Simon wrote:
> > There is a possibility if you can hook your computer on a hub, not
> > switch. There you could run any kind of sniffer, without anyone
> > recognizing it. But I fear there are not many hubs out there. Tiime
> > passes
>
> Well, I can shutdown the computer, which would look normal on the
> network, ...
Well, you assume it will look normal ;-)
> ... hook a hub and the cord to the pc, plus one to my laptop.
> Reboot the work machine.
Now here is where you may find a problem. The hub will need to support
the previous link speed reliably. 10 Mbs is OK, 100 Mbs is likely (but
check your hub beforehand) and 1000 Mbs is ???. Haven't seen a hub
that supports 1000 Mbs. If you substantially slow the link speed, that
_will_ be noticed.
> Would it be possible to detect the hub then? And how can I render the
> laptop to be silent, or undetectable?
First note that sniffers are passive -- only detection probes that work
depend on tickling bugs in nic driver/networking code, afaik. A
network scanner might be able to detect your laptop if it responds
inappropriately. Should it be _totally_ silent on the network?
Detectectable but appear "normal"? You'll have to sort that out.
Total silence may be "easiest" to implement but most difficult to
confirm. Normal may be detected but raise no alarms. Choose your
poison.
As noted already, you run a _very_ real risk of being fired. You would
if I were a sysadmin there. Even if you get past that, you will almost
certainly gain the undying ire and mistrust of the sysadmins. Don't
underestimate the pain they can cause you.
You also expose yourself to the possibility of being discovered and
becoming the target of "blackmail" in return for silence. Perhaps they
will wait till you're nearly done, get your work product, get you
fired, then take credit for your work. Ain't soap operas fun. In sum,
you _will_ be a disruptive force.
Hey, but you like the intrigue. Adds spice to your boring daily
activities. Others will not be amused.
To top it off, if I understand the current state of your knowledge re:
these "secret" app protocols, you will most probably not succeed in
your attempt to reverse engineer the wire protocol. The "normal"
pattern of packet flow will make it _very_ difficult to sort out just
_exactly_ what the protocol is doing, why it's doing it in the sequence
it's doing it, and how you might use this _incomplete_ knowledge to
fashion tools. This is _not_ how reverse engineering a protocol works
(well, hopefully not).
You need to set up a test bed with a client and a server that you
control _completely_ so that you can observe that when you do A on the
client, the server does Z. You need to understand not only the
protocol, but also the (side)effects on the server itself before it
responds to the client. Surely you don't expect to run _untested_ code
at/on the production servers, do you?
If the protocols have not already been decoded by someone else, you
won't get much but a hex dump of the application layer. It will be
like reverse engineering a binary from reading the raw executable. Are
you up to the task?
My approach would to be open about the project, set up a test bed,
scrounge the net _and_ some appropriate mailing lists for help,
guidance, and clues, and proceed with the tedious job of decoding and
understanding the protocols. True, you won't need to know _everything_
but you will need a good understanding of whats going on.
Surely the folks that wrote the apps included _some_ code for testing
and tools. If you would share some info about the apps you're talking
about, you may find someone else has already done some of the work --
if not _all_ of the work -- of decoding the protocols. Certainly,
someone with more experience doing this sort of thing would help. I
would certainly look here for help and guidance:
http://www.ethereal.com/lists/
If ethereal does not already have a decode for your apps, perhaps
someone else has worked on them or something similar. There are some
very bright, experienced folks there.
BTW, as a first step, you might try inserting a Linux box and using
netfilter to simply log the packets heading toward the servers/ports
running the apps in order to get some feel for what they're up to.
good luck -- you'll need it,
prg
Similar Threads
Linear Mode
