What Network Sniffing Tools Do You Use?

network-nose asks: "I work as a Network Administrator in a 500 user manufacturing facility in southeastern Wisconsin. My job is to keep the company running as close to 100% of the time as possible while trying not to spend any money on up to date hardware and software. As of late, we have been having quite a few network problems that can only really be resolved by sniffing packets. I am wondering what tools the rest of you network guys and gals out there use in a corporate environment for analyzing packets. Of course, the more reasonbly priced the better, but I know you usually get what you pay for."

Comments

Hrm...

[Smitedogg]

My job is to keep the company running as close to 100% of the time as possible while trying not to spend any money on up to date hardware and software

Are you trying to steal my job?

Coffee Beans

[numbski]

Wait! Wait!

Don't mark me offtopic yet!

Between sniffing different, strong scents (geeks, think about it), coffee beans are perfect for clearing you sense of smell.

That being said. Ethereal. :P

Anyway, try it sometime. Works well. Lots of people who sell the better kinds of incense will keep (good) coffee beans around for precisely this purpose.

Simple....

[QuasiCoLtd]

.....an Oscilliscope. Read the bits off the wire. You'd be suprised what an Oscilliscope in the hands of a VERY well trained person can accomplish.

Re:Simple....

[joshN]

Oscilliscopes!

When I was young, we just held our fingers against the wire, and felt the electic pulses.

Kids these days...

Re:Simple....

[stienman]

You'd be suprised what an Oscilliscope in the hands of a VERY well trained person can accomplish.

Translation:
You'd be surprised at the shear amount of BS a well trained conartist^H^H^H^H^H^H^H^H^Htechnician can pull off with an oscilliscope. Doesn't even have to be hooked up to anything.

"I see you have a large piece of test equipment there."
"Yes. It's telling me your password is insecure and hackers know about you-know-what..."
"Uh - I'll be right back..."

-Adam

Re:Simple....

[jdh-22]

I dont know what is worse:
... me counting to make sure you have enough ^H
... or you couting to make sure you have enough ^H

Re:Simple....

[Snoopy77]

That's not sniffing! In my days when we had a network problem we would draw straws to see who got the wires shoved up their nose. Yep, we really sniffed those packets.

The rest of us would monitor the nose twitches.

This is where the term 'Test Bunny' came from.

Re:Simple....

[Patik]

Wow, I've been reading Slashdot for years and always thought it was the server hiccuping as it generated the page... That explains so much

Bitch, don't you know where you are?

[Lord Kano]

Of course, the more reasonbly priced the better, but I know you usually get what you pay for.

This is Slashdot, you'll lose an eye here faster than you will in a barfight for saying that free (beer and speech) GNU/Linux isn't better than costly (money and your soul) Windows!

LK

My tools

[skraps]

I sniff with Olfactory 1.0.

Re:My tools

[Anonymous Coward]

I heard Michael Jackson uses version 9.3b.

Re:Great tools.

[Anonymous Coward]

>Ahh, the staples of my diet. What my roommates don't know won't hurt 'em ;-)

But it can hurt you.
I really wish I hadn't been sniffing IM when my recently broken up girlfriend was over. I don't want to see her :-* with another guy.

Re:Ethereal

[scotch]

btw, for the remarkable stupid: google

Outsourcing to Trained Cats

[billstewart]

One of the common network administration problems that software tools aren't very good at is finding where wires go when they're behind furniture or walls. Wires are pretty much like string, and my cats like to chase string, so I send them out to chase the wires, listen for the thumping noises, and see where the cat comes out. Doesn't work every time, and sometimes they'd rather chase mice than wires, but one of my cats really like chomping on RJ45 jacks, so if I suspect that a problem is related to an unplugged RJ45, he's the one for the job.

Re:Outsourcing to Trained Cats

[jskiff]

Hmmm...most of the time I just like to tone out the line. That being said, my cat has been looking a bit bored these days. Plus it would give my dog something to do while listening to all the thumping going on.

Being a /. nerd, that's the only pussy thumping going on in my parent's base^H^H^H^H^H house.

My nose

[t0qer]

My nose is indispensable OTJ. If a network card stops working, or is flaky I simply pop it out and smell for burned silicon.

I found it works with routers, switches, hubs and servers too.

My homemade sniffer

[MajorDick]

Well I use my own special homemade Network sniffer, let me explain it, its a BIG Rubber nose on a BIG Stick with cat 5 hanging out the nostrils. It works GREAT Walk into someones office with that and they start rambling about all the programs they are running , have run, could run, and want to run, MOST likley out of fear of what you are going to do with the rubber nose on the stick, or maybe just because they are scared someone actually spent the time and built it.

Re:Ethereal

[cperciva]

For the people who like useless links: You are here.

Sniffing

[JWSmythe]

Actually, you sound like a kid who just got a job at a company who has 500+ employees, and wants to sniff their traffic.

You'll learn and get caught. But who am I to stop you from a life experience. :)

ethereal is great. It's proven to be lots of fun. :) tethereal is great too (comes with Ethereal). tcpdump is the grand-daddy of all packet sniffers, so it's kinda handy to know how to use it.

For wireless, I use Wellenreiter and Kismet.

Sitting in a major Las Vegas hotel, only a few floors up from the casino, I turned on my laptop, hoping to find an access point I could get online with (damned hotel didn't provide Internet access). I heard two AP's, and caught a couple IP's going by. I assigned myself an IP which appeared to not be used, and fired up ethereal.

I saw text for several of the casino machines going by. It was the text to be updated to the displays, including windows paths to where the files originated from (I believe). It was all in plain text. I noted down what I saw for a few minutes, shut down the laptop, and proceeded to lose for the rest of the night in the casino. Hey, that's what Vegas is for, right? :)

After I got home, I dug around for something resembling an admin contact at the casino, and advised him of what I saw. It would have probably been pretty easy to push my own updates to the machines. What would I say though?

"Gambing is an addiction, quit now."
"This game is rigged, move on."
"This is the droid you are looking for."
"With a 97% chance of losing, did you really want to play this game?"

or, I guess

"I'm a spiffy keen elite haxor type person, props to my homeyz" haha

Re:^H^H^H

[coene]

^H is geek for "I can't configut^Hre my terminal correctly"

Re:I'm not a network admin

[Anonymous Coward]

Its great for obtaining user's passwords... you can never be too weary of terrorists. ;-)

Re:Ethereal

[whookey]

It's not like you need to know the secret handshake before you can become a network administrator.

Actually, you do.

In my day

[dheltzel]

pshaw!

You youngin's don't know how good you got it. Why, back in my day we didn't have no fancy, schmancy network sniffers. We just power cycled the boxes until they started working right (or until quitting time, whichever came first).

*mumbles* gotta teach these whipper snappers a thing or two - next they'll need some lessons in percussive maintenance

Re:Ethereal

[dhuff]

EMACS is an acronym for one of its normal key sequences, yes ? ESC-Meta-ALT-CTRL-Shift ? ;->

Re:Ethereal

[SubconsciousSeraphim]

Hrm. Are they aware that their handshake is the international symbol also known as the shocker?"

'cause, you know. Ew.