# Tag Info

7

Yes, maybe, not necessarily. A pcap file is not simply a byte-for-byte representation of the traffic that was sent/received. Things that will contribute to inaccuracies include: pcap file overhead. Every packet is timestamped, for instance. Impedance mismatch between pcap's idea of a "packet" and your understanding of what constitutes a "packet". The ...

5

If it is an internal box, then there should be a server acting as his gateway to the internet. Set up wireshark to monitor the traffic on this box, with a rule set for only his ip address. Alternatively, if you don't have a central node to watch across, set up ettercap and start an arp poisoning. His machine will silently send traffic to you, which you ...

4

You can use a tcpdump command like: $sudo tcpdump -i <interface> -s 1518 -XX -vv -n "tcp port 80" You customize the command according to your needs. You can add -w filename.pcap to save the dump to a file. Then, you can read the dump file using -r filename.pcap. 4 The data is vulnerable anywhere along the route, not just the first or last stage. It is quite conceivable that a system involved in the transfer searches out user names, passwords and other sensitive data. It follows therefore that sensitive data should only travel over a link that is secured all the way and of course that is exactly what SSL is for. ... 4 Yes there is. Install a packet capture program on the client (Wireshark, Microsoft Network Monitor, etc.) and start a capture, then start your program and invoke the email function, then look at the capture. You can filter the capture by protocol (SMTP) or by source/destination ip address to filter all of the "noise" out of the capture to allow you to focus ... 3 Your best bet is probably a switch that supports port mirroring plus a box plugged in running wireshark. This feature used to be only available on high-end, fully-managed switches, but now$60 gets you entry. http://www.netgear.com/business/products/switches/prosafe-plus-switches/gs105e.aspx

3

Something to make note of that others haven't mentioned here is that some browsers cache your form data. The default behavior on SSL sites typically is to not cache anything unless you chose "save my password". Typically password fields don't cache anyway, but I've seen some oddities (typically credit-card info, which I know isn't really the topic of the ...

2

Sniffing a remote server is possible, though not easy. The most effective (though not reliable) is to compromise another device on the same subnet as the web server to the level that you can execute a sniffer. At that point you deploy ARP Poisoning to convince the switch that you need to see that server's traffic. If the switch isn't set up to defend against ...

2

You're going to want a commandline call for this. For example, a download of something like windump. Then get a scheduled task that initiates on login, or periodically, if you want smaller hour-long dump files. (they can get big) The capture file will be viewable in WireShark. The specific command line will likely be C:\foo\bar\windump.exe -i 1 -w ...

1

OpenVPN by itself doesn't sniff anything, but you can use standard sniffing tools. If you configure OpenVPN to operate in tunnel mode, then the connection between the application host and your server will appear on a virtual interface (with a name like tun0 on unix-like hosts) with its own IP address on each side. From the point of view of the application, ...

1

You will need to sniff the traffic as it leaves the OpenVPN TUN or TAP interface on your computer that is acting as the VPN endpoint. There's no magic here (or at least none than I can think of). An interface, is an interface, is an interface. OpenVPN does not provide native functionality for packet sniffing but there are plenty of purpose-built tools to ...

1

Take a look at the ULOG target for iptables, combined with the owner match module. It's not quite what you asked for, but if you create a user specifically for your testing and run only the application you're trying to watch as that user, you should be pretty close. ULOGD, at least as far as I can tell, will write a file with raw packets. I haven't done ...

1

It's of mixed ethics, there are arguments both ways. I tend to lean towards the "not ethical" side, but I can definitely understand the arguments on the other side, even if I don't agree with them. One thing I definitely believe is that users should be notified that this is happening, in plain language and up-front, that all use is subject to monitoring ...

1

TCPDUMP for Windows works. I can vouch for the trial version, as it's 99% the same as the NIX version (it's compiled from the same source I believe); doesn't require installation either. Pricing's on their site and isn't unreasonable if you're using it alot.

1

I understand your dilemma. We currently have a guest in our Production facility that is dedicated to network troubleshooting that has WireShark on it. We will port span on our router as needed to tap into the traffic of the server that we need to research and then remove the port span when we are done with our research. This does require the ability to ...

1

In addition to what's already been said about traffic interception when not encrypted, perhaps your biggest problem is security through obscurity. You're trusting your users not to talk. You're giving a "secret" domain name to people who will be using it in public? Are you users really going to be concerned about security? I know people who don't even ...

1

To packet sniff anything you need to get the packets - no matter what you're sniffing. There are many ways to accomplish this, the easiest two are being a "man in the middle" (say linux system with two ethernet ports in bridging between the server and the network it talks to) or getting a copy of the actual traffic (you can set a port in "monitor mode" on ...

1

I can agree with KevinM's musings toward answering his own questions, and John Gardeniers is pointing in the correct direction. I must also agree with what silky said, in, "ideally - the general public would never log in to a site that doesn't have an SSL based login screen.", and point out that this is, however, not the contemporary case at all. I ...

Only top voted, non community-wiki answers of a minimum length are eligible