Port Sniffer for HPUX..

[Bharat Katkar]

Hi Friends,

I would like monitor packets coming on the NIC interface. Can anybody suggest me a proper tool, command or process to do so.

I am using 11.23 Sep 2004 OS.
Hardware is RP3400 Systems

Thanks for your valuable suggestions.

Regards,
Bharat

[Senthil Prabu.S_1]

Hi,
You can use sniffer, open source sniffer available. Also, use tcpdump, ethereal.

These ported version are available with HP's Internet Express.


HTH,
Prabu.S

[Muthukumar_5]

Bharat,

Use snort. It is good one.

http://gatekeep.cs.utah.edu/hppd/hpux/Networking/Admin/snort-2.3.3/

Hope you are doing great. :)

--
Muthu

[Senthil Prabu.S_1]

Hi,
sorry, there was typo in my previous mail. The tool name is "snort" not "Sniffer".
homepage is www.snort.org.

[Arunvijai_4]

Hi Bharat,

You can use TCPDUMP, Ethereal from Internet Express, Also it has got SSLDUMP for capturing SSL packets and Libpcap library.

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111


-Arun

[Muthukumar_5]

Come on Prabhu. Bharat, prabhu was porting snort to hpux platforms. He is good in that. As per recommendation you can use that. More well to use simple tool then use ethreal or tcpdump tools. Which are coming with Internet Express product as,

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111

--
Muthu

[Senthil Prabu.S_1]

Hi,
snort hpux ported version is aviable at http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1123

[Arunvijai_4]

Snort is part of Internet Express ;-) and it is Intrusion detection system, not as port sniffer. Better use, TCPDUMP.

-Arun

[Senthil Prabu.S_1]

Arun,
Snort can play three roles. Intrusion Detection is one role. It can also sniff as well like, tcpdump.

Also, once you get used to snort, you can play a lot with it by defining used defined rules to snif needed ports and protocols..... it goes on.



Bharat,
I advice you to use Ethereal for analysing as well as sniffing.

[Arunvijai_4 · Accepted solution]

Hi Again,

No arguments that you can use Snort for port sniffing as well, but that is not what it was designed for. You can use ethereal which has got X11 interface or you can use "tethereal" command line tool like "tcpdump".

You can see more tools here,
http://www.networknewz.com/2001/0723.html

It has dniff, Analyzer, etc...

-Arun

[rick jones]

If you have a compiler (a real one, not the bundled) installed the "top-of-trunk" versions of tcpdump/libpcap typically compile out of the tar file under HP-UX, if you want something newer than is in HP Internet Express.

[Bharat Katkar]

Thanks a Lot friends.
Closed...