Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

A Network Sniffer On Steroids

Posted by kdawson on Tue Mar 06, 2007 02:40 PM
from the data-seepage dept.
Privacy Wireless Networking Hardware
QuantumCrypto writes "Errata has developed a new network sniffer, dubbed 'Ferret,' that looks for traffic using 25 protocols, including those for the popular instant message clients as well as DHCP, SNMP, DNS and HTTP. This means the sniffer will capture requests for network addresses, network management tools, Web sites queries, Web traffic and more. 'You don't realize how much you're making public, so I wrote a tool that tells you,' said Robert Graham, Errata's chief executive. Errata has released the source code to this version 1.0, 'feature-poor and buggy' tool on its site. Anyone with a wireless card will be able to run it, Graham said."
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

A Network Sniffer On Steroids 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Broadcom cards? (Score:3, Interesting)

    by ShaunC (203807) * on Tuesday March 06 2007, @02:42PM (#18253758) Homepage
    Does anyone know if there are any special driver requirements, beyond "anyone with a wireless card?" The documentation is rather...sparse. I've got a Broadcom wireless card in my laptop and it's generally a pain to get things like aerodump going; it requires installing a debug driver, then rolling back the driver afterwards, and the network functionality itself is disabled during this period, at least with aerodump.

    I'm curious if ferret can sniff without the added hassle...
    • Anyone know how you would accomplish this without kicking the card into monitor mode?
      • Broadcom chipsets are absolute and utter crap. DO NOT USE THEM.

        The problem is that you could toss out your crappy, but admittedly working, Broadcom-based card, and inadvertently pick up a Marvell one instead, or one of the newer ones that have some sort of proprietary binary blob firmware that gets loaded by the driver, and will probably never, ever have legitimate Linux drivers.

        If you have a wireless card that actually works on Linux, here's a piece of advice: get on your knees and thank the diety of your choice for smiling on you, and not leading you astray into the Purgatory of identical-model-number-but-different-chipsets, or the Hell of alpha-quality drivers. And then, don't mess with anything.

        And if you got AES working, sacrifice a goat.

        • Re:Broadcom cards? (Score:5, Insightful)

          by caluml (551744) <slashdotNO@SPAMspamgoeshere.calum.org> on Tuesday March 06 2007, @03:59PM (#18254714) Homepage
          If you have a wireless card that actually works on Linux,

          Just check what card it is before you buy, and don't buy any that don't have Open Source, native Linux support. It's what I do. Cisco, Orinoco, the new Intel IPW drivers.
          If you buy something that doesn't work, don't cry when it doesn't work.

          • OT: Linux compatible, and tasty, too? (Score:5, Funny)

            by Anonymous Coward on Tuesday March 06 2007, @04:11PM (#18254878)
            I just went over to Amazon to check the prices on some of those cards, and this [amazon.com] completely made my day. (Look at the "Technical Details")

            Proxim 8482-FC ORiNOCO Wireless 11a/b/g PCI Card, $82.27

            Technical Details

                    * One 6.5-ounce package
                    * Made with enriched wheat flour and natural vanilla flavoring
                    * 100% cholesterol free and sweetened with sorbitol
                    * America's number one brand of sugar-free cookies
                    * Creme-filled, vanilla cookies perfect for low-carb diets
            Do you think they're RoHS-compliant, too?

        • If you have a wireless card that actually works on Linux, here's a piece of advice: get on your knees and thank the diety of your choice for smiling on you, and not leading you astray into the Purgatory of identical-model-number-but-different-chipsets, or the Hell of alpha-quality drivers. And then, don't mess with anything.

          Funny, this hasn't been my experience. I've booted the latest Knoppix live CD on many random PC's and even a Mac Mini and it's never had any trouble using whatever wireless was in th

          • If I were you, I'd be buying lotto tickets. I have a box going somewhere of WiFi cards that I've ripped out of systems because I couldn't get them working on Linux. It's not full, but there are a bunch in there, plus a bunch in systems that just don't work and I've not bothered to pull, plus a lot more that I've tried to get working and returned. They tend to be a combination of Marvell and Texas Instrument ACX chipsets, neither of which I've ever gotten to work successfully (and by "work," I mean natively,

        • Good Linux WIFI Cards (Score:4, Informative)

          by stevenm86 (780116) on Tuesday March 06 2007, @05:34PM (#18255860)
          Good for linux- with monitor mode

          * Atheros-based cards. Strangely, I don't hear these mentioned very often, but they have excellent support, complete with monitor mode, creating multiple interfaces from one card, etc. Oh and airpwn supports it :) - http://madwifi.org

          * Intel Pro Wireless (2100 / 2200 / 2950) - Works well, has monitor mode, wep in hardware, drivers actually developed by intel - http://ipw2200.sf.net and in the kernel at this point

          * Orinoco / Hermes / Lucent cards - in the kernel

          * Cards based on the Prism chipset based (http://prism54.org) BE WARNED though, some of the newer ones require "softmac" firmware which is currently not working all that well

          I have used a card from all of these manufacturers and if I were getting a new laptop, I would probably go with Atheros and if not that, then Intel.

  • Wireshark? (Score:5, Interesting)

    by Hackeron (704093) on Tuesday March 06 2007, @02:46PM (#18253822) Journal
    How is this different to say wireshark or any other traffic analyzer?
    • It was built on a Windows system and comes with an executable?

      I'm personally in favour of easier to use software (ie. something with a Make file or a .deb, etc.)

      • Re: (Score:3, Informative)

        by Arkaic (784460)
        Umm. Wireshark/Ethereal have had Win32 versions for quite some time. From reading the article and the download page I see nothing which distinguishes this app from others which were done first, and better.

        • Re:Wireshark? (Score:5, Informative)

          by Hackeron (704093) on Tuesday March 06 2007, @04:00PM (#18254738) Journal
          After reading their presentation and other material, here's how it's different to wireshark -- the packet analyzer part is just one of it's features:

          1) It can respond to various requests like DHCP requests (so it's like a lightweight collection of servers?)
          2) It has a port scanner to show running services (like nmap)
          3) It has kismet/netscambler functionality to break into wireless access points
          4) They go on and on about it not looking at data leakage but intential data like startup programs querying servers, etc -- After 6-7 pages of explaining this I still don't see the difference...

          At the end of the day, this looks like wireshark+nmap+kismet tied together made for the intent of tracking desired actions like buying new hardware in a firm

          So looks like move along, nothing to see her to me but I get the steroid bit now

        • Re: (Score:2, Interesting)

          by twistah (194990)
          By your logic, Wireshark is no different than tcpdump. But obviously, they are different. Wireshark is great at dissecting packets, not just dumping them in hex format. Ferret is good for sniffing broadcast information, such as NetBIOS traffic and iTunes DAAP, which can assist you in getting a picture of the current network. That's all it does. Yes, they are all pcap based, but they serve different purposes.

          Just like you could use Wireshark to sniff for passwords (or, hell, even tcpdump + ngrep), but it's a

    • Re:Wireshark? (Score:5, Funny)

      by $RANDOMLUSER (804576) on Tuesday March 06 2007, @03:01PM (#18254012)

      How is this different to say wireshark or any other traffic analyzer?
      Duh. It's on steroids.

    • Re: (Score:2, Interesting)

      by Red Flayer (890720)
      FTA:

      The Errata sniffer, dubbed Ferret, packs more punch than other network sniffers already available, such as Ethereal and Kismet, because it looks at so many different protocols, Graham said. Some at Black Hat called it a "network sniffer on steroids."

      Reading. It's what's for knowledge.

      Oh, and Wireshark was Ethereal. They had to change the name due to trademark concerns.
        • I don't know the specs of Ferret. I assume (typically a bad idea, of course) from the quote that Ferret searches more protocols than Wireshark, and thus casts a greater net.

        • Re: (Score:2, Informative)

          by basotl (808388)
          Errata [com.com] Errata has developed another network sniffer that looks for traffic using 25 protocols

          Wire Shark [wireshark.org] Hundreds of protocols are supported, with more being added all the time.
          Wireshark's most powerful feature is its vast array of display filters (over 51000 as of version 0.99.5).

          Something isn't adding up for Errata having more.

          Normally people complain that Wireshark looks at too many protocols and presents a network vulnerability.
    • How is this different to say wireshark or any other traffic analyzer?

      This one is feature poor and buggy.
    • I don't believe wireshark/ethereal can get to 802.11 without paying for a plugin from cace, at least not promiscuously (which is all I care about)

      But apart from 802.11, wireshark seems to capture WAY more than this one. So the only real question is does it do a better job or does it do it a better way? Because if it is "better" (in whatever way) then adding protocols is just a dissection task.

      I suspect that it's not that hot really.

      • Re: (Score:2, Informative)

        by klem (642403)
        Hum, as long as your wireless card is in monitor mode (http://en.wikipedia.org/wiki/Monitor_mode , this mode is controlled by the OS, so ethereal doesn't even know about it), ethereal can read and analyze with 802.11 packets just fine.
        Furthermore, it's not even limited to "regular" data packets (IP or ARP packets encapsulated into 802.11 ) . You can see things like 802.11 association/authentication/probes packets (it's funny how some people believe that preventing the AP from announcing its network name
    • Does anyone remember a Mac utility that came out a while back (by which I mean, maybe 5 or so years ago), that would put an Airport into promiscuous mode, and sniff for traffic, and then decode and display any images that it sniffed? It was a pretty amusing little program; I think I remember reading that it was thrown together at MacHack and won best of show, or some other honor.

      Basically you could run it, and it would give you an idea of what everyone on the wireless network was browsing, in the clear, at that moment, all sort of jumbled together.

      I've always wanted something like that, to use as a demonstration of how insecure most wireless APs (unencrypted ones) are, for nontechnical people, but I've never been able to find it, or any record of it. Sometimes I wonder if I just hallucinated the whole story.

      It would be a heck of a demo to just run something like that, particularly if you could target a particular connection, and then tell someone to load a web page, and be able to instantly display some or all of the page, or at least its images, in real time, to prove that you really were listening in on what they were doing. Most packet sniffers don't provide any direct, obvious, graphical output of stuff they sniff, and that's frankly just not dramatic enough to make an impression.

    • How is this different to say wireshark or any other traffic analyzer?
      It works on fiber-optics because it has frickin laser beams attached to its wire, that's how!

    • Re:Wireshark? (Score:5, Insightful)

      by s_p_oneil (795792) on Tuesday March 06 2007, @04:38PM (#18255202) Homepage
      Over 99% of Internet users wouldn't have a clue how to use Wireshark. "What are all these SYN messages? Are they caused by a virus or spyware?"

      Actually, that's a gross exaggeration. Very few Internet users would even be able to figure out how to start a capture in Wireshark. The more timid ones wouldn't even make it to the "No capture interface selected!" error, and most of the rest would be lost when they ran into that.

      If Ferret successfully dumbs it down, then it could be quite useful to a lot of Internet users. In that case, I wouldn't say it was a sniffer on steroids though. More like a "for dummies" version.

    • Re: (Score:3, Interesting)

      by slickwillie (34689)
      Well, for one thing Ethereal (Wireshark) used to have the best slogan on the Net:

      "Sniffing the glue that holds the Internet together."

  • From TFA (Score:3, Interesting)

    by Who235 (959706) <{secretagentx9} {at} {cia.com}> on Tuesday March 06 2007, @02:50PM (#18253878)

    "If the government was taking this information from you, people would be up in arms."

    First of all, they probably are sniffing you whenever it's convenient (like at the airport).

    Second of all, people sadly don't seem to care all that much.

    This looks like a cool tool, and I share the hope of an earlier poster that it will work with Broadcom cards - since that's what I have.
    • I'm tired and I haven't written a Makefile that I had to deduce by hand and eye in many aeons. Has anyone written a Makefile suitable for Deb or Edgy they could share?

    • I have a friend who works at Best Buy/Geek Squad. A guy came in with a government contract and a laptop, needing repairs. He was making small talk and said his job was to wardrive around and break into people's home computers and search them for child porn.

      Take it with a grain of salt - the guy was just some dude with a busted laptop walking into a Best Buy. But he did have a government contract, and a lot of wireless sniffer software on his machine.

      • Re:They probably already are (Score:4, Interesting)

        by Lord Ender (156273) on Tuesday March 06 2007, @10:08PM (#18258236) Homepage
        Right. He had advanced security software, a van with sophisticated antennas, and no IT department to fix failures of their own equipment. So he takes it to Best Buy, where the teenage "technicians" install unnecessary anti-virus software, which proceeds to wipe out ("clean") all his security software...

        Yeah, right. They don't make salt grains big enough.
  • You mean that by analyzing my DNS and HTTP traffic, either in the clear or from a cracked WEP session, that you can infer, or worse, identify, certain definite pieces of information about my Internet usage habits?
    Boy, if I had a tool that could do that, I'd certainly astroturf it on Slashdot.

  • Darn (Score:5, Funny)

    by Kohath (38547) on Tuesday March 06 2007, @02:57PM (#18253956)
    I needed a steroid sniffer that works on my network.

    Can I operate it in reverse or something?

  • my god (Score:5, Funny)

    by mastershake_phd (1050150) on Tuesday March 06 2007, @03:30PM (#18254348) Homepage
    My neighbor likes clown pron.

  • I've seen this before (Score:5, Funny)

    by ciaran.mchale (1018214) on Tuesday March 06 2007, @03:49PM (#18254612) Homepage
    A Network Sniffer On Steroids.

    I've seen this before. It starts off with steroids, but pretty soon the network sniffer moves on to crack cocaine. A short while later, he takes a job as a fluffer in midget porn movies to feed his habit.

  • The Errata sniffer, dubbed Ferret, packs more punch than other network sniffers already available, such as Ethereal and Kismet, because it looks at so many different protocols, Graham said. Some at Black Hat called it a "network sniffer on steroids."

    Oh Wowsers! DHCP, SNMP, DNS and HTTP! That's so many! It's a shame Ethereal can only look at these [ethereal.com]!

  • I doubt it. (Score:3, Funny)

    by Kenja (541830) on Tuesday March 06 2007, @04:05PM (#18254814)
    I'm willing to bet that most people with a wireless network card dont even know what the term "sniffer" means, much less be able to run one.

  • Wow! 25 protocols? (Score:5, Funny)

    by A Guy From Ottawa (599281) on Tuesday March 06 2007, @04:11PM (#18254872)
    Incredible... they support 25 protocols!!!

    And to think I used to use Wireshark/libpcap which is open source, available on almost every platform, is not buggy, and supports hundreds of protocols. It even has a graphical user interface.

    But I think these guys are really on to something...

  • Wireshark, anyone? (Score:4, Informative)

    by drix (4602) on Tuesday March 06 2007, @04:21PM (#18254998) Homepage
    Wireshark [wireshark.org] does waaaaay [wireshark.org] more than 25 protocols.

  • Wireshark does NOT do this (Score:3, Informative)

    by Anonymous Coward on Tuesday March 06 2007, @04:37PM (#18255194)
    What makes this sniffer stand out is not the fact that it can parse different protocol formats -- it's that it collects relevant data in a meaningful summary.

    For example, any sniffer can filter and then parse HTTP traffic, but an analyzer like this one tells you relevant bits like someone's web account names.

  • Not on steroids, not for linux. (Score:5, Funny)

    by WK2 (1072560) on Tuesday March 06 2007, @05:33PM (#18255854) Homepage
    They include the source code, and say that it "should" compile in linux. However, it uses many Windows-specific variable types. This code will not be cross compatible without a major overhaul.

    This program is not ethereal on steroids. It's more like ethereal and kismet got drunk, had sex, and had a retarded baby, which they named ferret.

  • EVERYTHING about this article is wrong. (Score:5, Interesting)

    by jurgen (14843) on Tuesday March 06 2007, @05:51PM (#18256052)
    This is a great example of the worst of slashdot (which isn't saying much)... just about everything in this article as it appears on the main page is wrong, word for word.
    • Category: YRO... why? What does this have to do with "rights"?

    • Title: "Sniffer on Steroids". Nothing steroidal about it... according to the authors of the software it is a buggy piece of shit whipped up quickly to demonstrate a very /specific/ type of traffic analysis for a talk.

    • "Looks for traffic using 25 protocols". Uh no, it doesn't use the protocols, it analyzes them.

    • List of protocols and applications... misses the point entirely as nothing explicitly as any other sniffer can also "capture" all those protocols. The point is that this program looks for and explicitly points to information within those protocol that you probably didn't realize was "seeping" out with those protocols. Mind you, you could still find all that same information with ANY OTHER SNIFFER... there is nothing technologically new about this sniffer. Rather, the authors have made a list of things that "seep" out with various applications and protocols that most people haven't thought of, and have written a simple ordinary sniffer that explicitly includes this list.

    • "Anyone with a wireless card will be able to run it"... uhm, yeah, anyone with a WINDOWS machine and the right kind of wireless card. Doh.

    Even for slashdot, that's pretty bad, eh?

    :j

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.