Tag Info

Hot answers tagged

22

There are a few options: sersniff is a simple program to tunnel/sniff between 2 serial ports. Serial line sniffer (slsnif) is a serial port logging utility. It listens to the specified serial port and logs all data going through this port in both directions. Serial to Network Proxy (ser2net) provides a way for a user to connect from a network connection to ...


20

To complete David's answer, a switch learns who is behind a port by looking at the MAC addresses of packets received on that port. When the switch is powered on, it knows nothing. Once device A sends a packet from port 1 to device B, the switch learns that device A is behind port 1, and sends the packet to all ports. Once device B replies to A from port ...


16

I use Wireshark on Windows all the time - with a SPAN session or similar, plus cunning use of capture/display filters, you can get it to tell you pretty much anything you need. And you can make pretty graphs for your boss, too. What did you mean by 'security history'?


15

It is very difficult to detect sniffers, because they work passively. Some sniffers do generate small amounts of traffic and though, so there are some techniques for detecting them. Machines cache ARPs (Address Resolution Protocol). Sending a non-broadcast ARP, a machine in promiscuous mode (a network card that makes the card pass all traffic) will cache ...


14

Packet sniffing is a passive activity, it's generally not possible to tell if someone is sniffing your network. However, in order for someone on an wired, switched LAN to see traffic that's not destined just to or from their IP (or broadcast to the network/subnet) they need to either have access to a monitored/mirrored port that duplicates all traffic, or ...


12

What about the old email to staff@? "I just bought a monitoring tool that will tell me who's using up the bandwidth. Here's a link to the paragraph in the employee handbook that explains the policy on internet use. I will be installing it tomorrow. You've been warned. Thanks." Might work, and if not, you've got some suggestions from the nice people here ...


10

More expensive switches will offer port mirroring, where they will mirror the traffic of one or more ports to a dedicated monitor port for (among others) problems like yours. But I am not sure at what price class features like that are offered.


10

I think Wireshark is pretty much the open/free standard. Is there something you're looking for that it doesn't do?


10

You're understanding is basically correct. First I'd like to mention that if you know the PSK, or have a copy of the certificate, it's basically game over. Cracking the the session key is cryptographically trivial if you've got that much information. If you don't have the PSK or cert you're left with brute force, as you mentioned. Certificates are just as ...


8

We use MRTG (free) http://oss.oetiker.ch/mrtg/ to monitor traffic on our routers and switches. This will only work if you are using managed switches that support SNMP.


7

For the case when you have a MAC address you can use the arpping tool to get the IP address. For case when you don't know the MAC address: You can generate regular ARP requests against all possible IP addresses with a tool such as nmap, by tuning the nmap option to be agressive. You will probably get a result in few minutes. If the device is sending data ...


7

Yes, maybe, not necessarily. A pcap file is not simply a byte-for-byte representation of the traffic that was sent/received. Things that will contribute to inaccuracies include: pcap file overhead. Every packet is timestamped, for instance. Impedance mismatch between pcap's idea of a "packet" and your understanding of what constitutes a "packet". The ...


6

Wireshark. Install that sucker, fire it up, start a capture, and Bob's yer uncle.


6

This is a common misunderstanding. Unless it is statically configured, a switch must send every packet over every port that it cannot prove it does not need to send that packet out on. This could mean that a packet only gets sent to the port that contains the destination device. But this cannot always be the case. For example, consider the very first packet ...


6

What you need if urlsnarf from the dsniff project. It will generate a log with all http request seen on one network interface. A very good tool !


5

The (I believe) only way you can sniff all traffic on a switched LAN is with a 'man in the middle' attack. You basicly do ARP poisoning, stealing everyone's packets, reading them and sending them to the right computer afterwards. There are probably multiple tools that can do this, I only know of one: Ettercap can both perform the Mitm attack and detect one ...


5

I tried to use slsnif, but I found that I got an error: Failed to open a pty: No such file or directory This mailing list item indicates that slsnif only supports the "legacy" pseudo-terminals (/dev/ttyp0 etc) which are probably not used on current Linux kernels. I tried interceptty, and was successful in using it. First I ran it on the port of ...


5

Yes, it is possible. There are several ways: Connect your two PCs using a hub. All traffic will be sent to all ports. Use a man-in-the-middle attack program like ethercap. Use port-mirroring feature in a managed switch to forward all traffic from another port. You can use tcpdump or wireshark for packet capturing. I am assuming both hosts are located in ...


5

If it is an internal box, then there should be a server acting as his gateway to the internet. Set up wireshark to monitor the traffic on this box, with a rule set for only his ip address. Alternatively, if you don't have a central node to watch across, set up ettercap and start an arp poisoning. His machine will silently send traffic to you, which you ...


5

You cannot decipher HTTPS traffic unless you do one of the following: Have the private key Do a Man-In-The-Middle attack where you intercept the SSL request, pretend to be the end client, decrypt it, inspect it, and then re-encrypt the data with your own root certificate and send it on to your end-client that trusts your root certificate. What you can ...


4

Like this. tshark -nn -i <interface> -s 0 -w mycapture.pcap <hostname> and port <portnumber> Replace <interface> with the interface name to capture on (e.g., eth0). Replace <hostname> with the name or IP address of the remote host you want to capture packets for. Replace <portnumber> with the port the service is running ...


4

Have a look at the Hak5 Throwing Star Lan Tap. It has features such as downgrading Gigabit to 100mbit, passive tapping and generally being hard to detect.


4

No. The switch between Ethernet ports is implemented in hardware and the hardware does not support any monitoring option.


4

Yes there is. Install a packet capture program on the client (Wireshark, Microsoft Network Monitor, etc.) and start a capture, then start your program and invoke the email function, then look at the capture. You can filter the capture by protocol (SMTP) or by source/destination ip address to filter all of the "noise" out of the capture to allow you to focus ...


4

Basically this boils down to a question: what OSI level are you interested in? If you want to know about what exactly was transmitted, you cannot avoid Wireshark, tcpdump or alike. But if you are interested to learn patterns that appear in your network you have to analyze netflows, packet capture is simply an overkill. And for netflows there are many tools: ...


4

The data is vulnerable anywhere along the route, not just the first or last stage. It is quite conceivable that a system involved in the transfer searches out user names, passwords and other sensitive data. It follows therefore that sensitive data should only travel over a link that is secured all the way and of course that is exactly what SSL is for. ...


4

I've done quite a lot of this with wireshark. Sniff the traffic I want with tcpdump, ship it to somewhere I can launch Wireshark, and then view the trace with Wireshark. Tracing the TCP session gives me the request and answer in a nice ASCII form. Works great.


4

ngrep is very useful for this. Something as simple as ngrep -W byline port 80 would work, but you can filter on the content of the requests too (hence the grep part of the name), and it prints out the packet payload: ngrep -W byline some_string port 80


4

I haven't run into anything free that is better. My work it too cheap to pay for a sniffer when Wireshark is so good at what it does. Yes, it seems Wireshark has a new vuln against a decoder every other day or so, but that kind of thing happens when you're by far the top package in a field like this. Yes, I'd like them to update a bit more often. But the ...


4

Social engineering is the other way to do it. Set up a honeypot root/admin account or some other tempting target, broadcast its password in the clear and watch your logs.



Only top voted, non community-wiki answers of a minimum length are eligible