Tag Info

Hot answers tagged

49

Short answer : you can't prevent them from sniffing your traffic, but you can make it meaningless for them by using encryption. Either use encrypted protocols (HTTPS, SSH, SMTP/TLS, POP/TLS, etc.) or use encrypted tunnels to encapsulate your unencrypted protocols. For example, if you use HTTPS instead of HTTP, the content of the webpages you fetch will ...


17

A few options: tcpdump Cocoa Packet Analyzer Packet Peeper AirMagnet See also this search on macupdate. Answer shamelessly cribbed from these other SU questions: http://superuser.com/questions/76656/is-there-a-nice-graphical-packet-sniffer-for-mac-osx http://superuser.com/questions/18815/can-i-do-packet-sniffing-out-of-the-box-on-os-x ...


14

For general looking at everything that goes out over your network card, I would use Wireshark, You can sort by protocol and "Go deep" in to exactly what is being transmitted where! Also for Windows, if you just want to see (and edit) HTML requests, any program that youcan input a proxy server to, or respects the computers "Internet Options" proxy setting, ...


10

You can use the specific HTTP header display filters to show either just the request headers, just the response headers or both. For just the request headers: tshark tcp port 80 or tcp port 443 -V -R "http.request" For just the response headers: tshark tcp port 80 or tcp port 443 -V -R "http.response" And for both the request and response headers: ...


8

Portmon, from Sysinternals, will do what you need: Portmon is a utility that monitors and displays all serial and parallel port activity on a system. It has advanced filtering and search capabilities that make it a powerful tool for exploring the way Windows works, seeing how applications use ports, or tracking down problems in system or ...


7

Fire up Backtrack if you haven't already. Since you're not after traffic - just the level 2 address - this should be easy. First, start airodump-ng and with the command airodump-ng --berlin 60 <wireless interface here> You'll get a screen that looks like: In the area marked client there is a column describing power in decibels (i.e. the more ...


7

Beware of terminology difficulties here. Promiscuous mode is a concept that originated on wired Ethernet, where you have your card show you all the traffic your hub is repeating onto your port, even if it's not addressed to you. Many (but not all) Wi-Fi cards support promiscuous mode, in a way that looks a lot like Ethernet promiscuous mode; it shows only ...


6

You can use TCPView from Microsoft/Sysinternals. If you find it difficult to capture the port opening with that utility, than the best bet is to install and run Wireshark to get a network trace (assume you aren't talking about a local software-based firewall.


6

You could use pfSense it has many features: Firewall Network Address Translation (NAT) Redundancy Load Balancing Reporting and Monitoring RRD Graphs The RRD graphs in pfSense maintain historical information on the following. CPU utilization Total throughput Firewall states Individual throughput for all interfaces Packets per second rates for all ...


6

WireShark can do this. You can even tell WireShark your WPA key so it can decrypt it for you: More in How to Decrypt 802.11.


6

Further reading seems to suggest that the data flowing to and from my computer can be 'sniffed' by anyone if it's not encoded through SSL or similar? Is this true? Yes, this is true. Both wireless (WiFi) and wired (Ethernet) networks can be sniffed easily, although it may be a little more complicated on switched Ethernet. Even if you are connected to ...


6

Linux / Windows + Cygwin tcpdump tcp Linux Gui / Windows Wireshark For a specific port (80 for example): tcpdump tcp port 80 for incoming trafic to port 80 tcpdump tcp dst port 80 Serial port sniffer: click and : click


5

In principle, "packet sniffing" is not a job of routers. Routers don't inspect the content of a packet, they just pick the header of the packet and find a suitable exit interface so that it will reach the destination stated in the packet's header. However, your packets could be sniffed by anyone interested while the packets are moving. Interested bodies ...


5

Just to make sure you're not missing the obvious...you're aware that Wireshark does have a nice GUI, and is protocol aware? And has simple analysis features like "Follow TCP Stream" that making analyzing SMTP (and other text-based protocol transactions) so much easier? Screenshots are here.


5

If you are willing to dabble a bit in Python, Scapy is a good tool. For simpler activities, hping3 is a quick Tcl based tool. An important advantage with these is, they are available as debian packages.


5

I would recommended Wireshark which will track any traffic on a particular network card. From a Wireless router perspective I am not aware of any software that can do this unless the router itself is linux based in which case you can use tcpdump


4

I'd recommend WireShark if you want to also see the data being sent. If you just want to see the hostnames/IP addresses that your applications are connecting to, you can use a more lightweight utility like TCPView or Windows' built-in netstat -b.


4

... all of the HTTP traffic is coming through as the SSDP protocol ... Nope, all of your HTTP traffic is still coming over traditional TCP. You are just being flooded with SSDP packets and unable to separate these from real HTTP packets. Easiest way to filter the "real" HTTP traffic is to type in to the Wireshark filter box: http && tcp And ...


4

There are quite a few. The search on macupdate turns up some of them: Cocoa Packet Analyzer Packet Peeper


4

Your machine will not by defualt listen to any other traffic other than what's useful for it so it will only pick up on traffic sent to it or broadcasts, you can use airmon-ng to put your card into monitor mode and it will add a device called mon0, Or you can use Ettercap a tool in backtrack to do a Man in the middle attack, this will direct all traffic to ...


4

I would say that NetStumbler is the most popular. It does not officially support Windows 7 (Thank you to paradroid for pointing that out), however I did find a site that shows how to configure it to make it work with Windows 7, and it will hopefully work for you. http://www.netstumbler.com/downloads/ http://wlanbook.com/netstumbler-windows-7/ This one is ...


4

No. Whenever you're using a HTTPS connection with a valid certificate to connect to a server you trust, every bit of content sent over this channel is encrypted using SSL/TLS. If you are on a channel where it is easy to sniff the sent data, i.e. on a switched LAN or on an unsecured WiFi network, an attacker could only see the encrypted data and not the ...


4

The six most important factors in my opinion are: Speed - You want to make sure they can guarantee a decent speed. limits - If they have either bandwidth or time limitations on the service, make sure it fits in to how/when you want to use the service. Location - If you ever plan on using internet streaming services, or other sites that are region ...


4

The proxy settings only apply to your connection to TeamViewer's servers used for UDP hole-punching; the UDP connection is always direct. RDP and VNC, on the other hand, use only TCP, so you can connect using them over Tor.


4

But, when we talk about a subnet - do we mean all the systems connected to the same switch? A switch (or interconnected set of switches operating at together at layer 2) defines a broadcast domain (give or take some VLAN configurations). You can run one, many or no IP subnets on the same broadcast domain. You can run a subnet that spans several ...


4

If you run DD-WRT on your home router, you can run tcpdump directly on the router, with the output brought back to your local system for later processing. An example: ssh [email protected] -c "tcpdump -v -w - -i eth2" > mypackets.pcap Just hit Ctrl-C when done, and load the capture file into your favorite analysis tool such as Wireshark.


3

It is hard to speculate, but let me try. You are asking: In this situation can a remote attacker somehow detect the fact that the machine is connected to the internet and try connecting to do an exploit? Even if the unpatched machine is clean (how do you know? did you do clean install?) it could be compromised again. It would be hard to detect the ...


3

The real answer: Nothing you could do to prevent a router to sniff all of the traffic that flows through it. But that should not be the question - this should be: "What could I do to prevent anybody to read my traffic?" - The answer: "Use only encrypted communication/protocols!". The best thing: Use a VPN between you and your communication partner. For all ...


3

You are required to have Administrator priveledges to install any software. Therefore, I believe the work-around for you is simply to only use "portable" applications. "Portable" applications are ones where you simply unzip and use it, no installation required. Check out: Portable Wireshark (gets rave reviews) Smart Sniff


3

This command will provide a list of interfaces, with the connected or disconnected status: c:\>netsh interface show interface Admin State State Type Interface Name ------------------------------------------------------------------------- Enabled Connected Dedicated Local Area Connection



Only top voted, non community-wiki answers of a minimum length are eligible