We have identified a number of software packages that could be used both for leg

Question

We have identified a number of software packages that could be used both for legitimate network management purposes as well as for hacking purposes. Depending on the intentions of the user the same feature set available in that package could be used as a sniffer or as a network protocol analyzer to help manage the network. For example, an intrusion detection system and a sniffer might have access to the same type of network transmission data, but the way that data is analyzed and used differentiates these tools.
Choose a network management application that could be used for sniffing or for legitimate network management and configuration purposes. You can choose one of the well-known network protocol analyzers (Ethereal, Wireshark, Snort etc) or choose some other one if you already have some experience with other tools. Research and prepare a short report (at most two pages) identifying the feature set available in such a protocol analysis tool. Explain how the same features could be used for hacking purposes as well as for network management purposes.

Explanation / Answer

Ethereal:

Ethereal is one of the best open-source programs ever made.Although Ethereal was initially made as a UNIX/Linux program in light of Libpcap (an open-source interface for catching system bundles) it has for some time been accessible for Windows.Unlike most open-source programs Ethereal's GUI is straightforward and explore and the item accompanies a 400-page manual in PDF arrange—which beats the run of the mill one-page man page record that is related with most open-source tools.You'll need to download and introduce the Windows variant of Libpcap—WinPcap a free parcel catch design for Windows website before you introduce and utilize Ethereal. The downloaded Ethereal item comes in both GUI and summon line forms. The order line adaptation is valuable for scripting or actuating Ethereal's bundle catching components as per the event of an occasion (think IDS or honeypot analysis).Because Ethereal is open-source programming the Ethereal Web webpage is the essential wellspring of data about the product.The Web website gives data about Ethereal elements, FAQs, and connections to Ethereal engineer and specialized help mailing records.

Ethereal incorporates every one of the components that you ordinarily find in a convention analyzer.You can catch or show all system activity or just movement that meets particular criteria.By default you should stop parcel catching to show movement in spite of the fact that you can advise Ethereal to show caught bundles while catching happens (which causes an execution penalty).You can print out parcel follows in fluctuating levels of detail and organizations or spare them to documents with the goal that you can break down them later.You can advise Ethereal to change over caught data, for example, IP and media get to control (MAC) locations to its basic names as opposed to show crude numbers.

Ethereal additionally gives a few windows that show outline data and statistics.Although Ethereal's presentations aren't as convenient as the dashboard showcases and pie graphs that some contending items, for example, EtherPeek or Netasyst Network Analyzer—offer the measurements that Ethereal gives are helpful and incorporate convention range spreads convention synopses and discussion records (i.e., which have was conversing with which other host).One of Ethereal's most significant components is its capacity to pick one TCP bundle and show all the payload information between the two imparting has over the span of the session.Ethereal's usage of this element is the most easy to understand of any item in this audit in spite of the fact that the element tracks just TCP streams. Other convention analyzers can perform stream examination for conventions other than TCP.

Ethereal is an incredible system convention analyzer for starting to prompt users.For such clients Ethereal's capacities are adequate albeit a few endeavors may have worries about the item's absence of devoted specialized support.Advanced clients who need more exact deciphers better master examination and dispersed structures will discover industrially accessible system convention analyzers a superior decision.

Related Questions

Navigate

• Browse (All)
• Browse W
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.