mailing list archives
Re: RFC on Nping: Raw packet probing nirvana
From: Ron <ron () skullsecurity net>
Date: Fri, 08 May 2009 10:08:59 -0500
Hi Brandon. You should think about this more when you're more rested,
as I think you're on to something! In particular, a number of people
over the years have asked for this sort of client/server testing to
determine what packets are being dropped and how they're being
manipulated across the network.
If you can think up a concrete proposal, please do send it for
discussion. Having Nping act as the sniff server itself is an
interesting idea. Or we could have another tool for that (nsniff?),
which would sniff for a unique token/signature which Nping, Nmap and
the like could be requested to send. This signature could be a unique
IP option string, IP ID, TCP option, data value, or the like. That
would make it very easy to isolate and only show the packets coming
from Nmap/Nping. But it may not work well for some of the things you
have in mind. I'm just doing late night incoherent brainstorming too
:). But everyone has probably noticed that I've lately had a
propensity for dreaming up new tools :).
This is very much related to what Brandon suggested, but a somewhat
different purpose (maybe :) ).
When doing pentesting work, you are sometimes starting from a
residential ISP, and there's no telling what filters are in place (one
ISP here filters 445, for example, which makes detecting Conficker
difficult). Or maybe you broke into the target's wireless network, or
are staying at a hotel. It'd be good to have a way of testing an ISP's
filters, whether it's port-based, session-based, actual attack
I once whipped up a in Perl where the client would tell the server that
it was going to start sending stuff. The server would basically run
tcpdump and log everything. When the client announced it was done, the
server would send the full capture log to the client. It was up to the
client to see what's missing and report what type of filters are in place.
I didn't actually get past writing the server portion, unfortunately.
But knowing what kind of filters are in place could be extremely useful
to a pen tester (when I was taking a SANS course with Ed Skoudis, he
mentioned a desire for such a tool).
Sent through the nmap-dev mailing list
Archived at http://SecLists.Org
Re: RFC on Nping: Raw packet probing nirvana ithilgore (May 06)