Slashdot Mirror
What Network Sniffing Tools Do You Use?
network-nose asks: "I work as a Network Administrator in a 500 user manufacturing facility in southeastern Wisconsin. My job is to keep the company running as close to 100% of the time as possible while trying not to spend any money on up to date hardware and software. As of late, we have been having quite a few network problems that can only really be resolved by sniffing packets. I am wondering what tools the rest of you network guys and gals out there use in a corporate environment for analyzing packets. Of course, the more reasonbly priced the better, but I know you usually get what you pay for."
That's it.
I tend to use tcpdump when I am watching a box using a specific filter and expecting very little traffic, i.e. when I want to know if a certain host is communicating on some arbitrary port or protocol. Ethereal I use when I want to capture tons of data and sift through it later (although you can do this with tcpdump and import it into ethereal as well).
Tcpdump is generally considered the superior learning tool, while ethereal is considered the more refined choice. In other words, ethereal does a lot of the work for you, while you are getting pretty raw stuff when you use tcpdump.
In general, tcpdump and ethereal are the tools of choice if you don't have tons of money to spend. Fancy looking enterprise applications essentially do the same thing as the apps mentioned above -- they just add a nice GUI to the mix.
dmiessler.com -- grep understanding knowledge
I've used Sniffer Pro, Observer Pro, and Ethereal, and I always, ALWAYS prefer Ethereal. It's free, it's open source, and it's hands down the best of the lot. Sniffer Pro may have the pretty gauges and the map that shows what's talking to what (utterly useless, IMHO), and Observer Pro comes with buttloads of tools for things like SNMP configuration and whatnot, but as a sniffer, nothing has ever beated Ethereal in ease of use, capability, or packet decodes.
For your security, this post has been encrypted with ROT-13, twice.
"BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
What kinds of problems can only be figured out by sniffing packets? Rogue programs? Unauthorized porn downloads? Illegal P2P activity?
On a properly configured network, where are the points of failure that can't be figured out with any other method besides packet sniffing? If these problems exist, would it be worthwhile to incorporate functionality directly into the networking software to watch for these problems and fix them automatically?
I have been pwned because my
Hands down, Fluke.
http://www.flukenetworks.com/us/default.htm
Alcohol & calculus don't mix. Never drink & derive.
- Ethereal
- hping
- tcpdump
- tcpflow
Ahh, the staples of my diet. What my roommates don't know won't hurt 'em"I either want less corruption, or more chance
to participate in it." -- Ashleigh Brilliant
.....an Oscilliscope. Read the bits off the wire. You'd be suprised what an Oscilliscope in the hands of a VERY well trained person can accomplish.
From their website:
Cool Features: Characters injection in an established connection : you can inject character to server (emulating commands) or to client (emulating replies) maintaining the connection alive !!
SSH1 support : you can sniff User and Pass, and even the data of an SSH1 connection. ettercap is the first software capable to sniff an SSH connection in FULL-DUPLEX
HTTPS support : you can sniff http SSL secured data... and even if the connection is made through a PROXY
Remote traffic through GRE tunnel: you can sniff remote traffic through a GRE tunnel from a remote cisco router and make mitm attack on it
PPTP broker: you can perform man in the middle attack against PPTP tunnels
Plug-ins support : You can create your own plugin using the ettercap's API. List of available plugins
Password collector for : TELNET, FTP, POP, RLOGIN, SSH1, ICQ, SMB, MySQL, HTTP, NNTP, X11, NAPSTER, IRC, RIP, BGP, SOCKS 5, IMAP 4, VNC, LDAP, NFS, SNMP, HALF LIFE, QUAKE 3, MSN, YMSG (other protocols coming soon...)
Paket filtering/dropping: You can set up a filter that search for a particular string (even hex) in the TCP or UDP payload and replace it with yours or drop the entire packet.
OS fingerprint: you can fingerprint the OS of the victim host and even its network adapter
Kill a connection: from the connections list you can kill all the connections you want
Passive scanning of the LAN: you can retrive infos about: hosts in the lan, open ports, services version, type of the host (gateway, router or simple host) and extimated distance in hop.
Check for other poisoners: ettercap has the ability to actively or passively find other poisoners on the LAN
Bind sniffed data to a local port: you can connect to that port with a client and decode unknown portocols or inject data to it (only in arp based mode)
Port Stealing: a new method to sniff on switched LAN without ARP poisoning...
http://ettercap.sourceforge.net/
Activists United
we have been having quite a few network problems that can only really be resolved by sniffing packets.
By "packets" I hope you mean "Ethernet frames". Looking only at layer 3+ information can be useless for many network problems. Anyhow, brain dump:
Do your switches and LAN router(s) have statistic counters (# of frames of various sizes, undersided/oversized frames, flooded frames, deferred frames, etc)?
If you don't have a LAN router for 500 users: why?
What's the most amount of hops (switches) your packets will travel from one end of the LAN to the other? Any more than 3 and you should be putting a LAN router in there (ideally)
Do you have hubs? If so, destroy them all right now. Hubs are pure, unadulterated evil.
My point of that is simple: not all LAN problems are computer problems. Looking at the IP traffic doesn't always cut it. Re: the subject: At my workplace we have a nice LAN meter from Fluke. They aren't cheap but if you have that many users your company should damn well pay for the right tools for you to do your job.
Trolling is a art,
Of course, the more reasonbly priced the better, but I know you usually get what you pay for.
This is Slashdot, you'll lose an eye here faster than you will in a barfight for saying that free (beer and speech) GNU/Linux isn't better than costly (money and your soul) Windows!
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
Don't forget the eternally useful.
I was recently clued-in to the existence of Argus.
It's really good for summarizing flow information in quasi-realtime, so it fills the niche of being more detailed than NetFlow, but more big-picture than tcpdump or ethereal.
I use tcpdump UNIX-side, and Ethereal Windows-side. Personally? I find Ethereal hard to use, but it gets the job done. I've traced down bugs in OpenBSD TCP stacks with it on my production servers. I've tried half a dozen other packages but they didn't add enough value to make them worth trying to hit my boss up for cash.
To install Ethereal, you will need to download and install the low-level WinPcap driver.
And you may find the Ethereal packet analysis plug-in Packetyzer helpful; sometimes reading raw logs gets a bit annoying.
--LP
I sniff with Olfactory 1.0.
Karma: -2147483648 (Mostly affected by integer overflow)
While it probably does suit the poster, I have to say for network diagnostics, Sniffer Pro is awesome. With the right network cards, it goes right down to the network layer, pulling out collision stats etc, and can even go and setup your switches for monitoring using rmon.
Got wan problems, Sniffer can work with a Y cable and hardware decoder to watch your WAN.
They even have long term trending and reporting tools. Its maybe the one tool that Network Associates does right.
Ethereal and TCPDump are good for protocol analysis, but most network problems I've delt with are not really at the application layer, but more the pysical layer. (Dodgy Network Cards, Flat network designs with hundreds of hosts, causing your collision rate to go through the roof etc)
The other thing that I like about sniffer, is its made for people that might not have degree's in network analysis. Its got that Expert System. It will throw at you all the errors it finds, and is good enough to tell you what those errors means.
Lastly, The export feature is great. Does my boss want to know what is the biggest talker on the network, Let sniffer run for a few hours, export to excell, and I can give him the top 10/20/50, I can break it down further by protocol or application, and can even tell him who the partners are.
I know there are other tools out there that can do all this, (ntop, ethereal, tcpdump, rrd's) but thats exactly my point. They are different tools, they don't work together, and imho, none of them are true network diagnostic tools.
I'm Ex NAI employee btw, so maybe a bit biased, but I still use Sniffer (legit copies) to this day. There are only a few reasons why I still have a windows drive for my laptop, and Sniffer is no. 1)
One of the common network administration problems that software tools aren't very good at is finding where wires go when they're behind furniture or walls. Wires are pretty much like string, and my cats like to chase string, so I send them out to chase the wires, listen for the thumping noises, and see where the cat comes out. Doesn't work every time, and sometimes they'd rather chase mice than wires, but one of my cats really like chomping on RJ45 jacks, so if I suspect that a problem is related to an unplugged RJ45, he's the one for the job.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
For windows get winpcap
then get ethereal for windows
and get windump
SANS.org has all the info: Packet capture apps
http://www.snort.org/
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Well I use my own special homemade Network sniffer, let me explain it, its a BIG Rubber nose on a BIG Stick with cat 5 hanging out the nostrils. It works GREAT Walk into someones office with that and they start rambling about all the programs they are running , have run, could run, and want to run, MOST likley out of fear of what you are going to do with the rubber nose on the stick, or maybe just because they are scared someone actually spent the time and built it.
EtherPEG works by capturing unencrypted TCP packets off your local network, collecting packets into groups based on TCP connection (determined from source IP address, destination IP address, source TCP port and destination TCP port), reassembling those packets into order based on TCP sequence number, and then scanning the resulting data for byte sequences that suggest the presence of JPEG or GIF data.
Or in other words, fire it up, plug in a data projector and watch everyone's porn. Interesting side-effect: It makes (most) people a lot more careful what they browse if they know the results will be displayed for everyone's amusement. Mercifully, it's also a lot less likely these days to see The Goatse flying across the screen.
Do you or your partner snore? - Visit www.snoring.com.au
Actually -s 0 is better.
:)
10/100BaseT Ethernet, which pretty much everyone uses these days, is limited to 1500 snaplen. But the good old FDDI was a whopping 4500!
With -s 0, it basically means "All" - you don't have to think about what transmission medium you're using.
I also usually name my packet captures with extention *.pcap, and just make Ethereal be the default *.pcap file handler.
I'll also use tcpdump to whittle my pcaps down. Say I capture for a long time and end up with a 500MB+ pcap. Opening this in most any workstation with Ethereal will cause you to wait awhile, and could actually crash your box (yay for WinXP pre-fetch!).
So when I've found a particular port or host I want to extract from a stream to make the pcap more managable, I'll do something like this:
tcpdump -s 0 -r infile.pcap -w outfile.pcap host x.x.x.x and port xxx
Sometimes, I'll use tethereal instead to go a little deeper. tethereal is ***SLOW*** compared to tcpdump, but the granularity is worth it sometimes. Just set it going, and go get a coffee or something.
When examining a capture of some malware trying to spread, often times it will SYN several hundred machines without getting a reply. Trolling through these can be a pain. But by using tethereal, you can make what I call "Jesus" pcaps (no SYN's). To make it complete, I also filter RST's like so:
tethereal -r infile.pcap -w outfile -R "tcp.flags.syn==0 && tcp.flags.reset==0"
There is a way to do this in tcpdump, but it's much more complicated. Besides, you need the break anyway, right?
-AutoNiN
Here's a link.
I haven't used it for a while (College) but it was the most impressive tool I've ever used for Network Sniffing. It's available for pretty much every major platform.
infested with jello like fishes no melotron wishes
I would advise you to get a LanScaper from Test-Um Inc. Retail is $419, shopping on Froogle will save you $70 or so. Anyway, the benefit of this device is that it will tell you all sorts of things about your infrastructure that any OS based tool will not. A defective cable, for instance, might work 80% of the time, maybe even more, but will lead to corrupt data (which is messy when you're dealing with some big database or something). This tool will weed out bad cables and links pretty quick. You can also find out length of runs, do pings, and many many other things. Totally worth its' weight in gold. (Which is about what it costs)
Often in Error, Never in Doubt.
Windows 2000 also has a network monitoring tool.
c:\system32\system\netmon\netmon.exe.
It's not going to support 500 protocols like ethereal. But hey, it comes default with windows 2000 without you having to install anything separately.
SmokePing, which uses rrdtool as a backend, is a great tool for graphically displaying ping informaiton.
Netsaint is very good for monitoring systems and networks and letting you know ASAP when there's a problem. It can also use rrdtool to generate graphs of packet loss and ping latency.
All of the above are things that will give you current as well as historic information. Current information is good, but historic information is incredibly important. Trending is the obvious thing, allowing you to predict future use to some extent. More importantly, it lets you examine things that happened recently but aren't currently happening, and to see recurring issues.
Recently, our local Internet cooperative was having problems where one of the upstream connections was going into very high packet loss and dropping it's BGP peer. We keep fairly high resolution traffic statistics through ganglia, another rrdtool based network system. That along with the RRD CGI grapher allowed us to create custom graphs of traffic with very high resolution, for days and weeks past, overlaying multiple sources.
Once we did that, it became obvious that every time we ran into these problems, one of our members was hitting the line somewhat hard. It wasn't hard enough that it pegged the line from a bandwidth standpoint, but it apparently was hard enough that it caused some part of the network to experience extremely high packet loss.
That was definitely a case where having the right tool allowed us to track down a fairly hard to see problem. Because our line was not at all saturated, we spent a lot of time looking for things like bad cables, ports with lots of accumulating errors, etc...
Sean
I can vouch for the win32 build... altouhg I could not check the packets in realtime... (network too fast, computer too slow)
you can try it with Knoppix STD Bootable Linux-ON-CD
with comes with all this:
aimSniff : sniff AIM traffic
driftnet : sniffs for images
dsniff : sniffs for cleartext passwords (thanks Dug)
ethereal 0.10.0 : the standard. includes tethereal
ettercap 0.6.b : sniff on a switched network and more.
filesnarf : grab files out of NFS traffic
mailsnarf : sniff smtp/pop traffic
msgsnarf : sniff aol-im, msn, yahoo-im, irc, icq traffic
ngrep : network grep, a sniffer with grep filter capabilities
tcpdump : the core of it all
urlsnarf : log all urls visited on the wire
webspy : mirror all urls visited by a host in your local browser
I live in Soviet Canuckistan you insensitive clod!
I used Ethereal for a while, sniffing simple HTTP traffic, sorting out cookie issues and so on (I'm not a netadmin -- mostly web app development)... and it was darned handy.
/. headers are entertaining]
Of course, when I found the live http headers plugin for Mozilla it was exactly what I needed -- just the headers, scrolling by realtime, and no more sniffing needed.
Yeah, this is slightly OT (which may be good in a discussion that seems to be a long string of ethereal links, all +5) -- but I wanted to point out to those people out there who think they "need a sniffer" -- unless you're a network admin, you probably don't.
[Plus the Futurama quotes in the
There are only 10 types of people: those who understand decimal, those who don't, and, uh, 8 other types I forget.
I guess I'm oldschool, but I still use tcpdump for most day-to-day things. It's handy, it's fast, and it runs on just about every OS (including Windows (google for windump)). The output is ugly, but once you get used to it, you hardly notice.
:) ), but couldn't/didn't want to install all kinds of GUI tools, etc. This is where tcpdump really shines. You can capture to a binary file and read the file with tcpdump, ethereal, Etherpeek, and many other packages. As long as you can get the file off the machine, you can analyze the data.
:)
When I really need to analyze a stream or set of streams, or I'm going to be staring at packets for more than about 10 minutes, I switch to ethereal. Again, it's free, runs on most OS's (including Windows, again), and the GUI is a little clunky, but quite usable. As several people have mentioned, the capture filter syntax is identical to tcpdump. The display filter syntax is different and I find is a little tricky to get right, so I try to prefilter (or filter with tcpdump beforehand) as much as possible.
One handy feature is the ability to analyze certain types of streams, such as a TCP session (filter out the whole session and see all the data in one window) and SIP (analyze jitter, loss, extract audio session, etc.). It's also open-source, so if it doesn't understand some kind of traffic, you can write your own extension. I haven't had to do this yet, but I know people who have, and it seems easy enough for a compitent programmer.
My employer has a site license for WildPackets Etherpeek (it comes in several versions... I think we have one of the higher-end ones). Frankly, it's prettier than ethereal, but, at least for the debugging I do, provides very little extra functionality. The capture filters are embedded in a GUI which I find makes it hard to see how they're configured.
Etherpeek is pretty and may be easier for novices to use. But I wouldn't waste the money unless it has some quirky feature you just can't live without.
Something to keep in mind: often, the place where you capture packets is not where you'd like to analyze them. For example, I've had situations where I needed to sniff traffic on a remote server -- I had ssh access to the server (and root, of course
There are also handy tools for managing and analyzing tcpdump files, such as tcpslice, which breaks up large dumps by time, date, etc.; there is a tool that "anonomizes" (sp?) packets so that you can analyze streams without violating anyone's privacy (this is largely for academic use, but if, for example, you wanted to do some kind of traffic analysis on your uplink, you could do so without ruffling as many feathers).
Finally, note that tcpdump will sniff on pretty much any interface that supports libpcap. Tools like Etherpeek only talk to certain (ethernet) adapters, for example. Caveat emptor.
Bottom line: pick the right tool for the job
Ethereal is a really nice application. However, it has it's limits.
c harter. htmli ntwk/i to_doc/rmon.htm
RMON (see RFC 3577) or Remote Monitoring is a set of SNMP MIBs which you allow you to gather traffic information (including packet captures) from network elements itself. You do not need to have a computer to run ethereal, snoop or tcpdump.
The switch/router/probe will collect the info for you, automatically.
Virtually all switches support (mini-)RMON. Furthermore you have (full) RMON probes which you can install at various places in the network.
The flexibility of RMON probes is much larger then ethereal. However, I often use ethereal to look at the packet captured using RMON.
Some info:
http://www.ietf.org/html.charters/rmonmib-
http://www.cisco.com/univercd/cc/td/doc/cis
my 2 cents
Rik
http://www.cs.columbia.edu/~hgs/internet/tools.
iftop - ncurses
iptraf - ncurses
tcpflow - reconstruct into file per tcp conn
ettercap - ncurses, kill conn, drill down on connection, ssh 1 attack, etc
ssldump - http://www.rtfm.com/ssldump/
etherape - graphical view of net
ntop - web based network monitoring
ethereal - GUI - based sniffer, gets all protocols.
mtr - monitor hops
trafshow - nice ncurses sorted list of top bandwith hogs
http://www.mirrors.wiretapped.net/security/networ
2 years and no mod points. Join reddit. Because openness is good.