netcat and monitoring local traffic 1

[fastlanwan]

I'm trying to monitor any traffic from my machine (XP) using netcat. It seems to be listening by the prompt of "listening on port x..." but I see no output to the screen or if I redirect to a file, its empty.

The cmd I've tried using are "nc -vv -l -p21-139" or "nc -l -p21-139" both with and without ">filename" with no output either way. I do have a firewall and took it down for the tests so that's not it and its running or "listening on port x..." while I'm web surfing it should at least pickup p53 and p80 but its not picking up anything.

Ideas anyone?

A+ N+ Sec+ SME/Sec+

 

[pansophic]

Netcat is not designed to be used for monitoring traffic, it is an application that listens on a given port to the exclusion of any other application that may be listening on that port. If you bind to a specific IP address, you will typically insert "in front of" the listening application, which generally listens on "any" IP address.

Read the following excerpt from the netcat for NT README.

--------------------------------------------
You will need to bind "in front of" some services that may already be listening on those ports. An example is the NETBIOS Session Service that is running on port 139 of NT machines that are sharing files. You need to bind to a specific source address (one of the IP addresses of the machine) to accomplish this. This gives Netcat priority over the NETBIOS service which is at a lower priority because it is bound to ANY IP address. This is done with the Netcat -s option:

nc -v -L -e cmd.exe -p 139 -s xxx.xxx.xxx.xxx

Now you can connect to the machine on port 139 and Netcat will field the connection before NETBIOS does. You have effectively shut off file sharing on this machine by the way. You have done this with just user privileges to boot.
--------------------------------------------

BTW, the example is quite dangerous, as it binds a command shell to port 139, meaning that anyone who attempts to telnet to that port will receive a command prompt from your machine.

I think that what you are really looking for is Ethereal (

http://www.ethereal.com/).

It uses the WinPCAP library, which is a packet capture library developed initially for Unix at Lawrence Berkely Labs and ported to Windows by an Italian firm.


pansophic