Re: Small hardware network sniffer - does it exist?

Thats exactly what I was going to recommend.

1. buy a soekris box
2. install linux on it
3. put network interfaces in bridge mode --- use bridge modules in
kernel and bridge-utils
4. use iptables and ip-queue module
5.- install snort and run with -Q switch
6. send oll traffic from iptables to snort (snort-inline).
7. Cancel your social lief
8. buy a ton of coffe for reading all logs/capture
9. have fun!

FocusHacks wrote:
http://www.soekris.com/

They have some pretty small machines that are essentially headless
486s that can run BSD or Linux, and many of them have
power-over-ethernet, multiple NICs, WiFi ability, etc.

On 11/2/06, Petr.Kazil@xxxxxx <Petr.Kazil@xxxxxx> wrote:

I have ordered a few hardware keyloggers to play with
(http://www.keelog.com/) and I was wondering if the same idea exists for
networks?
A device that you could tape under a desk, and that would act as a
transparant bridge, sniffing all traffic.

I know that you can use arp-spoofing to get a similar result (easier,
better?), and I know about hardware network taps.
But I'm still interested in the theoretical possibilities of this idea.

I have a few old laptops, but these have just one PCMCIA network card, so
bridging is not possible (well, with the right kind of network cards you
can get two in that slot - I'll see if you can still buy them). But
laptops are too big and heavy.

I've looked at microcontrollers with ethernet adapters, but here I find
webserver appliances with just one network interface. They're small
but I'm
not sure if you could run an OS and a sniffer on them. I've looked at
miniboards but they are very expensive, too expensive for "just a toy".

But, considering that you can get a 2-cigarette-pack sized Pix-firewall,
such hardware must exist. But I haven't found the right keywords yet. Any
ideas?

Greetings, Petr Kazil


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW

------------------------------------------------------------------------







------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------

Relevant Pages

  • Re: How to bind a static ether address to bridge?
    ... For a switched network if_bridge and ARP have to be integrated, ... whether they require forwarding through the bridge or not. ... ARP response flows in on member interface A with an ether destination ...
    (freebsd-stable)
  • Re: PROBLEM: Network sky2 Module
    ... one using X86_64 kernel version 2.6.23-rc5 on a 100Mbit network and one with i386 kernel version 2.6.23-rc6 on a 1Gbit network. ... 0cf8-0cff: PCI conf1 ... 00:00.0 Host bridge: Intel Corporation 82975X Memory Controller Hub ... Latency: 0, ...
    (Linux-Kernel)
  • Re: networking with virtual machine
    ... currently used eth1 by a bride device which uses eth1 and to which I ... Consider a bridge to be a software implementation of a network switch. ... also connect to the bridge and therefore to eth1, and your host system ...
    (Debian-User)
  • Re: 851w config w 12.4(4)-T4 vlan question
    ... Will I still be able to use the 192.168.1 network for the dhcp clients on the wireless bridge? ... ip nat inside source list 1 interface FastEthernet4 overload ...
    (comp.dcom.sys.cisco)
  • RE: [Bridge] [PATCH] macvlan: add tap device backend
    ... of operation (bridge, NAT, VEPA, etc). ... machine to use VEPA to access the network? ... With the macvlan based mode, you use 'ip link' to add a new tap ...
    (Linux-Kernel)