Re: Spyware assessment techniques - hub?

[Packet Man <packetman () altsec info>]

Petr.Kazil () eap nl wrote:
> > If you are doing a host:
> > - interrupt the hosts uplink with a hub and plug your snort box in.
> > You could have this all setup on a laptop.
>
>
> I have tried this but run into problems:
>
> - Real hubs are (almost?) impossible to get nowadays. Even the cheapest 
> "hub" is really a switch. If you know where I can find a hub-like network 
> component, then I'll order it right away.
> - I was able to buy the last real hub from a PC-shop, but it was only 
> 10Mbps and it refused to work with my 100Mb cards and switches.

If you can't do port mirroring on the switch itself, you
could build a passive network tap for under US$30.00,
or so.  Or, the alternative is a commercial network tap
for around US$1,000.00.

I've been building and using them for several years
now, but only recently have started documenting their
finer points (NIC selection is critical).  For more
info on building and using a passive network tap, see
my paper at: http://www.altsec.info/passive-network-tap.html

I'm working on an updated paper right now regarding the
error rates.  I've been testing with combinations of NIC's
that produce ZERO errors on 100Mb connections.  I expect to
update the paper with the suggestions within the next week.

BTW... a must read for such things is "The TAO of Network
Security Monitoring" by Richard Bejtlich.  Check out his
site at:  http://www.taosecurity.com/books.html

BTW... since the technique really belongs in the IDS
list, I cross-posted this message there.

Good luck.

--
Excellence in InfoSec and Linux
http://www.altsec.info

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner: 

Hackers are concentrating their efforts on attacking applications on your 
website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
futile against web application hacking. Check your website for vulnerabilities 
to SQL injection, Cross site scripting and other web attacks before hackers do! 
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------