use of Sniffer Pro. The following is my learning experience over the past few years.
I. network topology: Network Management Learning Environment
Required for this networking
Device
Is a CISCO3550 switch and a PC. The switch supports the SNMP protocol and runs the Sniffer Pro and MIB browser programs on the PC. The Park extension is as follows:
actual programming, you also need to use a Data Structure to represent the IP address data segment header. The following describes the definition of this data structure:
Typedef struct _ IP {Union {BYTE Version; // VersionBYTE HdrLen; // IHL};BYTE ServiceType; // service typeWORD TotalLen; // total lengthWord id; // IDUnion {WORD Flags; // flagWORD FragOff; // segment offset};BYTE TimeToLive; // Life CycleBYTE Protocol; // ProtocolWORD HdrChksum; //
to manually set the NIC to the hybrid mode and set it with the root permission:
Ifconfig eth0 promisc
Assume that eth0 is your Ethernet device interface, and then the compiled program list is the C program above) you will be able to see the accepted packets! Important message: the function of this program is too simple. It can only display the source address, target address, source port, target port, and other extremely simple information. It is useless for you, but you can change it)
I. Sniffer Principle Analysis Before implementing the sniffer, We need to master the TCP/IP protocol. TCP and IP protocols refer to two network protocols or data transmission methods used on the Internet ). They are transmission control protocol and Internet connection protocol
short arp_pro; Unsigned char arp_hln; Unsigned char arp_pln; Unsigned short arp_opt; Unsigned char arp_sha [6]; Unsigned long arp_spa; Unsigned char arp_tha [6]; Unsigned long arp_tpa; } Arp_header; The above is the structure of the ARP packet transmitted in the network. As for the specific meaning of each field in the structure and how to initialize, beyond the scope of this article, you are interested to see the TCP-IP protocol details b
Among today's many hacking technologies, sniffer is the most common and important technology. Anyone who has used the sniffer tool on windows (for example, netxray and snifferpro) may know that in a shared Lan, using the sniffer tool can provide a clear view of all the traffic in the network! Among today's many hacking technologies,
.
Prevents inbound snifferFor the powerful 'sensitiveness 'of the sniffer, you may be most concerned with transmitting sensitive data, such as user IDs or passwords. Some data is not processed, and the information can be obtained once it is sniffer. The solution to these problems is encryption.
SSH, full name: Secure Shell, is a protocol that provides Secure Comm
short arp_pro;
Unsigned char arp_hln;
Unsigned char arp_pln;
Unsigned short arp_opt;
Unsigned char arp_sha [6];
Unsigned long arp_spa;
Unsigned char arp_tha [6];
Unsigned long arp_tpa;
} ARP_HEADER;
The above is the structure of the ARP packet transmitted in the network. As for the specific meaning of each field in the structure and how to initialize, beyond the scope of this article, you are interested to see the TCP-IP protocol details book.
3.
processed and can be obtained once it is sniffer. The solution to these problems is encryption.We will introduce the following SSH, also known as Secure Shell. SSH is a protocol that provides Secure Communication in applications. It is built on the client/server model. The port allocated by the SSH server is 22. The connection is established by using an algorithm from RSA. After authorization is complete,
compiled program list (that is, the above C program) to see the accepted data packet! (Important message: the function of this program is too simple. It can only display the source address, target address, source port, target port, and other extremely simple information. It is useless for you, but you can change it)
Now let's take a look at the ** sniffer program
Sniffit can run network listening software on Linux Solaris SGI nt and other platforms.
arp_pro;Unsigned char arp_hln;Unsigned char arp_pln;Unsigned short arp_opt;Unsigned char arp_sha [6];Unsigned long arp_spa;Unsigned char arp_tha [6];Unsigned long arp_tpa;} Arp_header; The above is the structure of the ARP packet transmitted in the network. As for the specific meaning of each field in the structure and how to initialize, beyond the scope of this article, you are interested to see the TCP-IP protocol details book.
3. Detect
Use ARP to detect hybrid nodes in the Network
Author: refdomEmail: refdom@263.netHomepage: www.opengram.com
Due to the harm of Sniffer, it is also important to check whether there is sniffer in the network. Anti-sniff is generated accordingly to detect the networkSniffer In.
There are many ways to detect sniffer. For example, some powerful
Use Python to write network packet sniffer (Code a networks packet sniffer in Python for Linux) by Silver Moon Basic SnifferSniffers is programs that can capture/sniff/detect network traffic packet by packet and analyse them for various reasons. Commonly used in the field of network security. Wireshark is a very common packet Sniffer/
Internet cafe sniffing
With the development of multiple levels and diversity of the Internet, Internet cafes have been used in simple applications such as instant messaging, Web browsing, and email, extended into technical applications that run a large number of online games, online video and audio, interactive teaching, and P2P. Application features also present diversity and complexity. Therefore, these applications impose more stringent and demanding requirements on the quality of our network
enough to know who slowed down the network speed. We need to know how this person slowed down the network speed. Or can I see the following MAC/IP/IPX options in "transfer map? Click the IP Option to see what appears? It is no longer a map based on a MAC address. It has been switched to a transfer map based on an IP address. The thickest line: 192.168.123.117 ========== 221.10.135.114 indicates that this guy has been switching data with a host on the Internet, and obviously he is downloading
list" to view it in a pie chart:We found that the communication traffic between 192.168.123.117 and 221.10.135.114 was 89.58% + 44.20 Of the total network traffic )!
Screen. width-333) this. width = screen. width-333 "border = 0>
Now the cause of the failure is clear. We only need to process the host 192.168.123.117 to restore the network. But before that, we can use sniffer to monitor what is being transmitted throughout the network! Click capture>
I. Preparations before capturing data packetsBy default, sniffer will capture all data packets flowing through the access collision domain. However, in some scenarios, some data packets may not be what we need. To quickly locate network problems, it is necessary to filter the data packets to be captured. Sniffer defines the filtering rules before capturing data packets. The filtering rules include the defin
Open source database traffic audit MySQL SnifferMy most respected database security product is a traffic-based database audit, because it does not need to change the network structure, and the most critical is that it does not affect the performance of the database server, do not have to earnestly persuade the database administrator to install monitoring software. It can be better to find the drag library behavior through the Web vulnerability, as well as the database management process based on
BKJIA recommendation: Sniffer security technology from entry to entry
Learning the concept and principles of Sniffer is the foundation of Sniffer security technology. How should we get started with the knowledge of Sniffer security technology? Next let's introduce it to you one by one.
1. What is
[O M personnel? Why? 06] Using sniffer to diagnose Linux network faults? Why? 05] system security inspection tool-nmaphttp: // www.2cto.com/ OS /201304/200744.htmlfu O M personnel are also known as sniffer in network security. [in O M? Why? 06] Using sniffer to diagnose Linux network faults
[O M personnel? Why? 05) system security inspection tool-nmap
Http:/
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.