A Network Sniffer On Steroids

QuantumCrypto writes "Errata has developed a new network sniffer, dubbed 'Ferret,' that looks for traffic using 25 protocols, including those for the popular instant message clients as well as DHCP, SNMP, DNS and HTTP. This means the sniffer will capture requests for network addresses, network management tools, Web sites queries, Web traffic and more. 'You don't realize how much you're making public, so I wrote a tool that tells you,' said Robert Graham, Errata's chief executive. Errata has released the source code to this version 1.0, 'feature-poor and buggy' tool on its site. Anyone with a wireless card will be able to run it, Graham said."

Comments

Wireshark?

[Hackeron]

How is this different to say wireshark or any other traffic analyzer?

Anyone remember a Mac one from 99/2000?

[Kadin2048]

Does anyone remember a Mac utility that came out a while back (by which I mean, maybe 5 or so years ago), that would put an Airport into promiscuous mode, and sniff for traffic, and then decode and display any images that it sniffed? It was a pretty amusing little program; I think I remember reading that it was thrown together at MacHack and won best of show, or some other honor.

Basically you could run it, and it would give you an idea of what everyone on the wireless network was browsing, in the clear, at that moment, all sort of jumbled together.

I've always wanted something like that, to use as a demonstration of how insecure most wireless APs (unencrypted ones) are, for nontechnical people, but I've never been able to find it, or any record of it. Sometimes I wonder if I just hallucinated the whole story.

It would be a heck of a demo to just run something like that, particularly if you could target a particular connection, and then tell someone to load a web page, and be able to instantly display some or all of the page, or at least its images, in real time, to prove that you really were listening in on what they were doing. Most packet sniffers don't provide any direct, obvious, graphical output of stuff they sniff, and that's frankly just not dramatic enough to make an impression.

EVERYTHING about this article is wrong.

[jurgen]

This is a great example of the worst of slashdot (which isn't saying much)... just about everything in this article as it appears on the main page is wrong, word for word.

• Category: YRO... why? What does this have to do with "rights"?
  
  
• Title: "Sniffer on Steroids". Nothing steroidal about it... according to the authors of the software it is a buggy piece of shit whipped up quickly to demonstrate a very /specific/ type of traffic analysis for a talk.
  
  
• "Looks for traffic using 25 protocols". Uh no, it doesn't use the protocols, it analyzes them.
  
  
• List of protocols and applications... misses the point entirely as nothing explicitly as any other sniffer can also "capture" all those protocols. The point is that this program looks for and explicitly points to information within those protocol that you probably didn't realize was "seeping" out with those protocols. Mind you, you could still find all that same information with ANY OTHER SNIFFER... there is nothing technologically new about this sniffer. Rather, the authors have made a list of things that "seep" out with various applications and protocols that most people haven't thought of, and have written a simple ordinary sniffer that explicitly includes this list.
  
  
• "Anyone with a wireless card will be able to run it"... uhm, yeah, anyone with a WINDOWS machine and the right kind of wireless card. Doh.
  

Even for slashdot, that's pretty bad, eh?

:j

Re:They probably already are

[Lord Ender]

Right. He had advanced security software, a van with sophisticated antennas, and no IT department to fix failures of their own equipment. So he takes it to Best Buy, where the teenage "technicians" install unnecessary anti-virus software, which proceeds to wipe out ("clean") all his security software...

Yeah, right. They don't make salt grains big enough.