Sniffing Howto

From: Nuno Branco (branco@markdata.pt)
Date: 10/30/02 

From: Nuno Branco <branco@markdata.pt>
To: security-basics@securityfocus.com
Date: 30 Oct 2002 12:25:41 +0000

I recently found some time to code a little and I was interesting in
doing a little packet sniffer just for for fun. :)

I am working with gcc and libpcap and i already read the tutorial in
www.tcpdump.org. I also tried looking around dsniff source code, but
that's a little ahead of me right now, I want to do more simple stuff
just for learning purposes.

I was looking for more tutorials about how to capture the TCP/UDP/IP
packets in ethernet, more interested in the data layer itself.

Google wasn't able to give me much of interest or I inserted the wrong
question.

Does anyone know any good books or other tutorials about capturing
packets?

Thanks,
Nuno Branco

Relevant Pages

  • Re: Update: UDP 770 Potential Worm
    ... > were no packets indicating some form of replication. ... > my capture was limited due to the switched ... to see if the problem occurs on the test network, ... The proxy had already been isolated from the ...
    (Incidents)
  • Re: Continuous internet activity
    ... IP address out of the exercise (dest address for the packets). ... starts the capture. ... Wireshark is not running, and then it is "safe" to transmit ... There is a small probability of a networking problem, ...
    (alt.comp.hardware.pc-homebuilt)
  • Re: Auditing / Logging
    ... to explicitly set these values and capture the text output seperately. ... The key is that dumping anything to console or making tcpdump generate ... wants in order to capture full packets, save them to disk, and go ...
    (Pen-Test)
  • flooding an embedded device with isic and tcpreplay causing different results
    ... I'm trying to force a reload of an embedded SOHO router/NAT Gateway. ... now I wondering why the tcpreplay attack don't f*** up the SOHO. ... The tcpdump isn't complete because of "dropped by kernel" packets - ... listening on eth0, link-type EN10MB, capture size ...
    (Pen-Test)
  • [TOOL] RPCAP, Remote Packet Capture System
    ... RPCAP is a Remote Packet Capture system. ... and uplink the captured packets to another ... the server which captures network traffic on a remote system, ... and a client, which receives and processes these packets. ...
    (Securiteam)