 828, win 2068, options [nop,nop,TS val 17007481 ecr 1341906549], length 0

22:14:30.471656 IP 136.226.79.33.31101 > 172.21.0.2.80: Flags [S], seq 2919054858, win 65535, options [mss 1460,nop,wscale 5,sackOK,TS val 17008772 ecr 0], length 0

22:14:30.473083 IP 172.21.0.2.80 > 136.226.79.33.31101: Flags [S.], seq 2504697951, ack 2919054859, win 64768, options [mss 1420,sackOK,TS val 1834532093 ecr 17008772,nop,wscale 7], length 0

22:14:30.488585 IP 136.226.79.33.31101 > 172.21.0.2.80: Flags [.], ack 1, win 2068, options [nop,nop,TS val 17008774 ecr 1834532093], length 0

22:14:30.488591 IP 136.226.79.33.31101 > 172.21.0.2.80: Flags [P.], seq 1:469, ack 1, win 2068, options [nop,nop,TS val 17008774 ecr 1834532093], length 468: HTTP: GET / HTTP/1.1

22:14:30.488710 IP 172.21.0.2.80 > 136.226.79.33.31101: Flags [.], ack 469, win 503, options [nop,nop,TS val 1834532110 ecr 17008774], length 0

22:14:30.489427 IP 172.21.0.2.80 > 136.226.79.33.31101: Flags [P.], seq 1:335, ack 469, win 503, options [nop,nop,TS val 1834532110 ecr 17008774], length 334: HTTP: HTTP/1.1 200 OK

22:14:30.588957 IP 136.226.79.33.31101 > 172.21.0.2.80: Flags [.], ack 335, win 2068, options [nop,nop,TS val 17008786 ecr 1834532110], length 0

22:14:30.804022 IP 136.226.79.33.31101 > 172.21.0.2.80: Flags [P.], seq 469:879, ack 335, win 2068, options [nop,nop,TS val 17008809 ecr 1834532110], length 410: HTTP: GET /favicon.ico HTTP/1.1

22:14:30.804431 IP 172.21.0.2.80 > 136.226.79.33.31101: Flags [P.], seq 335:826, ack 879, win 501, options [nop,nop,TS val 1834532425 ecr 17008809], length 491: HTTP: HTTP/1.1 404 Not Found

22:14:30.903743 IP 136.226.79.33.31101 > 172.21.0.2.80: Flags [.], ack 826, win 2068, options [nop,nop,TS val 17008821 ecr 1834532425], length 0

22:14:35.713172 IP 172.21.0.2.80 > 136.226.79.33.31101: Flags [F.], seq 826, ack 879, win 501, options [nop,nop,TS val 1834537334 ecr 17008821], length 0

22:14:35.728581 IP 136.226.79.33.31101 > 172.21.0.2.80: Flags [.], ack 827, win 2068, options [nop,nop,TS val 17009357 ecr 1834537334], length 0

22:14:35.728590 IP 136.226.79.33.31101 > 172.21.0.2.80: Flags [R.], seq 879, ack 827, win 2068, options [nop,nop,TS val 17009357 ecr 1834537334], length 0

45 packets captured

45 packets received by filter

0 packets dropped by kernel

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

GENERATE LOG

7b0b6748d9@mig-dm-stamford-web-uswest4-6hsd:~$ dig @8.8.8.8 example.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> @8.8.8.8 example.com

; (1 server found)

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42717

;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 512

;; QUESTION SECTION:

;example.com. IN A

;; ANSWER SECTION:

example.com. 5421 IN A 93.184.216.34

;; Query time: 7 msec

;; SERVER: 8.8.8.8#53(8.8.8.8)

;; WHEN: Sat Aug 05 22:22:48 UTC 2023

;; MSG SIZE rcvd: 56

student-04-6d7b0b6748d9@mig-dm-stamford-web-uswest4-6hsd:~$ telnet 100.64.1.1 6667

Trying 100.64.1.1...

student-04-6d7b0b6748d9@mig-dm-stamford-web-uswest4-6hsd:~$

student-04-6d7b0b6748d9@mig-dm-stamford-web-uswest4-6hsd:~$ telnet 100.64.1.1 6667

Trying 100.64.1.1...

student-04-6d7b0b6748d9@mig-dm-stamford-web-uswest4-6hsd:~$

student-04-6d7b0b6748d9@mig-dm-stamford-web-uswest4-6hsd:~$ ping -c 3 34.125.170.248

PING 34.125.170.248 (34.125.170.248) 56(84) bytes of data.

64 bytes from 34.125.170.248: icmp_seq=1 ttl=61 time=1.91 ms

64 bytes from 34.125.170.248: icmp_seq=2 ttl=61 time=0.360 ms

64 bytes from 34.125.170.248: icmp_seq=3 ttl=61 time=0.379 ms

--- 34.125.170.248 ping statistics ---

3 packets transmitted, 3 received, 0% packet loss, time 2031ms

rtt min/avg/max/mdev = 0.360/0.886/1.919/0.730 ms

student-04-6d7b0b6748d9@mig-dm-stamford-web-uswest4-6hsd:~$

LOG in SURICATA:

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ egrep "BAD UDP DNS" /var/log/suricata/eve.json

@GCP: {"timestamp":"2023-08-05T22:22:48.698673+0000","flow_id":1651899379525937,"in_iface":"ens4","event_type":"alert","src_ip":"172.21.0.3","src_port":52318,"dest_ip":"8.8.8.8","dest_port":53,"proto":"UDP","alert":{"action":"allowed","gid":1,"signature_id":99996,"rev":1,"signature":"BAD UDP DNS REQUEST","category":"","severity":3},"dns":{"query":[{"type":"query","id":42717,"rrname":"example.com","rrtype":"A","tx_id":0}]},"app_proto":"dns","flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":82,"bytes_toclient":0,"start":"2023-08-05T22:22:48.698673+0000"}}

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ date

Sat Aug 5 22:23:10 UTC 2023

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ egrep "BAD TCP" /var/log/suricata/eve.json

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ egrep "BAD TCP" /var/log/suricata/eve.json

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ egrep "BAD TCP" /var/log/suricata/eve.json

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ egrep "BAD TCP" /var/log/suricata/eve.json

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ egrep "BAD TCP" /var/log/suricata/eve.json

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ egrep "BAD TCP" /var/log/suricata/eve.json

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ egrep "BAD" /var/log/suricata/eve.json

@GCP: {"timestamp":"2023-08-05T22:13:25.844115+0000","flow_id":1096727574995283,"in_iface":"ens4","event_type":"alert","src_ip":"35.230.28.46","src_port":0,"dest_ip":"172.21.0.3","dest_port":0,"proto":"ICMP","icmp_type":8,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":99998,"rev":1,"signature":"BAD ICMP","category":"","severity":3},"flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":98,"bytes_toclient":0,"start":"2023-08-05T22:13:25.844115+0000"}}

@GCP: {"timestamp":"2023-08-05T22:13:43.538816+0000","flow_id":778801211979968,"in_iface":"ens4","event_type":"alert","src_ip":"35.230.28.46","src_port":0,"dest_ip":"172.21.0.2","dest_port":0,"proto":"ICMP","icmp_type":8,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":99998,"rev":1,"signature":"BAD ICMP","category":"","severity":3},"flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":98,"bytes_toclient":0,"start":"2023-08-05T22:13:43.538816+0000"}}

@GCP: {"timestamp":"2023-08-05T22:16:32.406987+0000","flow_id":1852762090386891,"in_iface":"ens4","event_type":"alert","src_ip":"185.234.213.135","src_port":0,"dest_ip":"172.21.0.2","dest_port":0,"proto":"ICMP","icmp_type":8,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":99998,"rev":1,"signature":"BAD ICMP","category":"","severity":3},"flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":48,"bytes_toclient":0,"start":"2023-08-05T22:16:32.406987+0000"}}

@GCP: {"timestamp":"2023-08-05T22:16:46.871117+0000","flow_id":1322578443389645,"in_iface":"ens4","event_type":"alert","src_ip":"185.234.213.135","src_port":0,"dest_ip":"172.21.0.3","dest_port":0,"proto":"ICMP","icmp_type":8,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":99998,"rev":1,"signature":"BAD ICMP","category":"","severity":3},"flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":48,"bytes_toclient":0,"start":"2023-08-05T22:16:46.871117+0000"}}

@GCP: {"timestamp":"2023-08-05T22:17:38.543815+0000","flow_id":1597984634719303,"in_iface":"ens4","event_type":"alert","src_ip":"123.184.59.70","src_port":0,"dest_ip":"172.21.0.3","dest_port":0,"proto":"ICMP","icmp_type":8,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":99998,"rev":1,"signature":"BAD ICMP","category":"","severity":3},"flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":48,"bytes_toclient":0,"start":"2023-08-05T22:17:38.543815+0000"}}

@GCP: {"timestamp":"2023-08-05T22:17:40.163398+0000","flow_id":1638417456987718,"in_iface":"ens4","event_type":"alert","src_ip":"123.184.59.70","src_port":0,"dest_ip":"172.21.0.2","dest_port":0,"proto":"ICMP","icmp_type":8,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":99998,"rev":1,"signature":"BAD ICMP","category":"","severity":3},"flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":48,"bytes_toclient":0,"start":"2023-08-05T22:17:40.163398+0000"}}

@GCP: {"timestamp":"2023-08-05T22:20:52.873300+0000","flow_id":1247034279744340,"in_iface":"ens4","event_type":"alert","src_ip":"195.123.211.81","src_port":0,"dest_ip":"172.21.0.3","dest_port":0,"proto":"ICMP","icmp_type":8,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":99998,"rev":1,"signature":"BAD ICMP","category":"","severity":3},"flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":50,"bytes_toclient":0,"start":"2023-08-05T22:20:52.873300+0000"}}

@GCP: {"timestamp":"2023-08-05T22:26:01.289420+0000","flow_id":796466460846732,"in_iface":"ens4","event_type":"alert","src_ip":"34.125.170.248","src_port":0,"dest_ip":"172.21.0.3","dest_port":0,"proto":"ICMP","icmp_type":8,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":99998,"rev":1,"signature":"BAD ICMP","category":"","severity":3},"flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":98,"bytes_toclient":0,"start":"2023-08-05T22:26:01.289420+0000"}}

@GCP: {"timestamp":"2023-08-05T22:26:01.289502+0000","flow_id":796466460846505,"in_iface":"ens4","event_type":"alert","src_ip":"34.125.170.248","src_port":0,"dest_ip":"172.21.0.3","dest_port":0,"proto":"ICMP","icmp_type":0,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":99998,"rev":1,"signature":"BAD ICMP","category":"","severity":3},"flow":{"pkts_toserver":2,"pkts_toclient":1,"bytes_toserver":196,"bytes_toclient":98,"start":"2023-08-05T22:26:01.289193+0000"}}

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ egrep "BAD ICMP" /var/log/suricata/eve.json

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ egrep "TCP" /var/log/suricata/eve.json

@GCP: {"timestamp":"2023-08-05T22:20:16.794615+0000","flow_id":2103081389051793,"in_iface":"ens4","event_type":"anomaly","src_ip":"66.240.192.82","src_port":33844,"dest_ip":"172.21.0.3","dest_port":80,"proto":"TCP","anomaly":{"app_proto":"tls","type":"applayer","event":"APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS","layer":"proto_detect"}}

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ egrep "BAD HTTP" /var/log/suricata/eve.json

@GCP: {"timestamp":"2023-08-05T22:27:20.133109+0000","flow_id":1983990563618130,"in_iface":"ens4","event_type":"alert","src_ip":"136.226.79.33","src_port":1663,"dest_ip":"172.21.0.2","dest_port":80,"proto":"TCP","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":99997,"rev":1,"signature":"BAD HTTP PHP REQUEST","category":"","severity":3},"http":{"hostname":"34.125.91.185","url":"/index.php","http_user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36","xff":"24.23.174.37","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":404,"length":275},"app_proto":"http","flow":{"pkts_toserver":7,"pkts_toclient":6,"bytes_toserver":1432,"bytes_toclient":1396,"start":"2023-08-05T22:27:20.015698+0000"}}

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ egrep "TCP" /var/log/suricata/eve.json

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ egrep "BAD TCP" /var/log/suricata/eve.json

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$ egrep "TCP" /var/log/suricata/eve.json

student-04-6d7b0b6748d9@mig-dm-stamford-ids-uswest4-hr0r:~$