Tag Info

Hot answers tagged

21

There are a few options: sersniff is a simple program to tunnel/sniff between 2 serial ports. Serial line sniffer (slsnif) is a serial port logging utility. It listens to the specified serial port and logs all data going through this port in both directions. Serial to Network Proxy (ser2net) provides a way for a user to connect from a network connection to ...


20

To complete David's answer, a switch learns who is behind a port by looking at the MAC addresses of packets received on that port. When the switch is powered on, it knows nothing. Once device A sends a packet from port 1 to device B, the switch learns that device A is behind port 1, and sends the packet to all ports. Once device B replies to A from port ...


16

I use Wireshark on Windows all the time - with a SPAN session or similar, plus cunning use of capture/display filters, you can get it to tell you pretty much anything you need. And you can make pretty graphs for your boss, too. What did you mean by 'security history'?


15

It is very difficult to detect sniffers, because they work passively. Some sniffers do generate small amounts of traffic and though, so there are some techniques for detecting them. Machines cache ARPs (Address Resolution Protocol). Sending a non-broadcast ARP, a machine in promiscuous mode (a network card that makes the card pass all traffic) will cache ...


14

Packet sniffing is a passive activity, it's generally not possible to tell if someone is sniffing your network. However, in order for someone on an wired, switched LAN to see traffic that's not destined just to or from their IP (or broadcast to the network/subnet) they need to either have access to a monitored/mirrored port that duplicates all traffic, or ...


12

What about the old email to staff@? "I just bought a monitoring tool that will tell me who's using up the bandwidth. Here's a link to the paragraph in the employee handbook that explains the policy on internet use. I will be installing it tomorrow. You've been warned. Thanks." Might work, and if not, you've got some suggestions from the nice people here ...


10

More expensive switches will offer port mirroring, where they will mirror the traffic of one or more ports to a dedicated monitor port for (among others) problems like yours. But I am not sure at what price class features like that are offered.


10

I think Wireshark is pretty much the open/free standard. Is there something you're looking for that it doesn't do?


10

You're understanding is basically correct. First I'd like to mention that if you know the PSK, or have a copy of the certificate, it's basically game over. Cracking the the session key is cryptographically trivial if you've got that much information. If you don't have the PSK or cert you're left with brute force, as you mentioned. Certificates are just as ...


8

We use MRTG (free) http://oss.oetiker.ch/mrtg/ to monitor traffic on our routers and switches. This will only work if you are using managed switches that support SNMP.


6

What you need if urlsnarf from the dsniff project. It will generate a log with all http request seen on one network interface. A very good tool !


6

This is a common misunderstanding. Unless it is statically configured, a switch must send every packet over every port that it cannot prove it does not need to send that packet out on. This could mean that a packet only gets sent to the port that contains the destination device. But this cannot always be the case. For example, consider the very first packet ...


5

The (I believe) only way you can sniff all traffic on a switched LAN is with a 'man in the middle' attack. You basicly do ARP poisoning, stealing everyone's packets, reading them and sending them to the right computer afterwards. There are probably multiple tools that can do this, I only know of one: Ettercap can both perform the Mitm attack and detect one ...


5

I tried to use slsnif, but I found that I got an error: Failed to open a pty: No such file or directory This mailing list item indicates that slsnif only supports the "legacy" pseudo-terminals (/dev/ttyp0 etc) which are probably not used on current Linux kernels. I tried interceptty, and was successful in using it. First I ran it on the port of ...


5

Yes, it is possible. There are several ways: Connect your two PCs using a hub. All traffic will be sent to all ports. Use a man-in-the-middle attack program like ethercap. Use port-mirroring feature in a managed switch to forward all traffic from another port. You can use tcpdump or wireshark for packet capturing. I am assuming both hosts are located in ...


4

Social engineering is the other way to do it. Set up a honeypot root/admin account or some other tempting target, broadcast its password in the clear and watch your logs.


4

I haven't run into anything free that is better. My work it too cheap to pay for a sniffer when Wireshark is so good at what it does. Yes, it seems Wireshark has a new vuln against a decoder every other day or so, but that kind of thing happens when you're by far the top package in a field like this. Yes, I'd like them to update a bit more often. But the ...


4

Basically this boils down to a question: what OSI level are you interested in? If you want to know about what exactly was transmitted, you cannot avoid Wireshark, tcpdump or alike. But if you are interested to learn patterns that appear in your network you have to analyze netflows, packet capture is simply an overkill. And for netflows there are many tools: ...


4

I've done quite a lot of this with wireshark. Sniff the traffic I want with tcpdump, ship it to somewhere I can launch Wireshark, and then view the trace with Wireshark. Tracing the TCP session gives me the request and answer in a nice ASCII form. Works great.


4

ngrep is very useful for this. Something as simple as ngrep -W byline port 80 would work, but you can filter on the content of the requests too (hence the grep part of the name), and it prints out the packet payload: ngrep -W byline some_string port 80


4

Like this. tshark -nn -i <interface> -s 0 -w mycapture.pcap <hostname> and port <portnumber> Replace <interface> with the interface name to capture on (e.g., eth0). Replace <hostname> with the name or IP address of the remote host you want to capture packets for. Replace <portnumber> with the port the service is running ...


3

There are two ways to sniff traffic in a switched network where you don't have access to the switch. The first is ARP spoofing, where you attempt to respond to ARP requests faster than the target device. This is obviously dependent on your ability to do that, so might be a little bit hit and miss. The second is to overflow the switch's forwarding tables. ...


3

A quick-and-dirty solution for sniffing a single device on is to add a second NIC, connect the device to be sniffed to one NIC (using a crossover cable if necessary) and the LAN to another, then bridge the connections and sniff on the bridge interface. Since you're not wedging the machine into a heavy traffic flow (presumably) you won't really slow anything ...


3

Generally the VOIP traffic can be broken down into 2 parts... Control traffic and Audio Stream traffic. This may not be how Avaya specifically does it, but in plain vanilla VoIP you should see SIP (Session Initiation Protocol) going back and forth at around port 5060 to exchange information such as Message Waiting Indicator, Phone Registrations, and the ...


3

Use ettercap and live happy. See wikipedia for a list of ARP spoofing capable tools MAC Flooding attack can be tried too, depending on the switch you are attacking. If the switch is exposed to this kind of attack it will act as an HUB once overflowed. You can of course use an HW approach (much more less flexible IMHO), a very inexpensive switch such as ...


3

(Disclosure: My name is at the top of Wireshark's list of authors.) Wireshark's security record is one of the very few aspects of the project that I've been unhappy with. The good news is that we have a talented team of developers and a solid architecture. One of the reasons you hear about Wireshark's security is that we actively look for flaws and report ...


3

get windows version of tcpdump and analyze traces later with anything [ including wireshark ] on separate desktop box. or use network switch with port mirroring and attach linux [ or - in worst case - virtual machine with linux and bridging to separate ethernet interface ] and perform all sniffing on it.


3

I don't use this stuff nearly as much as I used to, but I always liked Microsoft Network Monitor when I needed a free protocol analyzer to track down a problem. http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=983b941d-06cb-4658-b7f6-3088333d062f


3

There is a simple way to detect most sniffers. Put two boxes on the network which are not in DNS and are not used for anything else. Have them periodically ping or otherwise communicate with one another. Now, monitor your network for any DNS lookups and/or ARP requests for their IPs. Many sniffers will by default look up any addresses they find, and thus ...


3

If you find switching to a Hubbed network temporarily unacceptable or find the other approaches too time consuming, You can use the tried and true tactic of ARP poisoning and sniffing their traffic (The caveat with this approach is that you WILL bottleneck your connection with your NIC/Cabling speed and will dramatically slow down, perhaps DOS a large ...



Only top voted, non community-wiki answers of a minimum length are eligible