Preliminary Ethereal User's Guide 79
An Anonymous Coward writes "The prelimiary Ethereal User's Guide is up.
It will be updated over the next month or so, and will be followed by a Developer's Guide.
It is all done in DocBook and the source will be up at the Ethereal web site." If you haven't used ethereal, its an extremely excellent packet sniffer: play with it a little and you'll never use telnet and FTP again (unless of course you knew that already).
Re:Turd! (Score:1)
Re:Mail a problem, too. (Score:3)
stunnel is great for a small number of connections, but the overhead of launching a new process every time is fairly significant as you scale up, so Courier does a great job of a lightweight, secure IMAP server.
You have to use maildir - but both Exim [exim.org] and qmail [qmail.org] support it natively now, and it's far superior to the traditional mbox format anyway.
Re:For One in My Life.... (Score:1)
Sigh. Not to be a language Nazi, but ... (Score:1)
Re:Turd! (Score:1)
Mozilla/4.6 [en] (X11; U; Linux 2.2.14 i586)
Looks like Linux to me....
Re:For One in My Life.... (Score:1)
Re:That's good, now what about security? (Score:2)
Re:*sigh* - use cables with Tx lines snipped (Score:1)
*sigh* What's that saying about a little bit of knowledge being a dangerous thing?
Absolutely. Which is why John's comment is so relevant -- Let's suppose you're working for a Humorless Corporate, and you're found running Ethereal. No admin is going to be happy about it, most will go ballistic, and any pointy-hair is going to see it as a major end-of-job crime. In almost every site I've ever worked, that's a hanging offence for certain (in one Scottish waterfront site, I think it's still one of the few literally hanging offences on the British statute book !).
Are these people right ? How do I know; it all depends on what you did with it, but nearly every company, nearly everywhere, is going to see this as distinctly A Bad Thing.
I'm considering running it at work -- I'm working on streaming, and sniffing traffic from my servers would be pretty useful. Out of courtesy I'd warn the admins though, and I'm lucky in that ours are clueful enough to understand why this is reasonable.
Net guru's who can't afford commercial sniffers. (Score:2)
Etherpeek and NA Sniffer both do pretty much everything ethereal does.
Ethereal has some neat tcp stream watching features, which is rather unique.
Ethereal is more flexible in terms of filters, and certainly being open source and running on unix are great. However...
Ethereal does NOT seem to have any graph-drawing abilities. Etherpeek and the like can generate stats based on packet size distribution, protocol types, and several other factors. I find these very useful features.
Also, the GUI needs work. I mean, it's great, it's clean, it's great for unix, but etherpeek and NA sniffer both color code automatically, in several ways.
Also, it doesn't seem to have the ability to play back what it records into the network (useful for testing/using other devices to analyze captured data). Of course this can be accomplished with other tools, but Etherpeek and NA sniffer both do this out of the box.
Ethereal does seem to have a superior filtering mechanism; however, the filters in NA sniffer and etherpeek are also competent. (read: Ethereal has a kick-ass filter mechanism, but the others are adequate)
Also, when monitoring a busy network, displaying realtime results, etherpeek is unbalanced. screen updates are very slow, and it's a pain in the ass to use. NA sniffer and etherpeek stay smooth.
Yes, of course, NA sniffer and Etherpeek both costs $$$ ($1000 and up). Yes of course, they aren't open source, and of course, don't run on unix.
So.. from a free tool point of view, etherpeek is fantastic.
From a Sniffer point of view, Etherpeek has some neat features, but is not the best.
Re:Ethereal == Nectar of the gods (Score:1)
Um, a "triumph of open source" would be if you fixed it yourself and distributed a patch immediately; no waiting until 1.3, when it may or may not be fixed by Sun...
Specialized sniffer - ipmasq URL logger? (Score:1)
Yes, it's Big-Brotherism; no, I didn't like it either.
BRTB
Ethereal (Score:1)
Who gets the Mojo? (Score:1)
Re:*sigh* - use cables with Tx lines snipped (Score:1)
Re:Ethereal impressed net gurus! (Score:1)
Re:*sigh* - use cables with Tx lines snipped (Score:4)
Re:That's good, now what about security? (Score:1)
try
man scp
for more info
Ethereal == Nectar of the gods (Score:4)
Lucky me, I also run VMWare, which flips on promiscuous mode anyway, so if someone is using a sniffer detector, I can always blame VMWare.
Re:That's good, now what about security? (Score:1)
As for forwarding ftp read the ssh manual.
Re:For ONCE, you git, ONCE, in My Life.... (Score:1)
Here, we discuss some typography basics. While this information is not essential, many font lovers will find it interesting.
3.1 Classifications of Typefaces
Fixed versus variable width
There are several classifications of typefaces. Firstly, there are fixed width fonts, and variable width fonts. The fixed width fonts look like typewriter text, because each character is the
same width. This quality is desirable for something like a text editor or a computer console, but not desirable for the body text of a long document. The other class is variable width. Most of
the fonts you will use are variable width, though fixed with can be useful also ( for example, all the example shell commands in this document are illustrated with a fixed with font ). The most
well known fixed width font is courier.
To serif or not to serif ?
Serifs are little hooks on the ends of characters. For example, the letter i in a font such as Times Roman has serifs protruding from the base of the i and the head of the i. Serif fonts are
usually considered more readable than fonts without serifs. There are many different types of serif fonts.
Sans serif fonts do not have these little hooks, so they have a starker appearance. One usually does not write a long book using a sans serif font for the body text. There are sans serif fonts
that are readable enough to be well suited to documents that are supposed to be browsed / skimmed ( web pages, catalogues, marketting brochures ). Another application that sans serif
fonts have is as display fonts on computer screens, especially at small sizes. The lack of detail in the font can provide it with more clarity. For example, Microsoft touts Verdana as being
readable at very small sizes on screen.
Notable sans serif fonts include Lucida sans, MS Comic Sans, Verdana, Myriad, Avant Garde, Arial, Century Gothic and Helvetica. By the way, Helvetica is considered harmful by
typographers. It is somewhat overused, and many books by typographers plead users to stay away from it.
The old and the new -- different types of Serif fonts
Old Style
Old style fonts are based on very traditional styles dating as far back as the late 15th century. Old style fonts tend to be conservative in design, and very readable. They are well suited to
writing long documents. The name ``old style'' refers to the style of the font, as opposed to the date of its design. There are classic old style fonts, such as Goudy Old Style, which wre
designed in the 20th century. The old style class of fonts has the following distinguishing features:
Well defined, shapely serifs.
Diagonal emphasis. Imagine drawing a font with a fountain pen, where lines 45 degrees anticlockwise from vertical are heavy and lines 45 degrees clockwise from verticle are light. Old
style fonts often have this appearance.
Readability. Old style fonts are almost always very readable.
Subtlety and lack of contrast. The old style fonts have heavy lines and light lines but the contrast in weight is subtle, not stark.
Notable Old Style fonts include Garamond, Goudy Old Style, Jenson, and Caslon ( the latter is contentious -- some consider it transitional )
Moderns ( or didone )
The moderns are the opposite of old style fonts. These fonts typically have more character, and more attitude than their old style counterparts, and can be used to add character to a
document rather than to typeset a long piece. However, nothing is black and white -- and there are some modern fonts such as computer modern and Monotype modern, and New Century
Schoolbook are very readable ( the contrast between heavy and light is softened to add readability ). They are based on the designs popular in the 19th century and later. Their distinguishing
features include:
Lighter serifs, often just thin horizontal lines.
Vertical emphasis. Vertical lines are heavy, horizontal lines are light.
Many moderns have a stark contrast between light and heavy strokes.
Modern typefaces with high contrast between light and heavy strokes are not as readable as the old style fonts.
Bodoni is the most notable modern. Other moderns include computer modern, and Monotype modern ( on which computer modern is based ).
Transitional
Transitional fonts fit somewhere in between moderns and old style fonts. Many of the transitionals have the same kind of readability as the old styles. However, they are based on slightly later
design. While a move in the direction of the moderns may be visible in these fonts, they are still much more subtle than the the moderns. Examples of transitionals include Times Roman,
Utopia, Bulmer, and Baskerville. Of these, Times leans towards old style, while Bulmer looks very modern.
Slab Serifs
The slab serif fonts are so named because they have thick, block like serifs, as opposed to the smooth hooks of the old styles or the thin lines of some of the moderns. Slab serif fonts tend to
be sturdy looking and are generally quite readable. Many of the slab serifs have Egyptian names -- such as Nile, and Egyptienne ( though they are not really in any way Egyptian ). These
fonts are great for producing readable text that may suffer some dilution in quality ( such as photocpied documents, and documents printed on newspaper ). These fonts tend to look fairly
sturdy. The most notable slab serif fonts are Clarendon, Memphis and Egyptienne, as well as several typewriter fonts. Many of the slab serif fonts are fixed width. Conversely, most ( almost
all ) fixed width fonts are slab serif.
The Sans Serif Revolution
Surprisingly, the rise of sans serif fonts is a fairly recent phenomenon. The first well known sans serif fonts were designed in the 19th early 20th century. The earlier designs include Futura,
Grotesque and Gill Sans. These fonts represent respectively the ``geometric'', ``grotesque'' and ``humanist'' classes of sans serif fonts.
Grotesque
The grotesques where so named because the public were initially somewhat shocked by their relatively stark design. Groteques are very bare in appearance due to the absence of serifs, and
the simpler, cleaner designs. Because of their ``in your face'' appearance, grotesques are good for headlines. The more readable variations also work quite well for comic books, and
marketting brochures, where the body text comes in small doses. Grotesques don't look as artsy as their geometric counterparts. Compared to the geometrics, they have more variation in
weight, more strokes, they are squarer ( because they don't use such circular arcs ). They use a different upper case G and lower case a to the geometrics. While they are minimalistic but
don't go to the same extreme as the brutally avant-garde geometrics.
Notable grotesques include the overused Helvetica, Grotesque, Arial, Franklin Gothic, and Univers.
Geometric
The Futura font came with the manifesto: form follows function. The geometric class of fonts has a stark minimalistic appearance. Distinguishing features include a constant line thickness (
no weight ). This is particularly conspicuous in the bold variants of a font. Bold groteques and humanist fonts often show some notable variation in weight while this rarely happens with the
geometric fonts. Also notable is the precise minimalism of these designs. The characters almost always are made up from straight horizontal and vertical lines, and arcs that are very circular (
to the point where they often look as though they were drawn with a compass ). The characters have a minimal number of strokes. This gives them a contemporary look in that they embrace
the minimalistic philosophy that would later take the world of modern art by storm. A tell tale sign that a font is a geometric type is the upper case ``G'', which consists of a minimalistic
combination of two strokes -- a long circular arc and a horizontal line. The other character that stands out is the lower case ``a'' -- which is again two simple strokes, a straight vertical line
and a circle ( the other ``a'' character is more complex which is why it is not used ). Notable geometrics include Avant Garde, Futura, and Century Gothic.
Humanist
As the name might suggest, humanist fonts were designed with a goal of being less mechanical in appearance. In many ways, they are more similar to the serif fonts than the geometrics and
the grotesques. They are said to have a ``pen drawn'' look about them. They tend to have subtle variation in weight, especially observable in bold variants. The curve shapes are considerably
less rigid than those of the geometrics. Many of them are distinguishable by the ``double story'' lower case g, which is the same shape as the g used in the old style serif fonts. The humanist
typefaces are the easiest to use without producing an ugly document as they are relatively compatible with the old style fonts.
Compatible Typefaces
Grouping typefaces is not easy, so it pays to avoid using too many on the one page. A logical choice of two typefaces consists of a serif and a sans serif. Monotype's Typography 101 page
provides a category-matchup. They conclude that the moderns and geometrics form good pairs, while the old styles and humanists also go together well. The transitionals are also paired with
the humanists. The slab serifs are paired with the grotesques, and some variants of the slab serifs are also said to match the geometrics or humanists.
From reading this, one gets the impression that their philosophy is essentially to match the more conservative serifs with the more moderate sans serifs, and pair the wilder modern serifs with
the avant garde looking ( pun unavoidable ) geometrics.
3.2 Ligatures, Small caps fonts and expert fonts
Ligatures
Properly spacing fonts brings with it all sorts of issues. For example, to properly typeset the letters ``fi'', the i should be very close to the f. The problem is that this causes the dot on the i to
collide with the f, and the serif on the head of the i to collide with the horizontal stroke of the f. To deal with this problem, font collections include ligatures. For example, the ``fi'' ligature
character is a single character that one can substitute for the the two character string ``fi''. Most fonts contain fi and fl ligatures. Expert fonts discussed later often include extra ligatures, such
as ffl, ffi, and a dotless i character.
Small caps fonts
Small caps fonts are fonts that have reduced size upper case letters in place of the lower case letters. These are useful for writing headings that require emphasis ( and they are often used in
LaTeX ). Typically, when one writes a heading in small caps, they use a large cap for the beginning of each word, and small capitals for the rest of the word ( ``title case'' ). The advantage of
this over using all caps is that you get something that is much more readable ( using all caps is a big typographic sin ).
Expert fonts
Expert fonts consist of several extras designed to supplement a typeface. These include things like ligatures, ornaments ( much like a mini-dingbats collection designed to go with the typeface
), small caps fonts, and swash capitals ( fancy, calligraphic letters ).
3.3 Font Metrics and Shapes
Font metrics define the spacing between variable width fonts. The metrics include information about the size of the font, and kerning information, which assigns kerning pairs -- pairs of
characters that should be given different spacing. For example, the letters ``To'' would usually belong in a kerning pair, because correctly spaced ( or kerned ), the o should partly sit under
the T. Typesetting programs such as LaTeX need to know information about kerning so that they can make decisions about where to break lines and pages. The same applies to
WYWIWYG publishing programs.
In addition to the metrics, is the font outline, or shape. The components of the fonts shape ( a stroke, an accent, etc ) are called ``glyphs''.
Re: Analyzer (Score:2)
Try giving a URL for it.
I'll assume that you're referring to Analyzer from the folks at the Politecnico di Torino [polito.it], the folks who also bring you WinDump [polito.it], a port of tcpdump [tcpdump.org] to Win32 systems, and WinPcap [polito.it], a port of libpcap [tcpdump.org] to Win32 systems (including drivers for Windows 9x and Windows NT, including NT 5.0^H^H^H^H^H^HWindows 2000), which is the library that Ethereal on Win32, Analyzer, and WinDump all use.
(The Politecnico di Torino site appears not to be responding at the time that I'm posting this; be patient - we sometimes get folks posting to the ethereal-users mailing list asking "that site is down, how do I get WinPcap?", for which the answer is "it's probably just temporarily down, try again later".)
Re:Use caution (Score:1)
Re:Fun...... (Score:1)
Re:Switched networks (Score:1)
Use caution (Score:2)
Carnivore? (Score:1)
Seriously however, I've tried most Windows packet sniffers and ugh, no good. The only reasonable one is Microsoft's own sniffer, which is out of the price range of someone trying to troublehsoot HTTP streams.The rest of them usually manage to blow out your connection.
I'm hoping the FBI uses this as their sniffer so my email address doesn't get munged onto the Child Porn Pirates email traffic.
TROLL: ROT13? (Score:1)
$ssh=~ tr/a-zA-Z/n-za-mN-ZA-M/;
then:
$ssh=~ tr/a-zA-Z/n-za-mN-ZA-M/;
to decrypt.
Why do I bother?
Re:Use caution (Score:1)
Re:I'll never use ftp again? (Score:1)
As long as you only log in anonymously you don't have to worry, but if you log in using FTP on a site where you want to be sure that noone is messing with your private files you should use another protocol (or some ftp+ssl solution).
--
Re:The Slashcode guys should see this (Score:1)
instead of location.
But I have other bugs than the any tag on fake email.
Re:That's good, now what about security? (Score:1)
Re:Use caution (Score:2)
Re:Use caution (Score:1)
However, on a properly configured network most people will be properly isolated from seeing most traffic due to switching. I used to be on a very busy hub. I could see pretty much everything. It was very interesting. After they got more connections installed to get rid of the hub we all went to the switch. Now I only see stuff for me and broadcast stuff.
As a side note, I have to say the Ethereal packet analyser is one of the best peices of open source software I have ever seen. I think there's a lot of crappy open source stuff out there that gets a lot more credit then it deserves but Ethereal is excellent and does not suffer from these problems as far as I can tell. It doesn't get every packet right and occationally it crashes but it's not 1.0 yet. I have been using it for some time to reverse engineer the CIFS protocol(Microsoft Windows native file and print sharing protocol) and it works fantastic. It basically made the project possible. I have spend probably _hundreds_ of hours in front of it.
http://www.zing.org [zing.org]
Thanks Richard!
KidSock
Re:Ethereal impressed net gurus! (Score:1)
When I worked in networking, a sniffer that could decode the protocol I dealt with was the only real tool I used. At the time Lanwatch was the only one that could really decode the protocol I used.
That's good, now what about security? (Score:1)
Why is there no spoon?
Ethereal impressed net gurus! (Score:2)
I remember showing Ethereal to some guys who did network troubleshooting for a living, and they were astounded. I highly recommend giving it a try.
Ethereal manual (Score:1)
A better manual would have come in handy when I was trying to use the filter option to isolate packets.
Who knows, maybe support for SSL will come next? I'd love to be able to snoop and decipher ssl data on the fly (If I had access to the private key of the enciphered stream).
Re:needed extra when I installed on a redhat 6.2 b (Score:2)
Ah, the joys of binary non-compatibility; UCD SNMP 4.1.1, which RH 6.2 picked up, changed a routine Ethereal uses into a macro, which meant that the Ethereal in the binary RPMs, which were built on RH 6.1, and linked with the UCD SNMP shared library, don't work on 6.2, as a routine it calls isn't present in the 6.2 UCD SNMP shared library. (UCD SNMP 4.1.2 turned that and other macros back into routines; I filed a bug with Red Hat suggesting that they pick up 4.1.2, which, as I remember, they said they'd do in 7.0.)
I threw into Ethereal 0.8.10 a greasy hack, inspired by greasy hacks I've been told are used on Windows to e.g. allow applications to use new DLL routines if present on a particular system without blowing up if they aren't, to work around that.
Whilst it worked on my simulation of that situation on my Debian 2.1 partition, it appears not to work on RH 6.2; I have some diagnostic information from one user who reported that on the ethereal-users mailing list, and will see if I can check in a change more likely to make it Just Work.
That's all you did? Just installing those two RPMs? That's bizarre - what files did installing those two RPMs add to your system?
Or is there an "I then recompiled from source" step after that step?
Re:Use caution (Score:1)
If an unauthorized person is sniffing packets on my company's network, they are going to be in very deep sh*t, I can promise you that.
Sniffing FAQ (Score:5)
Sniffing (network wiretap, sniffer) FAQ [robertgraham.com]
Re:Slash (Score:1)
Get comfortable with yourself and you'll be comfortable with others.
- Desi
Re:I'm not sure this is entirely true (Score:2)
Now the way to find out is to send frames with valid IP data, but to a invalid MAC. Normally the card would filter this out, but *gasp* it doesnt, its in promisc mode.
Thats how the promisc scanners find data. Some OSs will drop the invalid MAC (realizing its not their own) others accept it assuming that the hardware would filter it out
*Not a Sermon, Just a Thought
*/
Re:Sniffers aren't as useful as they used to be (Score:3)
Sniffer programs are also useful if you only care about the traffic between two machines, at least one of which is capable of running the sniffer program (or can otherwise produce a network trace file). Perhaps that's less common for network administrators than for software developers, but if you're a developer at a manufacturer of, well, Network Appliances, packet analyzer programs can come in very handy even if you can't see all the traffic on a network segment.
Mail a problem, too. (Score:2)
Of course, people forget about their mail a lot. Here at UMN [umn.edu], our central mail servers run stunnel [stunnel.org], so you can read your POP3 or IMAP mail over an SSL tunnel. Before I found out that they were doing this, I was really bothered by how many people could be sniffing my password. I had tried usin SSH tunnels, but that required you to stay logged in.
New versions of Netscape Communicator do support SSL, and I believe recent versions of mutt do too.
--
Ski-U-Mah!
Re:Other sniffers (Score:2)
If you're using Windows, at least.
You'll need WinPcap [polito.it] to get it to capture packets at all - but you'll need WinPcap to get Ethereal to capture packets on Win32 as well.
The Politecnico di Torino folk also have WinDump [polito.it], a port of tcpdump to Win32, also using WinPcap.
Or just go to the Analyzer site [polito.it] (I'm assuming from the reference to WinPcap that you're talking about the Politecnico di Torino Analyzer). If the site isn't up, try again later.
Re:Ethereal impressed net gurus! (Score:2)
Provides a GUI packet capture and analysis program for UNIX? GUI sniffers are something Windows and Mac folk have been used to for a while, but if the network administrators had only seen tty-oriented tools such as tcpdump or snoop, Ethereal might've been a surprise.
Ethereal isn't the only GUI packet capture and analysis program for UNIX; there's also Knetdump [uni-duisburg.de] (given the first letter, nobody gets a prize for guessing which GUI toolkit and desktop environment it uses :-)), and there's also tcpview [washington.edu], a Motif application based on an old version of tcpdump.
Re:I'm not sure this is entirely true (Score:1)
Other sniffers (Score:1)
What other (good) sniffers are their for the Windows platform?
Re:Mail a problem, too. (Score:3)
yup... because you'll go blind!!!
Re:For One in My Life.... (Score:1)
Re:Use caution (Score:1)
Re:Use caution (Score:1)
socket. The point is that if you start looking inside packets, it is
possible to see that the packets have been tampered with.
I'm not sure this is entirely true (Score:3)
To watch net traffic, the Ethernet interface must be put into 'promiscuous' mode (accepts all packets, even if not addressed to your particular machine).
true
Some network administrators are sensitive to this sort of thing, since it can be used to compromise security.
According to the sniffit FAQ detecting 'promiscuous' mode is only possible if the os is broken or not configured properly. It is my understanding that linux or even win32 in this mode would be very hard to detect.
Perhaps you recall slashdot's article about packet sniffer-sniffers from Lopht [lopht.com]. There is much skepticisim as to whether or not 'Antisniff' can really work as it seems to make alot of assumptions about the machines it scans. If memory serves, one of the tests is to send a message to the client machines and record the time it takes to respond. Then in the future if it respond significantly slower something may be up. Another is to try to overload machines by sending a large number of forged packets all good machines will ignore and the promisc machine will choke on.
With the current state of ethernet sniffing is basically risk free.
The only down side is that you need to be within the same subnet as the victim machine.
Re:That's good, now what about security? (Score:2)
An advantage of S/Key is that you don't need to trust the system you are logging in from.
As a matter of interest, how do you forward ftp over ssh? Is this by using ssh to construct a VPN, or is there some other trick?
Re:Other sniffers (Score:1)
SCP stuff (Score:1)
It seems really strange, all things considered, and how much people complain about the insecurity of FTP.
TheGeek
Re:Use caution (Score:2)
Sniffers aren't as useful as they used to be (Score:1)
Some switches can be programmed to put a port into 'diagnostic mode' (forward all packets to this port because there's a sniffer there) but it's usually more trouble than it's worth, especially when you have a large building with a dozen or more switches.
That said, I'll probably still try out Ethereal. For the times that I still can make use of a sniffer, it'll be nice to get that DOS partition off my laptop.
--
Re:Mail a problem, too. (Score:1)
If you think education is expensive, try ignornace
Re:I'm not sure this is entirely true (Score:1)
Re:I'm not sure this is entirely true (Score:1)
eth0 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
inet addr:x.x.x.x Bcast:x.x.x.x Mask:255.255.255.128
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:5490631 errors:362 dropped:0 overruns:0 frame:492
TX packets:5668545 errors:2 dropped:0 overruns:0 carrier:3
collisions:1153503 txqueuelen:100
Interrupt:11 Base address:0xe400
Note the PROMISC flag above. The results of "ifconfig eth0" on my Linux machine.
I'll never use ftp again? (Score:1)
Re:I'm not sure this is entirely true (Score:1)
Is it just me.. (Score:1)
Coincidence.. I think not.
Re: dhat (Score:1)
--
Re:Switched networks (Score:1)
turn one port in to hub mode and see everything
and you happily operate as though everything is tickety boo as you telnet and su your way around your network
one rogue employee and it's asta la vista I believe
Cheops has a lot of potential also ... (Score:2)
Cheops is a network "swiss army knife". It's "network neighborhood" done right (or gone out of control, depending on your perspective). It seems that the development has slowed down a bit though.
Have a look at:
http://www.marko.net/cheops/ [marko.net]and
http://www.marko.net/cheops/features.html [marko.net]Re:Use caution (Score:1)
Re:Other sniffers (Score:1)
Re:Ethereal User's Guide? (Score:1)
Actually, there has been systematic discrimination against ghosts in computer games since the early days. The ghosts were none too happy about being cast as the villians in Pac-man, for example.
But things are starting to look up. Programs specifically targetted at ghosts are starting to appear -- first came Ghostscript, and now there's Ethereal.
Re:Switched networks (Score:1)
Obviously switched topologies do make it harder to get visibility of the entire network. However, some products including NAI's Sniffer range do allow you to set a span port on your switch (from inside the Sniffer software in some cases) and then sniff the mirrored port. Additionally, you can send traps from the switch to NAI's Sniffer that will allow it to snap to switch generated alarms on a port, or it will do port roaming. So while you do get a cut down view, you get some visibility into potential issues.
Additionally, you need to consider your network design - VLANs are a good environment to incorporate Sniffer into. And there is always more to sniff than just your LAN. You might want to keep an eye on your ATM or Gigabit backbone, your Packet over Sonet links, or Frame Relay, HSSI, HDLC, PPP, etc. I know you can do all of that and a bit more with the NAI Sniffer, so I wouldn't rule out Sniffing as a network management tool!
I'll get off my soapbox now, shall I?
Snifferchick
Re:Ethereal impressed net gurus! (Score:2)
I assumed (perhaps arrogantly?) that a network administrator would invest in network tools, regardless of the OS involved. I know that any well equipped network shop has a copy of either etherpeek or NA sniffer...., or something darn similar.
A $30,000 Wandell & Goltermann network analyzer runs windows 3.11....
*sigh* - use cables with Tx lines snipped (Score:3)
SOME NICs will "chirp" when put into promiscuous mode. SOME OSes will exhibit slightly different behavior on their TCP/IP stack when the NIC is running in promiscious mode.
But all of that is irrelevant. Anyone who seriously wants to sniff your network will snip the Tx lines on a special patch cable. Then it doesn't matter what the NIC or OS is doing - nobody will see anything coming out of that NIC. The only(?) way to detect it is by checking line impedence - something a well-stocked site could handle, but not most businesses or schools.
Obviously, this trick will also keep you from actually doing anything useful -- and that itself might be suspicious. (Or might not, if this "dead" system is sitting in a dorm room or otherwise unoccupied office.) But if you have access to a hub (official or not) and a second NIC....
Re:Use caution (Score:2)
Just having the switch hides all your traffic other than broadcast traffic... (arp, etc..)
That, plus perhaps some security settings, and you're set..
Re:That's good, now what about security? (Score:1)
Re:SCP stuff (Score:1)
Re:That's good, now what about security? (Score:1)
Be sure to test out the setup by telneting in from a cable modem though.
Re:Ethereal impressed net gurus! (Score:2)
Certainly, it may have some neat-o-rama features that they don't... it may even be better.. but enough to astound them?
Re:Sigh. Not to be a language Nazi, but ... (Score:1)
-----------
"You can't shake the Devil's hand and say you're only kidding."