Packet Sniffing with the Ethereal Network Analyzer

251

-c command: Displays files that are opened by any occurrence of the given command. (You can specify a partial command name here; for example, -c xm displays files opened by commands whose names start with xm.)

-u username: Displays files opened by user username.

-i TCP@host: Displays TCP connections to host.

-p processID: Displays files opened by the given process.

If you’ve ever tried to umount a CD that’s being used by another user, you know that Linux won’t let you. The other user might not even be using the CD; if that user has a terminal window open to the directory, you can’t eject the CD until he or she is done. To find out who’s hogging the drive, use the following command:

# lsof | grep /mnt/cdrom

The result set shows you the device user. Hopefully, this user can surrender the drive so others can

use it.

Packet Sniffing with the Ethereal Network Analyzer

Normally, your machine doesn’t read the network packets that aren’t intended for it. The Ethereal Network Analyzer is a packet sniffer that watches all the packets that go across your network and lets you open and read the packets you choose.

Starting Ethereal

To open the Ethereal Network Analyzer, follow these steps:

1. If you’re running Fedora Linux, open the Main Menu and choose Internet More Internet Applications Ethereal.

If you’re using SuSE, open the Main Menu and choose Internet Administration.

If you’re using Mandrake, open the Main Menu and choose System Monitoring Ethereal.

2. Enter your password when prompted.

Ethereal opens, as shown in Figure 36-4.

• Figure 36-4: The Ethereal main window.

The Ethereal Network Analyzer is included with most Linux distributions. If it’s not on your menu, it should be on the disc. Just install the RPMs with the following commands:

#rpm -Uhv ethereal-version.rpm

#rpm -Uhv ethereal-gnome-version.rpm

Capturing packets

To start capturing network packets in Ethereal, follow these steps:

1. Choose Capture Start.

The Capture Options setup dialog opens, as shown in Figure 36-5.

2. In the Interface list box, choose the network interface that you want to watch.

Typically, you choose eth0.

3. Check the Update List of Packets in Real Time and Automatic Scrolling in Live Capture boxes.

252 Technique 36: Streamlining Your Network Surveillance

• Figure 36-5: The Capture Options setup dialog.

As a rule, checking the Enable Network Name Resolution box really slows things down.

4. Click OK.

Ethereal starts sniffing (see Figure 36-6). If you look closely at the Source and Destination columns, you’ll see that packets are flowing back and forth between machines.

Use the Start and Stop options in the Capture menu to sample short segments of network usage for a quick scan. Unless you tell Ethereal to save the captured packets, it doesn’t create a log file, but the working file can get big fast. If your system has plenty of power, it won’t hurt to leave the capture session running, but if you’re running on a slow machine, sampling is a good idea.

• Figure 36-6: Ethereal capturing network packets.

Applying filters to screen packets

To make the traffic easier to follow, apply filters to select only the packets you’re interested in. Ethereal filters screen packets by protocol type. You can choose from hundreds of protocols, but many are so obscure that you’ll never encounter them.

You can set up an HTTP filter to monitor the Internet traffic between your system and the Web. If excessive surfing is slowing down the network, you can screen all the network packets for the HTTP protocol and find the prime offenders.

To add and apply a filter, follow these steps:

1. Choose Edit Display Filters.

The Edit Display Filter List dialog opens, as shown in Figure 36-7.

2. Type HTTP Packets in the Filter Name field and type http in the Filter String field, and then click New.

3. Click Save and then click Close.

You’ve created a new filter named HTTP Packets.

Packet Sniffing with the Ethereal Network Analyzer

253

•Figure 36-7: Adding a display filter.

4.To apply the filter, click the Filter button in the lower-left corner of Ethereal’s main window.

5.In the Display Filter dialog that appears, highlight the filter name and click OK.

After a short delay, the packet list shows only HTTP packets.

Peeking in packets

When you’ve found a series of packets that might be interesting, you can take a peek inside. Highlight a packet and choose Tools Follow TCP Stream. A window opens, displaying the contents of the TCP stream. The dialog displays the chatter between the machines, with each machine responding in a different color.

Packet data is not meant to be readable by humans. Some protocols contain recognizable text (such as the HTML code that a Web browser uses), but other protocols (like SSH) are encrypted.

Network chatter is sent in a series of wrappers. The outermost layer contains hardware information, and the inner layers hold the meat of the message. The outermost layers are the least human-friendly, and the inner layer is occasionally understandable.

In the middle pane of the Ethereal window, you see a display of the wrappers that make up the packet (refer to Figure 36-6). The wrappers that are higher in the tree control are the machine-friendly wrappers. The lower wrappers are human-friendly.

Expand the lower branches in the tree control to see an interpretation of the packet that’s highlighted in the top panel. The bottom window displays the corresponding raw data in the packet.

Color-coding packets coming from your network

The packet listing is much easier to read if you colorize the packets coming from the computers on your network. Follow these steps to add color to the display:

1. Choose Display Colorize Display.

The Apply Color Filters dialog opens.

2. Click New.

The Edit Color Filter dialog opens.

3. Enter a name in the Name field.

4. In the String field, enter the IP address you want to colorize by using the following form (see Figure 36-8):

ip.src == 192.168.0.218

5. Click the Foreground Color button and use the color selector to choose the font color. Then click OK.

254 Technique 36: Streamlining Your Network Surveillance

• Figure 36-8: The completed Apply Color Filters dialog.

If you really want conversations to stand out at a glance, choose a background color as well. That can get a bit garish, but it’s worth experimenting with.

6. Click OK to close the Color Filter dialog.

7. Click Save and then OK in the Apply Color

Filters dialog.

A dialog opens, charting the progress as the filter runs, and in a snap, the display is colorized. The new colors make it easy to tell who’s chattering on your network.

Colorize each machine on your local network to make it easy to spot the traffic that’s not being generated by a network computer. It’s also an easy way to monitor an individual user’s traffic.

37	Evaluating Your
	Network Security
Technique	with Nessus

Save Time By

Using Nessus to evaluate your network security

Closing any security vulnerabilities you find before a hacker can exploit them

It doesn’t matter if you’re the administrator of a big network or a small one, a hacker running loose on your system can cause mega-damage (and time loss) in a matter of minutes. Running a tight ship is important. When you set up your network, you’re likely to have taken quite a few measures to ensure your network’s security, but how do you know

you haven’t missed something?

A top-notch open-source project called Nessus provides a security scanner that can check your (hopefully) tight ship for leaks — security vulnerabilities that hackers could exploit if they had the chance. If your system freely gives up information about open ports (or more specifically, the services running behind them), hackers can exploit that information easier than they could if they had to make guesses about your system.

Nessus can do a lot more than detect open ports. Here are some other timesaving features Nessus has to offer:

If the security tests you need aren’t included in the distribution, you can write your own customized plug-ins to get the job done.

Nessus has a friendly graphical user interface with easy-to-read reports, or you can run it from the command line.

The Nessus project stays up-to-date with recent security issues and provides easy automatic updates of the security test scripts.

Nessus also supports SSL services, making sure your network is secure while it works on your ports.

The Nessus plug-ins search for backdoors, denial-of-service vulnerabilities, sturdy firewalls, remote shell accesses, peer-to-peer filesharing, useless services, and tons of other security risks. The database currently has over 2,000 plug-ins.

Nessus can handle big or small networks with ease, with tailored testing that won’t waste a lot of time.