Capture - Revision history

Khalats at 22:55, 23 March 2008

2008-03-23T22:55:21Z

← Older revision		Revision as of 22:55, 23 March 2008
Line 9:		Line 9:
	libpcap and WinPcap provide the packet-capture and filtering engines of network intrusion detection systems. They are usually installed at the data link layer but they can be installed at any desired layer and they capture the net work traffic from that layer all the way up. Filters can be applied so that the NIDS can can sniff the data in a desired way. for example:		libpcap and WinPcap provide the packet-capture and filtering engines of network intrusion detection systems. They are usually installed at the data link layer but they can be installed at any desired layer and they capture the net work traffic from that layer all the way up. Filters can be applied so that the NIDS can can sniff the data in a desired way. for example:

-	- request a list of all packets except the ones that use UDP.- request a list of all packets all packets going through TCP and usnig port 80.	+	- request a list of all packets except the ones that use UDP.
		+
		+	- request a list of all packets all packets going through TCP and usnig port 80.

Khalats at 22:55, 23 March 2008

2008-03-23T22:55:09Z

← Older revision		Revision as of 22:55, 23 March 2008
Line 1:		Line 1:
-	an IDS ~~should~~ use ~~some~~ methods to capture the relevant data to be analyzed.	+	IDS use different methods to capture the relevant data to be analyzed. A very well known method is pcap.

	pcap consists of an application programming interface (API) for capturing network traffic. Unix-like systems implement pcap in the libpcap library(packet capture library); Windows uses a port of libpcap known as WinPcap.		pcap consists of an application programming interface (API) for capturing network traffic. Unix-like systems implement pcap in the libpcap library(packet capture library); Windows uses a port of libpcap known as WinPcap.
Line 7:		Line 7:
	libpcap and WinPcap also support saving captured packets to a file, and reading files containing saved packets; applications can be written, using libpcap or WinPcap, to be able to capture network traffic and analyze it, or to read a saved capture and analyze it, using the same analysis code. A capture file saved in the format that libpcap and WinPcap use can be read by applications that understand that format.		libpcap and WinPcap also support saving captured packets to a file, and reading files containing saved packets; applications can be written, using libpcap or WinPcap, to be able to capture network traffic and analyze it, or to read a saved capture and analyze it, using the same analysis code. A capture file saved in the format that libpcap and WinPcap use can be read by applications that understand that format.

-	libpcap and WinPcap provide the packet-capture and filtering engines of ~~many open-source and commercial network tools, including protocol analyzers (packet sniffers), network monitors,~~ network intrusion detection systems, traffic~~-generators and network-testers~~.	+	libpcap and WinPcap provide the packet-capture and filtering engines of network intrusion detection systems. They are usually installed at the data link layer but they can be installed at any desired layer and they capture the net work traffic from that layer all the way up. Filters can be applied so that the NIDS can can sniff the data in a desired way. for example:

-		+	- request a list of all packets except the ones that use UDP.- request a list of all packets all packets going through TCP and usnig port 80.
-	~~gets the data from the data link layer~~	+
-		+
-	~~(and from each layer that you get your input, you can go from that layer~~ all the ~~way up)~~	+
-		+
-		+
-	~~packet capture library:~~	+
-		+
-	~~- data link layer~~	+
-		+
-	~~- fire wall~~	+
-		+
-		+
-	~~filters apply to data so~~ that ~~you can sniff what you want~~.	+
-		+
-	~~ex:~~	+
-		+
-	~~- everything but UDP~~	+
-		+
-	- all packets going through TCP and usnig port 80	+

Khalats at 22:45, 23 March 2008

2008-03-23T22:45:01Z

← Older revision		Revision as of 22:45, 23 March 2008
Line 1:		Line 1:
		+	an IDS should use some methods to capture the relevant data to be analyzed.
		+
		+	pcap consists of an application programming interface (API) for capturing network traffic. Unix-like systems implement pcap in the libpcap library(packet capture library); Windows uses a port of libpcap known as WinPcap.
		+
		+	Monitoring software may use libpcap and/or WinPcap to capture packets travelling over a network and, in newer versions, to transmit packets on a network at the link layer, as well as to get a list of network interfaces for possible use with libpcap or WinPcap.
		+
		+	libpcap and WinPcap also support saving captured packets to a file, and reading files containing saved packets; applications can be written, using libpcap or WinPcap, to be able to capture network traffic and analyze it, or to read a saved capture and analyze it, using the same analysis code. A capture file saved in the format that libpcap and WinPcap use can be read by applications that understand that format.
		+
		+	libpcap and WinPcap provide the packet-capture and filtering engines of many open-source and commercial network tools, including protocol analyzers (packet sniffers), network monitors, network intrusion detection systems, traffic-generators and network-testers.
		+
		+
	gets the data from the data link layer		gets the data from the data link layer

Khalats at 17:39, 22 March 2008

2008-03-22T17:39:32Z

← Older revision		Revision as of 17:39, 22 March 2008
Line 1:		Line 1:
	gets the data from the data link layer		gets the data from the data link layer
		+
	(and from each layer that you get your input, you can go from that layer all the way up)		(and from each layer that you get your input, you can go from that layer all the way up)

Khalats at 17:38, 22 March 2008

2008-03-22T17:38:57Z

← Older revision		Revision as of 17:38, 22 March 2008
Line 1:		Line 1:
	gets the data from the data link layer		gets the data from the data link layer
	(and from each layer that you get your input, you can go from that layer all the way up)		(and from each layer that you get your input, you can go from that layer all the way up)
		+

	packet capture library:		packet capture library:

Khalats: New page: gets the data from the data link layer (and from each layer that you get your input, you can go from that layer all the way up) packet capture library: - data link layer - fire wall f...

2008-03-22T17:38:40Z

New page: gets the data from the data link layer (and from each layer that you get your input, you can go from that layer all the way up) packet capture library: - data link layer - fire wall f...

New page

gets the data from the data link layer
(and from each layer that you get your input, you can go from that layer all the way up)

packet capture library:

- data link layer

- fire wall

filters apply to data so that you can sniff what you want.

ex:

- everything but UDP

- all packets going through TCP and usnig port 80