Đang chuẩn bị liên kết để tải về tài liệu:
Open Source Security Tools : Practical Guide to Security Applications part 20

Open Source Security Tools : Practical Guide to Security Applications part 20. Few frontline system administrators can afford to spend all day worrying about security. But in this age of widespread virus infections, worms, and digital attacks, no one can afford to neglect network defenses. Written with the harried IT manager in mind, Open Source Security Tools is a practical, hands-on introduction to open source security tools. | Howlett_CH06.fm Page 169 Thursday June 24 2004 12 32 PM Considerations for Network Sniffing 169 Running Tcpdump There are a number of filter operations you can perform on the output to look for a specific type of traffic or lessen the overall amount of output. Indeed on a busy network unfiltered Tcpdump output will cause your screen to scroll faster than you can read it However for a quick demo of the power of Tcpdump invoke it from the command line by simply typing tcpdump You will see all the TCP traffic passing your machine s Ethernet card unfiltered. It might look something like the example in Listing 6.1. Listing 6.1 Tcpdump Example 12 25 38.504619 12.129.72.142.http 192.168.1.3.3568 . ack 1418369642 win 31856 nop nop timestamp 72821542 25475802 DF 12 25 38.504758 192.168.1.3.3568 12.129.72.142.http . ack 1 win 40544 nop nop timestamp 25486047 72811295 DF 12 25 38.507753 192.168.1.3.4870 65.83.241.167.domain 11414 PTR 142.72.129.12.in-addr.arpa. 44 DF 12 25 38.561481 65.83.241.167.domain 192.168.1.3.4870 11414 NXDomain - 0 1 0 113 12 25 38.562754 192.168.1.3.4870 65.83.241.167.domain 11415 PTR 3.1.168.192.in-addr.arpa. 42 DF 12 25 38.609588 65.83.241.167.domain 192.168.1.3.4870 11415 NXDomain 0 1 0 119 12 25 38.610428 192.168.1.3.4870 65.83.241.167.domain 1416 PTR 167.241.83.65.in-addr.arpa. 44 DF 12 25 38.649808 65.83.241.167.domain 192.168.1.3.4870 11416 1 0 0 69 12 25 43.497909 arp who-has 192.168.1.1 tell 192.168.1.3 12 25 43.498153 arp reply 192.168.1.1 is-at 0 6 25 9f 34 ac 12 25 43.498943 192.168.1.3.4870 65.83.241.167.domain 11417 PTR 1.1.168.192.in-addr.arpa. 42 DF Howlett_CH06.fm Page 170 Thursday June 24 2004 11 47 AM 170 Chapter 6 Network Sniffers 12 25 43.533126 65.83.241.167.domain 192.168.1.3.4870 11417 NXDomain 0 1 0 119 12 25 44.578546 192.168.1.1.8783 192.168.1.255.snmptrap Trap 35 E 3955.2.2.1 192.168.1.1 enterpriseSpecific specific- trap 1 0 43525500 snmp This might look a little confusing at first but if you break it down it starts to make