KSnuffle-0.6 released

From: 1 (ice_at_localhost.localdomain)
Date: 08/06/05

  • Next message: Mark Suter: "[HUMBUG] Next Meeting - 13th August 2005" 
    Date: Fri, 5 Aug 2005 18:19:05 CST

    Thanks!
    ----------[snip]--------

    NOTE: Versions up to 0.3 inclusive had a great big security hole. Anyone
           using these should upgrade!

    NEW : Version 0.7 is primarily a fix to build on Mandrake 7.0 with
           gcc 2.95. Otherwise there is one fix to the packet details
           display (source/destination address mixup), and a picture of me
           in the about box (OK, this is a pure ego trip, but the KDE site
           has a developers' gallery).

    THANX: To everyone who helped sort the gcc 2.95 problem, and generally
           supplied bug reports and feedback. You might want to grab the
           latest upload for the above bug fix.

    MANDRAKE:
           Should be OK now!

    -----[The Actual Announcement]----------------------------------------

    KSnuffle is a network packet sniffer for KDE. Features include:

            * Basic filtering and packet selection via the GUI
            * Advanced filtering and packet selection via filter programs
            * Multiple concurrent monitors
            * Text and binary logging, plus replay of binary log files
            * Textual display of network traffic overview
            * Full(er) details of protocol and application data available
            * Display of data in TCP/IP streams
            * Network load histograms and time-averaged load display
            * Parallel display of multiple load histograms
            * Save and restored filter and packet selection configurations
            * Support for use by selected non-root users
            * Plugin support - 0.7 contains dns, summary and end-to-end plugins

    In its current state it is, so far as I can tell, quite reliable. The
    main area where is is lacking is actually decoding different network
    packets. At the moment, it handles basic decoding of TCP/IP and UDP/IP,
    plus ARP/RARP and ICMP. Packet decoding does not go down into the
    application level except for DNS packets.

    Also, KSnuffle uses libpcap-0.4, as used by tcpdump. As I only have access
    to Linux boxen, I cannot build or test it for any other Unix. I'd be
    interested if anyone else could try.

    The plugin interface as changed a tiny bit, specifically the structure
    returned by "getPlugin" has changed. If (in the unlikely event) anyone
    has written a plugin, see the PLUGINS file for details.

    KSnuffle is available from ftp://195.92.31.34/pub/ksnuffle-0.7/ ; there
    is a homepage at http://www.quaking.demon.co.uk/ksnuffle.html. The latter
    contains some screen shots and other information.

    ##########################################################################
    # Send submissions for comp.os.linux.announce to: cola@stump.algebra.com #
    # PLEASE remember a short description of the software and the LOCATION. #
    # This group is archived at http://stump.algebra.com/~cola/ #
    ##########################################################################

  • Next message: Mark Suter: "[HUMBUG] Next Meeting - 13th August 2005"

    Relevant Pages

    • CCK demodulation
      ... real WLAN packet but i am doing the decoding off line. ... I do this operation for all octets and fin out d2....d7 for all ...
      (comp.dsp)
    • Finding the steps of an installation
      ... In order to install a packet in BartPE environment it is necessary to have ... directories and the list of the keys to store in Windows registry. ... try to build the plugin file for a packet I'm interested in; ... I've got a copy of the Registry before and after the installation ...
      (microsoft.public.windowsxp.general)
    • Re: Linksys WAP11 & corrupt SNMP packets
      ... ASN.1 decoder at http://kairos.dsa.uqam.ca/software/asndecode.html to see ... packet is corrupt or badly encoded, since there is no data in the message ... alone that can be used to tell if the PDU has been decoded correctly. ... Decoding with the wrong key, or not decoding at all, yields a jumble of ...
      (comp.security.firewalls)
    • Re: Snort UDP filter???
      ... > Can you create a rule based on threshold? ... > being flooded to a DNS server as a Denial of Service? ... I dont think you can do that b/c snort checks packet by packet - rule ... you would need to create a plugin to do so. ...
      (comp.os.linux.security)