Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm using an Ettercap filter to detect a query response coming back from a particular service on a remote machine. When I see a response from the service, I'm searching through the data in the packet to see if an offset is a specific value, and if so I'm changing the value at another offset.

Trouble is, when I try this on a new virtual machine I built my Ettercap filter's no longer getting any data in the DATA.data variable available to it.

if(ip.proto == TCP && tcp.src == 17867) {
  msg("Response seen!\n");

  if(DATA.data + 2 == "\0x01") {
    msg("Flag detected!\n");

    DATA.data + 5 = 0x09;
  }
}

The filter's getting applied to the traffic because "Response seen!" messages get printed out by Ettercap. However, "Flag detected!" messages do not. I think DATA.data is indeed empty because if I change my second "if" statement to check for DATA.data == "" then the "Flag detected!" message gets printed.

Any ideas why this may be happening?!

Also, if this is the wrong site to be asking questions like this, please let me know. I wasn't sure if it fit better here or somewhere like superuser or serverfault.

By the way, this is a cross-post from StackOverflow... I should have posted on this forum instead I think. :)

share|improve this question

migrated from security.stackexchange.com Mar 17 '11 at 15:24

This question came from our site for Information security professionals.

    
Have you tried outputting DATA.data as a whole to see what the contents look like? –  SteveS Feb 24 '11 at 19:23
    
I've tried doing that with Ettercap's log(what, where) method in the filter, but all I get in the log file is a bunch of zeros. Also, I've confirmed there is actually data in the packet that Ettercap should be seeing via Wireshark. –  Bryan Feb 24 '11 at 21:03
1  
Is this really a security question? Looks like it might be more SF material... –  AviD Feb 26 '11 at 21:26

1 Answer 1

I had the same problem. (ettercap receives null (0x00) characters or 0x20 (DECODED ONE)). i tried to compile ettercap from source and everything works fine. try to log what ever ettercap receives using LOG filter and then see what is received. if it's bunch off nulls or zeros, your problem is probably like mine! it seems to be some problem in etterfilter or ettercap itself.

change your ettercap version and it will work (mine did). my problem was in backtrack 5 r1 and it's ettercap. i updated ettercap and everything works fine.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.