Slashdot Mirror
A Network Sniffer On Steroids
QuantumCrypto writes "Errata has developed a new network sniffer, dubbed 'Ferret,' that looks for traffic using 25 protocols, including those for the popular instant message clients as well as DHCP, SNMP, DNS and HTTP. This means the sniffer will capture requests for network addresses, network management tools, Web sites queries, Web traffic and more. 'You don't realize how much you're making public, so I wrote a tool that tells you,' said Robert Graham, Errata's chief executive. Errata has released the source code to this version 1.0, 'feature-poor and buggy' tool on its site. Anyone with a wireless card will be able to run it, Graham said."
How is this different to say wireshark or any other traffic analyzer?
I needed a steroid sniffer that works on my network.
Can I operate it in reverse or something?
My neighbor likes clown pron.
Libertarian Leaning Political Discussion Forum.
Broadcom chipsets are absolute and utter crap. DO NOT USE THEM.
The problem is that you could toss out your crappy, but admittedly working, Broadcom-based card, and inadvertently pick up a Marvell one instead, or one of the newer ones that have some sort of proprietary binary blob firmware that gets loaded by the driver, and will probably never, ever have legitimate Linux drivers.
If you have a wireless card that actually works on Linux, here's a piece of advice: get on your knees and thank the diety of your choice for smiling on you, and not leading you astray into the Purgatory of identical-model-number-but-different-chipsets, or the Hell of alpha-quality drivers. And then, don't mess with anything.
And if you got AES working, sacrifice a goat.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
I've seen this before. It starts off with steroids, but pretty soon the network sniffer moves on to crack cocaine. A short while later, he takes a job as a fluffer in midget porn movies to feed his habit.
Does anyone remember a Mac utility that came out a while back (by which I mean, maybe 5 or so years ago), that would put an Airport into promiscuous mode, and sniff for traffic, and then decode and display any images that it sniffed? It was a pretty amusing little program; I think I remember reading that it was thrown together at MacHack and won best of show, or some other honor.
Basically you could run it, and it would give you an idea of what everyone on the wireless network was browsing, in the clear, at that moment, all sort of jumbled together.
I've always wanted something like that, to use as a demonstration of how insecure most wireless APs (unencrypted ones) are, for nontechnical people, but I've never been able to find it, or any record of it. Sometimes I wonder if I just hallucinated the whole story.
It would be a heck of a demo to just run something like that, particularly if you could target a particular connection, and then tell someone to load a web page, and be able to instantly display some or all of the page, or at least its images, in real time, to prove that you really were listening in on what they were doing. Most packet sniffers don't provide any direct, obvious, graphical output of stuff they sniff, and that's frankly just not dramatic enough to make an impression.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
If you have a wireless card that actually works on Linux,
Just check what card it is before you buy, and don't buy any that don't have Open Source, native Linux support. It's what I do. Cisco, Orinoco, the new Intel IPW drivers.
If you buy something that doesn't work, don't cry when it doesn't work.
Get your own free personal location tracker
Incredible... they support 25 protocols!!!
And to think I used to use Wireshark/libpcap which is open source, available on almost every platform, is not buggy, and supports hundreds of protocols. It even has a graphical user interface.
But I think these guys are really on to something...
using System.Awesome;
Proxim 8482-FC ORiNOCO Wireless 11a/b/g PCI Card, $82.27Do you think they're RoHS-compliant, too?
Wireshark does waaaaay more than 25 protocols.
I think there is a world market for maybe five personal web logs.
What makes this sniffer stand out is not the fact that it can parse different protocol formats -- it's that it collects relevant data in a meaningful summary.
For example, any sniffer can filter and then parse HTTP traffic, but an analyzer like this one tells you relevant bits like someone's web account names.
You should be out in the garage getting your clown suit on.
The Kruger Dunning explains most post on
They include the source code, and say that it "should" compile in linux. However, it uses many Windows-specific variable types. This code will not be cross compatible without a major overhaul.
This program is not ethereal on steroids. It's more like ethereal and kismet got drunk, had sex, and had a retarded baby, which they named ferret.
Write your own Choose Your Own Adventure. http://www.freegameengines.org/gamebook-engine/
Good for linux- with monitor mode
:) - http://madwifi.org
* Atheros-based cards. Strangely, I don't hear these mentioned very often, but they have excellent support, complete with monitor mode, creating multiple interfaces from one card, etc. Oh and airpwn supports it
* Intel Pro Wireless (2100 / 2200 / 2950) - Works well, has monitor mode, wep in hardware, drivers actually developed by intel - http://ipw2200.sf.net and in the kernel at this point
* Orinoco / Hermes / Lucent cards - in the kernel
* Cards based on the Prism chipset based (http://prism54.org) BE WARNED though, some of the newer ones require "softmac" firmware which is currently not working all that well
I have used a card from all of these manufacturers and if I were getting a new laptop, I would probably go with Atheros and if not that, then Intel.
Even for slashdot, that's pretty bad, eh?
Right. He had advanced security software, a van with sophisticated antennas, and no IT department to fix failures of their own equipment. So he takes it to Best Buy, where the teenage "technicians" install unnecessary anti-virus software, which proceeds to wipe out ("clean") all his security software...
Yeah, right. They don't make salt grains big enough.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.