Packet Sniffing

Packet Sniffing

[Patrick Ahler]

Using iptables as a firewall/gateway/router machine for my stub network.
Using snat and dnat to translate internal ip's to public and vice versa.

Want to setup a machine inside the network to packet sniff. I was hoping
iptables could do this. What I'd like is if iptables would route each
incoming packet to the correct machine, but also direct it to the packet
sniffer (in other words duplicate the packet and send to 2 destinations).

Just wondering if this is possible and if it is how can I set this up? I've
also tried doing all my packet sniffing off the firewall, but I've been
unsuccessful, can't seem to get ethereal to look at the forwarded packets.
If someone knows a way to successfully do setup either solutions please let
me know.

Thanks,
Patrick

Re: Packet Sniffing

[Marcelo Moreira]

From: "Patrick Ahler" <patrick@vikus.com>
> Want to setup a machine inside the network to packet sniff. I was hoping
> iptables could do this. What I'd like is if iptables would route each
> incoming packet to the correct machine, but also direct it to the packet
> sniffer (in other words duplicate the packet and send to 2 destinations).
>
> Just wondering if this is possible and if it is how can I set this up?
I've
> also tried doing all my packet sniffing off the firewall, but I've been
> unsuccessful, can't seem to get ethereal to look at the forwarded packets.
> If someone knows a way to successfully do setup either solutions please
let
> me know.

I think things are a bit misconcepted over here...

First, the sniffer machine needs not to receive any packet. It just grabs
them from the network when in promiscous mode.
Also, if you have a switch on your internal network, not all packets will be
broadcasted to the sniffer. So your best choice is to run the sniffer on the
firewall itself, where all the traffic passes through (or just set up a
small hub -- not a switch -- on it's input interface along with the sniffer
computer, this should also work).
The way I do when I need to troubleshoot something is to run tcpdump with
the -w option to capture to a packet file, along with the -s 0 (to capture
full packet), and then open the saved file with ethereal to check the
packets. It works perfectly. But if you need real time sniffing then go for
the prior option (the one with the little hub).

Have fun,
Marcelo.

iptables 1.2.8, mangle-recomputes, userspace?

[Scott MacKay]

Hello, poking around at the website I see the 1.2.8 is
out.  In the 'history'
(http://www.iptables.org/downloads.html#cvs) it
appears there is a patch-o-matic entry between 1.2.7a
and 1.2.8.  To use 1.2.8, do I need to do anything
special?  I currently have the 2.4.20 w/ebtables
patches.

Also, when mangling the contents of a packet
(including payload size), is there anything special
you need to do aside from recomputing IP and TCP/UDP
checksums?

Lastly, are there any good references for userspace
apps?  There is a ton for the netfilter, but was
looking for more in the way of userspace concepts &
activities.  Thanks!

-Scott



__________________________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo
http://search.yahoo.com

RE: Packet Sniffing

[dhiraj.2.bhuyan]

I think using a sniffer on the firewall may not be a good idea (other than
for troubleshooting purpose) 
- as it will leave the box in promiscous mode

Use something like this -



		 -----------		    --------
 public    	|		|   	private  |		|----[Other
private machines/Hubs]
	------| firewall	|--------------|  HUB	|
 interface	|		|	network  |
|----[Machine with sniffer]
	 	 -----------		    --------		



Now all traffic flowing in and out of the private network can be sniffed by
using ethereal/tcpdump 
on the "Machine with sniffer".

Note that many of these so-called-HUB do switching between the 10 and 100
Mbps link. So you will
have to configure all the machines to use the same connectivity speed to be
able to see all traffic.


dhiraj


-----Original Message-----
From: Patrick Ahler [mailto:patrick@vikus.com]
Sent: 14 April 2003 19:30
To: netfilter EMAIL
Subject: Packet Sniffing


Using iptables as a firewall/gateway/router machine for my stub network.
Using snat and dnat to translate internal ip's to public and vice versa.

Want to setup a machine inside the network to packet sniff. I was hoping
iptables could do this. What I'd like is if iptables would route each
incoming packet to the correct machine, but also direct it to the packet
sniffer (in other words duplicate the packet and send to 2 destinations).

Just wondering if this is possible and if it is how can I set this up? I've
also tried doing all my packet sniffing off the firewall, but I've been
unsuccessful, can't seem to get ethereal to look at the forwarded packets.
If someone knows a way to successfully do setup either solutions please let
me know.

Thanks,
Patrick

RE: Packet Sniffing

[Patrick Ahler]

Know of any good packet sniffer's? tcp dump with Ethereal is great, but is
it possible to set up reports from that? I need software that will be able
to print a report of who was looking at what web pages... and then be able
to print out weekly reports for each employee or "IP waster" as I call them
=). The boss is tired of employees lookin at porn during work =).

Thanks,
Patrick

Re: Packet Sniffing

[Aldo Lagana]

The way I do it: forward ports 80 & 443 to Squid and then report on it with
Sarg - which is then published to an internal web server.  The problem w/
straight netfilter data was that it contained too much - I don't care about
SYN versus RST (in my web usage reports) - just tell me who went where and
when they went there.

Sarg web reports are management-friendly too...you won't have to give him
the executive summary ;-\


----- Original Message -----
From: "Patrick Ahler" <patrick@vikus.com>
To: "netfilter EMAIL" <netfilter@lists.netfilter.org>
Sent: Tuesday, April 15, 2003 1:04 PM
Subject: RE: Packet Sniffing


> Know of any good packet sniffer's? tcp dump with Ethereal is great, but is
> it possible to set up reports from that? I need software that will be able
> to print a report of who was looking at what web pages... and then be able
> to print out weekly reports for each employee or "IP waster" as I call
them
> =). The boss is tired of employees lookin at porn during work =).
>
> Thanks,
> Patrick
>
>
>

RE: Packet Sniffing

[Doug Johnson]

In that scenario it is best use use a proxy server (such as Squid) and find
one of many analysis tools http://www.squid-cache.org/Scripts/ to do the
reporting for you. You can even use a redirector to block porn from
precompiled db's. Such redirectors can be found at
http://www.squid-cache.org/related-software.html . And the neat thing is
that some of the analysys tools are setup with the redirectors listed such
as squidGuard and Sarg. They are fairly east to setup.

Good Luck Patrick.
Doug

-----Original Message-----
From: Patrick Ahler [mailto:patrick@vikus.com]
Sent: Tuesday, April 15, 2003 1:05 PM
To: netfilter EMAIL
Subject: RE: Packet Sniffing


Know of any good packet sniffer's? tcp dump with Ethereal is great, but is
it possible to set up reports from that? I need software that will be able
to print a report of who was looking at what web pages... and then be able
to print out weekly reports for each employee or "IP waster" as I call them
=). The boss is tired of employees lookin at porn during work =).

Thanks,
Patrick

RE: Packet Sniffing

[Patrick Ahler]

Squid sounds like a reasonable option, but where would I set that up? On the
firewall, on an internal machine or an external machine?