Re: Tracking tools?

[gmiller () dey-systems com (Greg Miller)]

On Wed, 14 Aug 1996 23:56:41 -0400, you wrote:

> Can anyone point out some tools I might apply to this dump file in order
> to track the session which actually hacked root?  I'd most like to see
> one of the monitoring programs which can be fed from the dump file, but
> I'd be happy with something which would give me an ascii dump of the
> data portions of selected packets.

        I've written a program just for this.  It's in perl, and isn't the
prettiest or fastest code in the world, but it works (for the most part).  It
will retrieve the IP, TCP, UDP, and ICMP headers from the dump and print the
headers (labeled).  It then prints any remaining data in both hex and ascii.
        The program is on my web page in the "misc" section.  You can download
it directly at http://grendel.ius.indiana.edu/~gmiller/network/tcpformat.pl.

.·´¯´·._.·´¯´·._.·´¯´·._.·´¯´·._.·´¯´·._.·´¯´·._.·´¯´·._.·´¯´·._.·´¯´·._.·´¯
enum MicrosoftBoolean {TRUE, FALSE, MAYBE};
Greg Miller: Programmer/Analyst (gmiller () dey-systems com)
http://grendel.ius.indiana.edu/~gmiller/
´·._.·´¯´·._.·´¯´·._.·´¯´·._.·´¯´·._.·´¯´·._.·´¯´·._.·´¯´·._.·´¯´·._.·´¯´·._