Slashdot Mirror
Ethereal Packet Sniffing
I've used the tool for years, and I've read the docs a bit, so I felt comfortable with the tool. Still, I wanted to learn something new with it, and I wanted to see if this book could offer what I was hoping for. The book delivers, and does a pretty good job. One of the big tests for me about any book that covers an Open Source project is "Does this book offer more than the existing documentation?" If it fails to, the book isn't worth the money, I'll stick with free docs. While the book comes out favorably for me, I'll start with the things I didn't like, first.
One of the big things that is missing from this book is any coverage of Ethereal on OS X. Given how many people are migrating to OS X (from UN*X or from Windows), and the coverage of Ethereal on Windows, I would have expected some mention of it. Luckily it's available in both Darwin Ports and the Fink project, but some mention of any of the quirks people may encounter would have been welcome. Amy (from Syngress) tells me that they will have a paper in their Solutions center on Ethereal on OS X, which would be great to see.
Another annoyance with the book is the repeated coverage in some sections of various aspects of Ethereal. One that stands out is the coverage of the additional tools which are installed alongside Ethereal, like Editcap and Text2pcap. They are covered in chapter 2 for a bit and then more completely in chapter 6. Covering these tools only once would have sufficed, but it does let chapter 2 stand on its own. Amy tells me that they do this intentionally, because it makes some chapters stand on their own as "units" for others to use. That makes sense.
A final bit of the book I didn't like was the choice of screenshots: quite a number of the screenshots were full screen dumps when only one or two elements of the page really mattered. Either trimmed or annotated screenshots would have been more welcome. A lot of information gets dumped in Ethereal, helping people navigate the UI with a static, black-and-white image would have been welcome.
Now, on to the real strengths of the book. Like I said earlier, The book offers more coverage than the existing, free docs on Ethereal provide, or at least in a more manageable form. Obviously, with the source code in front of me I could dissect the tool and learn everything about it, but that's hardly efficient. Simply put, the book introduces network sniffing and troubleshooting well. How can you place a sniffer to get coverage, what can a sniffer tell you during troubleshooting (and what can it not?), and of course how to get and install Ethereal (on UN*X and Windows).
The next chapter covers exactly what you would expect it to, how to use Ethereal. Ethereal's main use is as a GUI protocol analyzer, so you have menus, panes and windows to navigate. This chapter tells you what they are and how they present and format the data you're looking at. The next chapter deals with four tools that come with Ethereal: Tethereal (very similar to tcpdump), Editcap, Mergecap, and Text2pcap (all useful for managing pcap files).
Chapter 7 is one of those handy things to read. Ethereal is typically used to read pcap files, but it can also read snoop files, Microsoft Network Monitor files, EtherPeek files, NAI's Sniffer files, and HPUX's nettl files, all of which you'll find around. It's handy that you can see how to integrate Ethereal with these other products.
Chapter 8 brings it all together with real world packet captures, many of which are also on the included CD. These files include scans, Trojan uses, and even worm traffic. All of these are useful for learning how to use Ethereal and highlight the power of the tool. You can go from novice to a pretty decent network protocol junkie if you dilligently study the resources in this chapter and on the CD.
Chapter 9 will be useful to a small subset of people, but quite useful. This chapter gives you a tour of how to develop for and extend Ethereal. Ethereal's main strength is a huge number of decode routines, such as sFlow and MPLS (in addition to the standard ones like DNS, DHCP, and the like). Using this information you can extend Ethereal for your own needs and maybe even contribute back to the project.
Either the developer's angle or the detailed discussions and examples of the filter syntax are my favorite parts of the book. They contribute significant value for everyday use, and I found them useful in a recent task at work.
The book is going to run the risk of becoming quickly out of date, given the development pace of Ethereal. However, it relies more on underlying core concepts and principles inherent in Ethereal, so it should stay useful for longer than you may think.
All in all I would say this is probably worth picking up if you're looking at becoming a network operator or network security junkie. You'll learn a lot about a powerful tool, how to integrate it into your use, and even how to dissect real traces of traffic. I give it a 7 out of 10 for the above weaknesses, but that shouldn't stop you from strongly considering it.
You can purchase Ethereal Packet Sniffing from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page
I purchased this book using credit card information I picked up using Ethereal.
Can only understand about half of what it does though. Maybe I'll buy the book.
I look at packets for a living. I generate them, I capture them and dissect them, and I try and make sense of them as quickly as possible.
So what's it like working for the N.S.A.? Do they have a decent benefits package?
I would like to see an integration of Ethereal with google's locator service, or one of those ip to geographical coordinate services. It could bring up a map of the world, and where people are coming from to get to you. Finally, I could project that map on the wall, and be just like in DEFCON 5 the movie! HA HA HA!
stuff |
Why? They already smell like crap.
I used Ethereal back when I was playing with Try2Hack and discovered what information was being sent for The Kill Everyone Project. I then fired up my custom "hacker" program and proceeded to destroy the world approximatly five times per packet.
After crashing the high score page from an integer overflow caused by my rediculously high score, I decided that maybe I should stop.
So after beating the internet, what purpose does a book on Ethereal serve?
What would actually be handy is a browser that you can tell to "step" through message transmissions. The owner of the "Kill Everyone Project" challenged me to hack his other games after I e-mailed him to explain what I did and how he could fix it. The only reason I couldn't do it was because after some cookie passing with my program I couldn't quite get the SWF file with the session ID. With a real browser with "step" it would be possible to let it load up the game session like normal but then set it to "step" mode and be able to edit packets before they go to the server.
I don't imagine it would be too terribly difficult to add such a feature to Mozilla. It would be nice to have a text window that shows what data is actually being sent up to the server with the option to have to manually okay each packet so you could edit out any info you'd rather the server didn't have.
Like when certain Javascript pages try to grab system information.
Ben
Work Safe Porn
Here we go with the n00b questions.. ie. Can it sniff spam packets? Answer: No, spam packets are so mysterious and powerful, no available NIC is capable of passing them to a sniffer program.
Please people, leaving SNIFFING to the professionals!
Mod +5 Drunk
No spam packets are unlike other packets. They are marked with the "spam bit" and this means that sniffers will not capture them or display them.
Cypherpunks: Civil Liberty Through Complex Mathematics. Those who live by the sword die by the arrow.
Get your own Carnivore device...
http://www.systemrecycler.com/shomiti/
My professor is working on a book that uses Ethereal to study networks, but provides all the relevant captures and such to keep students from running traces on active networks
Is this Prof on crack that he/she doesn't think that any of their students is going to try sniffing their neighbors packets on the dorm network? Hell, thats the first thing I'd do!
Where does the school board find them and why do they keep sending them to ME?
Ever mention 'packet sniffing' in a public place?
Suddenly people across the room are hanging on your every word, until they realize you didn't say "panty sniffing" and they can't get vicarious thrills/outrage from the perverted geeks in the corner.
...thats the way i learn alot of stuff u know poking it. Must... contain... jokes...
Don't call me a cowboy, and don't tell me to slow down!
Not to mention the 13 root exploits for Ethereal.
I am Bennett Haselton! I am Bennett Haselton!
Yes, but what are the material componants? Area of effect? Your review of this "Ethereal Packet Sniffing" leaves me wanting.
Why oh why did I have to play so much D&D in high school...
- nmap for basic port sniffing.
- nessus for more extensive security sweeping.
- ethereal for packet capture & analysis.
- snort for intrusion detection.
- magnum marine for spammer management (I feel a mod-down comin on!)
(Apologies if I've left your favorite tool out of this list)I have a vague notion about how to use some of them in limited fashion, but I'm handicaped by not having an intimate knowledge of how IP and TCP really work (down at the packet level).
The Russians have won. They have made the world a cesspool of distrust, greed, fear and hate.