Writing Security Tools and Exploits
Learn to read, analyze, modify, and write custom exploits and enhance security tools with little or no assistance with help from this authoritative text.
TABLE OF CONTENTS Writing Security Tools and Exploits
Extending wiretap
A powerful way for Ethereal to read a new file format is to teach it how to read it natively. By integrating this code with Ethereal, the user no longer has to run textp2cap before he or she can read their file. This approach is most useful if the user intends to use Ethereal often on his or her new file format .
The wiretap Library
Ethereal uses a wiretap library to read and write many packet-analyzer file formats. Most users do not know that Ethereal uses libpcap only for capturing packets, not for reading pcap files. Ethereal's wiretap library reads pcap files. wiretap reimplemented the pcap reading code because it has to read many variations of the pcap file format. Various vendors have modified the pcap format, sometimes without explicitly changing the version number inside the file. w iretap uses heuristics to determine the pcap file format.
w iretap currently reads the following file formats (this list is from the Ethereal Web site at www.ethereal.com/introduction.html):
-
ibpcap
-
NAI's Sniffer (compressed and uncompressed) and Sniffer Pro
-
NetXray
-
Sun snoop and atmsnoop
-
Shomiti/Finisar Surveyor
-
AIX's iptrace
-
Microsoft's Network Monitor
-
Novell's LANalyzer
-
RADCOM's Wide Area Network (WAN)/Local Area Network (LAN) Analyzer
-
HP-UX nettl
-
i4btrace from the ISDN4BSD project
-
Cisco Secure IDS iplog
-
Point-to-point Protocol Daemon (PPD) log ( pppdump-format)
-
The AG Group's/WildPacket's EtherPeek/TokenPeek/AiroPeek
-
Visual Networks' Visual UpTime
-
Lucent/Ascend WAN router traces
-
Toshiba Integrated Services Data Network (ISDN) routers...
Copyright Syngress Publishing, Inc. 2006 under license agreement with Books24x7
