barns.blog

Today was a little bit slow. I started off well by redoing this site, so that it would produce nifty things such as RSS feeds. Its now using WordPress.

I managed to get the Linux version of InetVis to work with my crafted Ethernet frames which was great. I then started creating tcpdumps of the different types of Nmap scans. These will be analysed with Snort, Bro and InetVis.

Today I set about performing the following tasks:

• Setting up and Running Snort
• Testing Snort with a few Simple Scans
• Using InetVis with NULL Interface Traffic

I succeeded in setting up Snort and running it with just the sfportscan preprocessor. The README states that it is designed to match against Nmap scans and I attempted to get it to alert on these, but discovered that it doesn’t alert on a number of these scans.

In an attempt to use Nmap scans tartgeted at a FreeBSD disc Interface, I set about modifying InetVis to accept more than just Ethernet frames. This was a “Bad Idea”™. With some help from Nick and Wiresharks text2pcap tool, I wrote a program which converts a disc interface tcpdump file to text which can be processed by text2pcap to produce a file of Ethernet frames. This loads correctly into Wireshark, but still does not produce output in the Windows version of InetVis. I think that it is a bug…

I struggled to use C++ after such a long time of not using it, but it certainly improved as the afternoon wore on.