Re: sniffers

On Feb 24, 2006, at 10:19 PM, Bilal Abdullah Fakhruddin wrote:


Recently I am facing problems in my network. Sometimes the network is fast
and sometimes it is slow. Im a bit familiar with Ethereal, but i dont know
what I am looking for. Could anybody help me out by pointing out where i
could start or to any documents available? Thanks in advance.



You need to start with a baseline or failing that, be prepared to grab packets during a "slow" period. Remember that a sniffer in a switched network is subject to the same limits as any other device, it will only see broadcast packets and packets destined to it. So you need to "mirror" or "monitor" a port or ports or VLAN. The other option is to find a link where traffic funnels to and stick a passive tap or hub in-between the endpoints. I have a network where I keep three different cables patched and ready to go at a moments notice.

Right now I'm testing Lanhound since it will let you have remote sniffers feeding back to the master. It is a design much like Distributed Sniffer from NAI/Network General but it's ALOT cheaper :)

For the initial captures, catch everything, no filters except your own MAC. Always filter out your own MAC address.

For more information, wander by where Laura Chappell has some excellent papers, tutorials and more for folding, spindling and mutilating packets :)


The Norwich University program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Tailor your education to your own professional goals with degree customizations including Emergency Management, Business Continuity Planning, Computer Emergency Response Teams, and Digital Investigations.

Relevant Pages

  • Re: [opensuse] SuseFirewall IPv4 vs IPv6
    ... # network security threats. ... # Opening ports for LAN services in the external zone defeats the ... # this setting only works for packets destined for the local machine. ... # If the protocol is icmp then port is interpreted as icmp type ...
  • Re: Ethernet issue: works one way but not another
    ... packets transmitted, 5 packets received, 0% packet loss ... (This is when connected directly to internet through ... FBSD, I have been working with BSDI at the isp I work for for the last ... As for my network topology, I have an internal network that goes ...
  • Re: Update: UDP 770 Potential Worm
    ... > the network immediately after the 'attack', ... were no packets indicating some form of replication. ... I noticed that the UDP ... > of the UDP datagrams is the IP address of the proxy? ...
  • Re: IDSIPS that can handle one Gig
    ... especially with 64-byte UDP packets. ... There are plenty of network IPS's ... IDS/IPS devices through use of fragments. ... Find out quickly and easily by testing it with real-world attacks from ...
  • Re: iptables and dhcp
    ... > the same physical network segment as the firewall and the remote DHCP ... You used INPUT and not FORWARD chain ... # This target allows packets to be marked in the mangle table ...