# Tag Info

7

For the case when you have a MAC address you can use the arpping tool to get the IP address. For case when you don't know the MAC address: You can generate regular ARP requests against all possible IP addresses with a tool such as nmap, by tuning the nmap option to be agressive. You will probably get a result in few minutes. If the device is sending data ...

7

Yes, maybe, not necessarily. A pcap file is not simply a byte-for-byte representation of the traffic that was sent/received. Things that will contribute to inaccuracies include: pcap file overhead. Every packet is timestamped, for instance. Impedance mismatch between pcap's idea of a "packet" and your understanding of what constitutes a "packet". The ...

6

Wireshark. Install that sucker, fire it up, start a capture, and Bob's yer uncle.

5

If it is an internal box, then there should be a server acting as his gateway to the internet. Set up wireshark to monitor the traffic on this box, with a rule set for only his ip address. Alternatively, if you don't have a central node to watch across, set up ettercap and start an arp poisoning. His machine will silently send traffic to you, which you ...

5

You cannot decipher HTTPS traffic unless you do one of the following: Have the private key Do a Man-In-The-Middle attack where you intercept the SSL request, pretend to be the end client, decrypt it, inspect it, and then re-encrypt the data with your own root certificate and send it on to your end-client that trusts your root certificate. What you can ...

4

The data is vulnerable anywhere along the route, not just the first or last stage. It is quite conceivable that a system involved in the transfer searches out user names, passwords and other sensitive data. It follows therefore that sensitive data should only travel over a link that is secured all the way and of course that is exactly what SSL is for. ...

4

Yes there is. Install a packet capture program on the client (Wireshark, Microsoft Network Monitor, etc.) and start a capture, then start your program and invoke the email function, then look at the capture. You can filter the capture by protocol (SMTP) or by source/destination ip address to filter all of the "noise" out of the capture to allow you to focus ...

4

Have a look at the Hak5 Throwing Star Lan Tap. It has features such as downgrading Gigabit to 100mbit, passive tapping and generally being hard to detect.

4

No. The switch between Ethernet ports is implemented in hardware and the hardware does not support any monitoring option.

3

Your best bet is probably a switch that supports port mirroring plus a box plugged in running wireshark. This feature used to be only available on high-end, fully-managed switches, but now $60 gets you entry. http://www.netgear.com/business/products/switches/prosafe-plus-switches/gs105e.aspx 3 Some devices answer to 'pings' (ICMP echo-requests) to the broadcast '255.255.255.255' address. 3 You can use a tcpdump command like:$ sudo tcpdump -i <interface> -s 1518 -XX -vv -n "tcp port 80" You customize the command according to your needs. You can add -w filename.pcap to save the dump to a file. Then, you can read the dump file using -r filename.pcap.

3

SmartSniff supports packet capture without libpcap; however, it only supports (TCP|UDP|ICMP)v4.

3

Sniffing a remote server is possible, though not easy. The most effective (though not reliable) is to compromise another device on the same subnet as the web server to the level that you can execute a sniffer. At that point you deploy ARP Poisoning to convince the switch that you need to see that server's traffic. If the switch isn't set up to defend against ...

3

Something to make note of that others haven't mentioned here is that some browsers cache your form data. The default behavior on SSL sites typically is to not cache anything unless you chose "save my password". Typically password fields don't cache anyway, but I've seen some oddities (typically credit-card info, which I know isn't really the topic of the ...

2

There are proxy servers which might store data. But there is also an obligation to keep users passwords safe. Many users use a limited set of passwords, so an unsafe site might compromise their homebank password for example.

2

TCPDUMP for Windows works. I can vouch for the trial version, as it's 99% the same as the NIX version (it's compiled from the same source I believe); doesn't require installation either. Pricing's on their site and isn't unreasonable if you're using it alot.

2

You're going to want a commandline call for this. For example, a download of something like windump. Then get a scheduled task that initiates on login, or periodically, if you want smaller hour-long dump files. (they can get big) The capture file will be viewable in WireShark. The specific command line will likely be C:\foo\bar\windump.exe -i 1 -w ...

2

Take a look at the ULOG target for iptables, combined with the owner match module. It's not quite what you asked for, but if you create a user specifically for your testing and run only the application you're trying to watch as that user, you should be pretty close. ULOGD, at least as far as I can tell, will write a file with raw packets. I haven't done ...

2

OpenVPN by itself doesn't sniff anything, but you can use standard sniffing tools. If you configure OpenVPN to operate in tunnel mode, then the connection between the application host and your server will appear on a virtual interface (with a name like tun0 on unix-like hosts) with its own IP address on each side. From the point of view of the application, ...

2

A better way to do it is to tap the wireless network where the access point connects to the wired network. You could do this with a dedicated network tap device, or a managed switch with a SPAN port configured, then you'll be able to sniff the traffic traversing the network.

1

You will need to sniff the traffic as it leaves the OpenVPN TUN or TAP interface on your computer that is acting as the VPN endpoint. There's no magic here (or at least none than I can think of). An interface, is an interface, is an interface. OpenVPN does not provide native functionality for packet sniffing but there are plenty of purpose-built tools to ...

1

I would say yes. As it is my understanding the writer (-w) writes the packets byte-for-byte to /tmp/dump.dmp. But I'm only 80% sure... That would include header information also, but that should be calculated into the throughput statistic.

1

Yes very much possible. You already named the best in the class. Sniff Wireless Packets with Wireshark in windows

1

It's of mixed ethics, there are arguments both ways. I tend to lean towards the "not ethical" side, but I can definitely understand the arguments on the other side, even if I don't agree with them. One thing I definitely believe is that users should be notified that this is happening, in plain language and up-front, that all use is subject to monitoring ...

1

For a completey install-less sniffer there's SmartSniff as grawity posted or IpTools.

1

I use ngrep and make a static executable. It works great for those instances, I also use nmap and make a static executable as well. These tools together can help troubleshoot instances where the network is not under your control.

1

I understand your dilemma. We currently have a guest in our Production facility that is dedicated to network troubleshooting that has WireShark on it. We will port span on our router as needed to tap into the traffic of the server that we need to research and then remove the port span when we are done with our research. This does require the ability to ...

1

In addition to what's already been said about traffic interception when not encrypted, perhaps your biggest problem is security through obscurity. You're trusting your users not to talk. You're giving a "secret" domain name to people who will be using it in public? Are you users really going to be concerned about security? I know people who don't even ...

1

There are quite a few software tools that will locate devices and their IP addresses on the network, using a variety of methods. On Windows my two favourites are NetworkView and Fluke Network Inspector. I don't believe the Fluke software is available any more, but you may be able to source an old copy somewhere. It detects devices partly by watching the ...

Only top voted, non community-wiki answers of a minimum length are eligible