Network Utility Programs

3-16-2012
For this class, there will be homework exercises requiring the use of:

   nmap  ping    traceroute   tcpdump   ethereal   nslookup (or "host" or "dig"), whois,  ssh, and telnet.

The best way to run network utilities is under UNIX (Linux or Mac OS X ("Terminal" or "X11").  The most useful are installed with the OS (traceroute, ping, netstat, nslookup, dig, whois, tcpdump, ...).  "wireshark" can be selected as a network utility during a Linux install.  Instructions on use can be obtained from the "man" pages (for manual) by typing "man program-name" at the command line.

Ethereal (now "wireshark") - Network monitor program, can be installed on Linux, Mac (see info/Install-wireshark-on-MacOS.html), Windows - http://wireshark.org

nmap, a  port-scanning tool (http://www.insecure.org/nmap/)  (Windows also)

PGP Encryption - PGP International (free, v.8.0 2003), PGP Corp ($59), other Links (2002)

GPG - GNU Privacy Guard - open source replacement for PGP -  www.gnupg.org
   MacOS - http://macgpg.sourceforge.net/    As of 2/26/2010 under Snow Leopard (OSX 10.6), the GPGMail plugin does not work in Apple Mail.  Thunderbird with the Enigmail plugin seems to the only option for Snow Leopard users (it also can be used with Thunderbird on Windows).

c Compiler - gcc is standard in unix, linux, and MacOS.

For Mac

To install additional UNIX applications, install MacPorts, www.macports.org , then use MacPorts to install apps (e.g., in Terminal: >sudo port install nmap).  If "sudo" does not work, do "su", root password, then >port install nmap.  You may have to first  Enable Root User (in Finder, click on Help, type "Root User" in the search box, click on "Enable Root User").  ">" indicates the Terminal prompt (which may differ and which you do not type).

Host-Based Firewall - for servers use the "Sharing" panel in "System Preferences ...".  This will allow specific open server ports, but with no restriction on incoming IP addresses.  The "/etc/hosts.allow" file appears to be recognized by the sshd server, and perhaps other servers, but only lines like "all : 130.207.  " or "130.207.0.0/255.255.0.0" can be used (no server specification, or netmask specification by  /16).

The application "Little Snitch" ($25, http://www.obdev.at/products/littlesnitch/download.html) works like the Vista firewall, limiting network connections by application, ports, and IP ranges.  The rule table is built up by selections in a pop-up box whenever a new connection is attempted.  You can manually edit the rules (e.g., change 130.207.225.12 to a subnet like 130.207.0.0/16). 

I highly recommend "RBrowser" ($29, http://www.rbrowser.com/) for transfering files between Macs and/or UNIX systems, and synchronizing remote folders. It is easier than remote mounting Mac disks, and works with any remote host running an ssh server. Good GUI interface.

For Windows

Windows has ping, nslookup, telnet, and "tracert" available from the "Command Prompt"  terminal window (cmd.exe).

"Command Prompt" -(terminal)  Start -> Run -> type "CMD"  The program is %systemroot%\windows32\cmd.exe

Windows - unix environment - cygwin - http://www.cygwin.com/ -manually select the optional download of "development utils"  to get the gcc c compiler.

MSDNAA Website, that has Visual Studio versions 2003, 2005, and 2008: http://msdn02.e-academy.com/git_ece  You can down load these for use at home, as long as your are a registered student of GA Tech.  The site requires a user name and password obtained from msdnaa-help@ece-help.gatech.edu.

"dig" and "whois" - http://members.shaw.ca/nicholas.fong/dig/  "whois" is installed when "dig" is installed.

"notepad++" for true text file editing of .bat and .conf files.  http://sourceforge.net/projects/notepad-plus/ or Google for it. Windows "Notepad" may add problematic control characters, and Wordpad and Word definitely will.

  Wireshark- Network monitor program - http://wireshark.org

  WinSCP - a SFTP and SCP client for Windows using SSH. Its main function is secure copying of files between a local and a remote computer - http://sourceforge.net/projects/winscp/

  SSH Server for Windows - sshd.  FreeSSHd - http://www.freesshd.com/ and SSHwindows - http://sourceforge.net/projects/sshwindows/.

   PuTTY - a telnet and ssh client for Windows - http://www.chiark.greenend.org.uk/~sgtatham/putty/

   PingPlotter - A Windows XP program that does pings and traceroutes, - http://www.pingplotter.com

You need a remote server to practice doing things over the network.  To set up a user account on the ECE UNIX servers, go to:

http://www.ece-help.gatech.edu/unix/index.html  - note that you are an ECE6612 student on the form you will fill in.

Look at the tutorial: http://www.ece-help.gatech.edu/unix/tutorial/index.html

To ease logging on, look at http://www.csc.gatech.edu/copeland/jac/6612/info/SSH-No-Password-Login.txt

You can capture network traffic by saving the file from a Wireshark capture, or capturing directly from the command line with tcpdump: http://www.tcpdump.org/.  A standard UNIX utility program, tcpdump uses the same capture filtering commands as Wireshark (they both use lib/pcaplib). To write your own analysis programs, you need the format of these capture files: http://wiki.wireshark.org/Development/LibpcapFileFormat.


Up to Date Information

SANS Institute

Computer Emergency Response Taskforce (CERT)

Cisco -Security Advisories,

   Cisco "Internet Protocol Journal" -  http://www.cisco.com/ipj/

    Example - "Handling IP Addresses" - http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_9-1/ip_addresses.html

IEEE Computer Society

IEEE CS Technical Committee on Security and Privacy

Slashdot

Linux Security - linuxsecurity.com, Patches at www.linuxsecurity.com/advisories/

Government Organizations

U.S. Dept. of Justice - Cyber Crime

U.S. FBI - Cyber Crime

Secure Sockets Layer (SSL) for Web data transfer

Recent Attack Information.  Netcraft.

Add SSL to a socket (e.g., add TLS to email):

socat - (http://www.dest-unreach.org/socat/

Stunnel - (http://www.stunnel.org/)

Hacker Information

2600 magazine

Security Products

Test your Windows Configuration - Shields Up

See What Your Computer tell's every Web Site you Access

Georgia Tech Security Info (free anti-virus for GT students)

Writing Secure Software

Learn Unix Commands in 10 Minutes

Secure Programming for Linux and Unix HOWTO

The Network Time Protocol , NTP (need accurate time for forensics)

The Official U.S. Government Time


Odds and Ends (old notes)

The best way to run network utilities is under UNIX (Linux or Mac OSX).  The most useful are installed with the OS (traceroute, ping, netstat, nslookup, dig, whois, tcpdump, ...).  "wireshark" can be selected as a network utility during a Linux install.  Instructions on use can be obtained from the "man" pages (for manual) by typing "man program-name" at the command line.

Windows has ping, nslookup, telnet, and "tracert" available in the Command Prompt terminal window.  You can "redirect" the output into a text (.txt) file (e.g., tracert www.cnn.com > C:\mystuff\trace.txt) and then edit the file in "Notepad" or "Wordpad".

  Ethereal (now "wireshark") - Network monitor program, can be installed on Linux, Mac (see info/Install-wireshark-on-MacOS.html), Windows - http://wireshark.org

  WinSCP - a SFTP and SCP client for Windows using SSH. Its main function is secure copying of files between a local and a remote computer - http://sourceforge.net/projects/winscp/

   OpenSSH for Windows - ssh client and server - http://www.networksimplicity.com/openssh/

   PuTTY - a telnet and ssh client for Windows - http://www.chiark.greenend.org.uk/~sgtatham/putty/

   PingPlotter - A Windows XP program that does pings and traceroutes, - http://www.pingplotter.com

   dig - similar to "nslookup", does automatic iterative name resolution with "+trace" option.  A good version for Windows is from http://members.shaw.ca/nicholas.fong/dig/  (includes "whois").

"whois" gives information about the owner and operator of a subnet.

A different approch to downloading programs into Windows is to boot up Linux from a CD that already has the utilities installed.  These CDs will do just that, without affecting your hard disk or the Windows OS on it.

   Knoppix - Boot disc creates a Linux OS in RAM - http://knoppix.org/ (German- click on flag for English)

   STD - Boot disc creates a (old) Linux OS in RAM with many network security tools - http://s-t-d.org/

Some things can be done from certain Web sites.  I like the Geek Tools "whois" lookup, but the "whois" utility in Linux and MacOS now also does a good job of selecting the right registrar based on the IP address.

   Geek Tools - A Web site that does pings, traceroutes, and whois, ... - http://www.geektools.com

Some notes on use and installation are in the "info" folder - info/