Re: [WEB SECURITY] Hardware for logging network requests

["Mike Fratto" <mfratto@xxxxxxxxx>]

Go buy a passive network tap or connect the LAN side of your network
to a hub. They are cheap. Hang a Linux box off the tap or the hub.

Fireup tcpdump like as root "tcpdump -q -i eth0 tcp >savefile.txt" on
that interface and have a ball. You cna further filter the output with
the unix command "cut"

mike

On 1/21/07, J Joensuu <j_joensuu@xxxxxxxxx> wrote:
> Hi all,
>
> I am interested of tracing network activity between my
> computer(s) and the internet, and have been thinking
> about setting up a box between the computer and the
> DSL router. The box would intercept all TCP/IP
> requests and log them to a text file; the idea is to
> later go through the text file to determine the
> presense of any rootkits on the computer.
>
> Does anyone know of a tool (in effect a small piece of
> hardware) that can be plugged between two network
> devices to collect a list of of all TCP/IP traffic? It
> would be cool if this device had some form of storage
> onto which it logged the traffic (e.g. in form of a
> text file). This would allow me to avoid setting up a
> computer for this purpose.
>
> Thanks in advance,
>
>
>
> ____________________________________________________________________________________
> Looking for earth-friendly autos?
> Browse Top Cars by "Green Rating" at Yahoo! Autos' Green Center.
> http://autos.yahoo.com/green_center/
>
> ----------------------------------------------------------------------------
> The Web Security Mailing List:
> http://www.webappsec.org/lists/websecurity/
>
> The Web Security Mailing List Archives:
> http://www.webappsec.org/lists/websecurity/archive/
> http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

----------------------------------------------------------------------------
The Web Security Mailing List: 
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]