Slashdot Mirror
A Network Sniffer On Steroids
QuantumCrypto writes "Errata has developed a new network sniffer, dubbed 'Ferret,' that looks for traffic using 25 protocols, including those for the popular instant message clients as well as DHCP, SNMP, DNS and HTTP. This means the sniffer will capture requests for network addresses, network management tools, Web sites queries, Web traffic and more. 'You don't realize how much you're making public, so I wrote a tool that tells you,' said Robert Graham, Errata's chief executive. Errata has released the source code to this version 1.0, 'feature-poor and buggy' tool on its site. Anyone with a wireless card will be able to run it, Graham said."
Does anyone know if there are any special driver requirements, beyond "anyone with a wireless card?" The documentation is rather...sparse. I've got a Broadcom wireless card in my laptop and it's generally a pain to get things like aerodump going; it requires installing a debug driver, then rolling back the driver afterwards, and the network functionality itself is disabled during this period, at least with aerodump.
I'm curious if ferret can sniff without the added hassle...
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
How is this different to say wireshark or any other traffic analyzer?
First of all, they probably are sniffing you whenever it's convenient (like at the airport).
Second of all, people sadly don't seem to care all that much.
This looks like a cool tool, and I share the hope of an earlier poster that it will work with Broadcom cards - since that's what I have.
You mean that by analyzing my DNS and HTTP traffic, either in the clear or from a cracked WEP session, that you can infer, or worse, identify, certain definite pieces of information about my Internet usage habits?
Boy, if I had a tool that could do that, I'd certainly astroturf it on Slashdot.
I want to delete my account but Slashdot doesn't allow it.
I needed a steroid sniffer that works on my network.
Can I operate it in reverse or something?
My neighbor likes clown pron.
Libertarian Leaning Political Discussion Forum.
I've seen this before. It starts off with steroids, but pretty soon the network sniffer moves on to crack cocaine. A short while later, he takes a job as a fluffer in midget porn movies to feed his habit.
Does anyone remember a Mac utility that came out a while back (by which I mean, maybe 5 or so years ago), that would put an Airport into promiscuous mode, and sniff for traffic, and then decode and display any images that it sniffed? It was a pretty amusing little program; I think I remember reading that it was thrown together at MacHack and won best of show, or some other honor.
Basically you could run it, and it would give you an idea of what everyone on the wireless network was browsing, in the clear, at that moment, all sort of jumbled together.
I've always wanted something like that, to use as a demonstration of how insecure most wireless APs (unencrypted ones) are, for nontechnical people, but I've never been able to find it, or any record of it. Sometimes I wonder if I just hallucinated the whole story.
It would be a heck of a demo to just run something like that, particularly if you could target a particular connection, and then tell someone to load a web page, and be able to instantly display some or all of the page, or at least its images, in real time, to prove that you really were listening in on what they were doing. Most packet sniffers don't provide any direct, obvious, graphical output of stuff they sniff, and that's frankly just not dramatic enough to make an impression.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
The Errata sniffer, dubbed Ferret, packs more punch than other network sniffers already available, such as Ethereal and Kismet, because it looks at so many different protocols, Graham said. Some at Black Hat called it a "network sniffer on steroids."
Oh Wowsers! DHCP, SNMP, DNS and HTTP! That's so many! It's a shame Ethereal can only look at these!
I'm willing to bet that most people with a wireless network card dont even know what the term "sniffer" means, much less be able to run one.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Incredible... they support 25 protocols!!!
And to think I used to use Wireshark/libpcap which is open source, available on almost every platform, is not buggy, and supports hundreds of protocols. It even has a graphical user interface.
But I think these guys are really on to something...
using System.Awesome;
Proxim 8482-FC ORiNOCO Wireless 11a/b/g PCI Card, $82.27Do you think they're RoHS-compliant, too?
Wireshark does waaaaay more than 25 protocols.
I think there is a world market for maybe five personal web logs.
What makes this sniffer stand out is not the fact that it can parse different protocol formats -- it's that it collects relevant data in a meaningful summary.
For example, any sniffer can filter and then parse HTTP traffic, but an analyzer like this one tells you relevant bits like someone's web account names.
If I were you, I'd be buying lotto tickets. I have a box going somewhere of WiFi cards that I've ripped out of systems because I couldn't get them working on Linux. It's not full, but there are a bunch in there, plus a bunch in systems that just don't work and I've not bothered to pull, plus a lot more that I've tried to get working and returned. They tend to be a combination of Marvell and Texas Instrument ACX chipsets, neither of which I've ever gotten to work successfully (and by "work," I mean natively, without Windows-driver hacks, and will work with WPA-PSK AES, and without installing anything alpha-quality or destabilizing). The TI ones are particularly awful, because they're the kind that require firmware blobs to be loaded at startup, so they'll pretty much never be supported in the hardcore FOSS distros (although I heard a rumor that Mepis may support them).
I have only ever gotten lucky with one wireless card on a Linux machine, and that was a DWL-650 and Ubuntu Dapper, a combination which (naturally) you can't buy anymore, because the DWL-650 has been replaced by the DWL-650+, which has a completely different (ACX!) chipset.
My plan is to dump the crate out every few years and see if the situation has changed, but after buying and returning pretty much every card at all of the local stores which even seemed to be distantly or possibly related to anything that might have out-of-the-box Linux drivers, I decided to can the whole endeavor.
It's easier, IMO, (and cheaper, if you look at the prices for "real" Linux-compatible WiFi cards from Orinoco/Cisco/etc. -- notwithstanding the fact that they need to be ordered a week in advance of when you need them) to buy routers that will work in bridge mode (aka "game adapters", or a WRT54GL with DD-WRT if you can find one), and can just be attached to any type of box via Ethernet, than to actually mess around with getting a card working natively on anything except Windows and MacOS. (And it's not like Windows is necessarily any picnic, either, particularly when you start talking about WPA. MacOS only avoids it by only having a handful of cards.)
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
You should be out in the garage getting your clown suit on.
The Kruger Dunning explains most post on
in order to run ferret on vista, you need to run cmd.exe as administrator b4 running ferret from the cmd line.
According to this banner ad I saw on another site, my IP address is visible!
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
They include the source code, and say that it "should" compile in linux. However, it uses many Windows-specific variable types. This code will not be cross compatible without a major overhaul.
This program is not ethereal on steroids. It's more like ethereal and kismet got drunk, had sex, and had a retarded baby, which they named ferret.
Write your own Choose Your Own Adventure. http://www.freegameengines.org/gamebook-engine/
Good for linux- with monitor mode
:) - http://madwifi.org
* Atheros-based cards. Strangely, I don't hear these mentioned very often, but they have excellent support, complete with monitor mode, creating multiple interfaces from one card, etc. Oh and airpwn supports it
* Intel Pro Wireless (2100 / 2200 / 2950) - Works well, has monitor mode, wep in hardware, drivers actually developed by intel - http://ipw2200.sf.net and in the kernel at this point
* Orinoco / Hermes / Lucent cards - in the kernel
* Cards based on the Prism chipset based (http://prism54.org) BE WARNED though, some of the newer ones require "softmac" firmware which is currently not working all that well
I have used a card from all of these manufacturers and if I were getting a new laptop, I would probably go with Atheros and if not that, then Intel.
Even for slashdot, that's pretty bad, eh?
I have a friend who works at Best Buy/Geek Squad. A guy came in with a government contract and a laptop, needing repairs. He was making small talk and said his job was to wardrive around and break into people's home computers and search them for child porn.
Take it with a grain of salt - the guy was just some dude with a busted laptop walking into a Best Buy. But he did have a government contract, and a lot of wireless sniffer software on his machine.
Weaselmancer
rediculous.