OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Tracking Specific Ports
From: Eric Sherrill (sherrillTI.COM)
Date: Thu Aug 03 2000 - 16:07:11 CDT

Try (on the same LAN segment, natch) with a Linux box:

        tcpdump -s 1518 -w file host hostname port 8002

or, a Solaris box:

        snoop -o file hostname port 8002

(both these commands capture the packets to/from 'hostname' on port 8002 to
'file' for later analysis).

There are good Win32 equivalents out there as well, e.g. EtherPeek from AG
Group at http://www.aggroup.com (commercial; spiffy GUI), or WinDump at
http://netgroup-serv.polito.it/windump/ (BSDish free license; straight CLI
port of tcpdump). 

--
Eric R. Sherrill, WF Software Systems Engineer
Texas Instruments HFAB1 Automation Systems
Stafford, TX 77477-3006
281-274-4133

-----Original Message-----
From: Focus on Microsoft Mailing List
[mailto:FOCUS-MSSECURITYFOCUS.COM]On Behalf Of Brian Pollack
Sent: Wednesday, August 02, 2000 10:56 AM
To: FOCUS-MSSECURITYFOCUS.COM
Subject: Tracking Specific Ports

Hopefully there is an answer to this difficult issue without an all-out
ethical discussion.  We need to be able to record a few workstations chat on
Yahoo! Chat (port 8002).