Ethereal - Revision history

Gijs at 11:11, 1 February 2007

2007-02-01T11:11:36Z

Gijs: /* Promiscuous mode */

2007-01-30T19:12:11Z

Promiscuous mode

Gijs at 19:03, 30 January 2007

2007-01-30T19:03:50Z

Gijs: /* Using Ethereal */

2007-01-30T18:52:44Z

Using Ethereal

Gijs: /* Using Ethereal */

2007-01-30T16:10:49Z

Using Ethereal

Gijs: /* Using Ethereal */

2007-01-30T15:58:59Z

Using Ethereal

Gijs: /* Using Ethereal */

2007-01-30T15:57:25Z

Using Ethereal

Gijs at 15:55, 30 January 2007

2007-01-30T15:55:06Z

Gijs at 12:30, 30 January 2007

2007-01-30T12:30:38Z

Gijs: /* Analysis */

2007-01-30T12:03:50Z

Analysis

@@ Line 4: / Line 4: @@
 * <tt>192.168.1.101 </tt>- Asterisk #1
 * <tt>192.168.1.106 </tt>- Asterisk #2
-* <tt>192.168.1.3   </tt>- Windows machine 1 (also running both VMware's for both Trixboxes)
+* <tt>192.168.1.3   </tt>- Windows machine 1 (running VMware with Tribox, Asterisk #1)
 * <tt>192.168.1.189 </tt>- Laptop #1 running only X-lite
 * <tt>192.168.1.100 </tt>- Laptop #2 running only X-lite
@@ Line 27: / Line 28: @@
 == Promiscuous mode ==
 For detailed analysis, also traffic not adressed to the machine running Ethereal must be captured.
-If all Trix-boxes (each SIP-device communicates via an Asterisk box) run on the same computer in e.g. VMware, it is quite easy to capture all network data before it is sent through the ethernet adapter.
+If both VMware machines run on the same computer, it is impossible to capture the traffic between them. Therefore we setup an extra Windows machine running VMware.
 When measuring (listening to) all data on the local network, the network adapter has to be set in '''promiscuous mode'''. This is only possible with administrator rights (e.g. root in Linux) and not all network devices can operate in such mode.

@@ Line 32: / Line 32: @@
 For example most WiFi cards cannot operate in this mode and therefore cannot listen to all traffic it receives.
-Another problem when listening to all other traffic (= all traffic not adressed to the computer running Ethereal) is in a switched network. When using switches instead of hubs, you cannot "hear" what other computers are sending to each other. Possible work-arounds are setting the switch in broadcast-mode (not all switches can do this) or forcing the switch to operate like a hub by overloading the MAC-table (forging numerous false MAC-addresses, most system-administrators will not like this).
+Another problem when listening to all other traffic (= all traffic not adressed to the computer running Ethereal) is in a switched network. When using switches instead of hubs, you cannot "hear" what other computers are sending to each other. Possible work-arounds are setting the switch in broadcast-mode (not all switches can do this) or forcing the switch to operate like a hub (System-administrators will not like this) by overloading the MAC-table (see [http://en.wikipedia.org/wiki/MAC_flooding Wikipedia:MAC flooding]).
 Some (manageble) switches can create one or more <tt>Vlan</tt>s in which sniffing the traffic is possible.

@@ Line 6: / Line 6: @@
 * <tt>192.168.1.3   </tt>- Windows machine 1 (also running both VMware's for both Trixboxes)
 * <tt>192.168.1.189 </tt>- Laptop #1 running only X-lite
 = Analysis on VoIP-calls =
@@ Line 25: / Line 26: @@
 For more information on Packet Capturing, we have included a simple how-to [[Ethereal capture filter]] ([http://www.openxtra.co.uk/support/howto/ethereal-filter.php source])
 == Promiscuous mode ==
 When measuring (listening to) all data on the local network, the network adapter has to be set in '''promiscuous mode'''. This is only possible with administrator rights (e.g. root in Linux) and not all network devices can operate in such mode.
 For example most WiFi cards cannot operate in this mode and therefore cannot listen to all traffic it receives.
-Another problem when listening to all other traffic is in a switched network. When using switches instead of hubs, you cannot "hear" what other computers are sending to each other. Possible work-arounds are setting the switch in broadcast-mode (not all switches can do this) or forcing the switch to operate like a hub by overloading the MAC-table (forging numerous false MAC-addresses, most system-administrators will not like this).
+Another problem when listening to all other traffic (= all traffic not adressed to the computer running Ethereal) is in a switched network. When using switches instead of hubs, you cannot "hear" what other computers are sending to each other. Possible work-arounds are setting the switch in broadcast-mode (not all switches can do this) or forcing the switch to operate like a hub by overloading the MAC-table (forging numerous false MAC-addresses, most system-administrators will not like this).
 Some (manageble) switches can create one or more <tt>Vlan</tt>s in which sniffing the traffic is possible.

@@ Line 16: / Line 16: @@
 e.g. After capturing we filtered out all data to machines not on the local network (IP-adress other than 192.168.1.x), using this filter:
   ip.src >= 192.168.1.1 && ip.src <= 192.168.1.255 && ip.dst >= 192.168.1.1 && ip.dst <= 192.168.1.255
 Doing this ensures other data like a webpage refreshing, or a mail-client fetching new mail does not contaminate the meassurements.

@@ Line 20: / Line 20: @@
 When doing further analysis, sometimes the filters should only look at the protocol under investigation, because Windows PC's will also communicate to each other about shared files, etc.
 Also HTTP- and DHCP-traffic is not uncommon between the VMware- and other local machines.
 == Promiscuous mode ==
 When measuring (listening to) all data on the local network, the network adapter has to be set in '''promiscuous mode'''. This is only possible with administrator rights (e.g. root in Linux) and not all network devices can operate in such mode.

← Older revision		Revision as of 15:55, 30 January 2007
Line 21:		Line 21:
	Also HTTP- and DHCP-traffic is not uncommon between the VMware- and other machines.		Also HTTP- and DHCP-traffic is not uncommon between the VMware- and other machines.

−	When measuring all data on the local network, the network adapter has to be set in '''promiscuous mode'''	+	When measuring (listening to) all data on the local network, the network adapter has to be set in '''promiscuous mode'''. This is only possible with administrator rights (e.g. root in Linux) and not all network devices can operate in such mode.
		+	For example most WiFi cards cannot operate in this mode and therefore cannot listen to all traffic it receives.
		+
		+	Another problem when listening to all other traffic is in a switched network. When using switches in stead of hubs, you cannot "hear" what other computers are sending to each other. Possible work-arounds are setting the switch in broadcast-mode (not all switches can do this) or forcing the switch to operate like a hub by overloading the MAC-table (forging numerous false MAC-addresses).
		+	Some (manageble) switches can create one or more <tt>Vlan</tt>s in which sniffing the traffic is possible.

@@ Line 10: / Line 10: @@
   ip.src >= 192.168.1.1 && ip.src <= 192.168.1.255 && ip.dst >= 192.168.1.1 && ip.dst <= 192.168.1.255
-= Analysis =
+= Analysis on VoIP-calls =
 We did also do some [[Ethereal Analysis]] on the traffic during several conversations.