LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 01-19-2005, 09:23 AM   #1
covertops
LQ Newbie
 
Registered: Jan 2005
Distribution: Debian
Posts: 8

Rep: Reputation: 0
IP Tables , sniffers


Hi

is it possible to use IP Tables as part of a network sniffer ? I'm looking into developing something that uses them in c but not sure yet.... what do you think ?
 
Old 01-21-2005, 09:48 AM   #2
wimdh
LQ Newbie
 
Registered: Aug 2004
Location: Dendermonde, Belgium
Distribution: Ubuntu latest
Posts: 28

Rep: Reputation: 15
Hey,

You can accept every packet an add the log option, so that they are logged into syslog,

but they are tools like tcpdump or ettercap or ethereal that does network sniffing your you...
 
Old 01-22-2005, 11:46 PM   #3
phoenix99
Member
 
Registered: Jun 2004
Location: Canada
Distribution: Slackware 10.2 KDE 3.4
Posts: 43

Rep: Reputation: 15
or simply use snort
 
Old 02-27-2005, 01:10 PM   #4
covertops
LQ Newbie
 
Registered: Jan 2005
Distribution: Debian
Posts: 8

Original Poster
Rep: Reputation: 0
thanks,

Im looking into using syslog. I've tried tcpdump, ettercap , ethereal and a handful of other network analysers , some were pretty good. But I'm really interested in creating my own network analyser. I set snort up on the computer but I havent gotten to try it yet. I thought snort was only an intusion detection system.

anyway thanks again
 
Old 02-27-2005, 03:41 PM   #5
Mara
Moderator
 
Registered: Feb 2002
Location: Grenoble
Distribution: Debian
Posts: 9,569

Rep: Reputation: 171Reputation: 171
Loggin using iptables is not a very good idea, because it's not designed for this. Instead, you can write your own customized code using libpcap library. That's the one tcpdump uses. libpcap handlessniffing, writing packets to files and many interesting things.
 
Old 03-02-2005, 01:34 PM   #6
covertops
LQ Newbie
 
Registered: Jan 2005
Distribution: Debian
Posts: 8

Original Poster
Rep: Reputation: 0
Someone in IBM came up with a way to do it(1) but it involves using kernel modules (firewall hooks) and for some reason the /usr/src/ directroy does'nt have the linux directory. I've downloaded kernel-source for 2.4.18 but its going to take me a long time to work out how to program kernel modules and add and remove them.

Yeah I've been reading alot about libpcap, it looks good. Easy enough to pick up(compared to the kernel modules). Alot of the network analysers ive been looking at use it. I worked through a few tutorials (2) so i think i might just build my analyser using that....







(1)https://www6.software.ibm.com/develo...ket/index.html
(2)http://www.cet.nau.edu/~mc8/Socket/T.../section1.html
 
Old 03-21-2005, 08:40 AM   #7
covertops
LQ Newbie
 
Registered: Jan 2005
Distribution: Debian
Posts: 8

Original Poster
Rep: Reputation: 0
Smile

I built a system using lipcap it went pretty good. I also tried out using ulogging with IP Tables, for analysis but I couldnt get it working yet though.
Finally I developed a system using the Log files from IP Tables. I set the logging options on the IP Table rules and was able to get the log info from /var/log/kern.log files. I then used java to open the file and analysis the info.. I have to say Java is the business....

thanks for all the help.....
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Ethereal and Kismet wireless sniffers difference powah Linux - Wireless Networking 1 10-08-2005 07:19 AM
Http Sniffers leninkoduru Linux - Security 2 01-31-2004 11:31 PM
how to detect sniffers porous Linux - Security 11 01-05-2004 09:15 AM
IP TABLES help chrisfirestar Linux - Networking 2 10-29-2003 12:24 PM
How to stop sniffers ?? jad Linux - Security 8 08-14-2002 09:08 AM


All times are GMT -5. The time now is 06:05 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration