I’ve noticed that the old Ethereal website is back up again after being offline for well over a year. The original Ethereal crew, including Gerald Combs the founder, disappeared over to Wireshark, where they created a fork due to problems with trademarks.

Not sure what’s going on. The website hasn’t been updated since 2007. The last version of Ethereal advertised on the site was 0.99.0 from 24th April 2006.

Is somebody planning on keeping the Ethereal brand going?

Chris Sanders is offering an online Wireshark training opportunity for the rather modest cost of $100. The course will cover analyzer placement on your cabling system, performing a network baseline and troubleshooting network latency.

like when you’re doing gigabit packet capture or packet injection, you’ll need a high performance ethernet card.

Sometimes you fall over a product and it blows you away. Network taps have until now been exotic hardware affordable only by large IT departments with the budget to match.

Not any more! nmon have brought out a range of low cost network taps and network traffic analysers with NetFlow support. Looks like network taps just got affordable to the masses.

Why should you be interested? They’re just enterprise doodads aren’t they?

Traditionally they have been enterprise tools…but that’s mainly because of price, not because large enterprises are the only ones with a requirement for them.

Even small networks use switches. The only way you can gain visibility on a switch, without affecting the system as a whole, is via network taps. Network taps provide a great way to troubleshoot your network without affecting the network itself in any way.

But, the biggest use for network taps is for running intrusion detection systems. Network taps afford a way for the intrusion detection system itself to be completely invisible to anything running on the network.

Hopefully, enterprise grade security tools will start to trickle down to smaller and smaller networks. There are a number of open source tools eminently suited to the task.

Update: The nTap & nMirror are now available for purchase.

One of the big problems in a switched network is to access reliably network traffic for analysis or monitoring purposes. Many solutions require changes either to the hosts being monitored or require modifications to your network infrastructure.

Many managed switches have the ability to mirror the traffic on one or more ports. Mirroring simply involves the switch copying network traffic from one or more ports to another designated port. The switch still sends the network traffic to its original destination.

With a simple command you can start analysing the traffic on another switch port without having to touch any of the devices being analysed.

For instance, on a Cisco switch, the following command will mirror the source port to the destination port:

set span <source port> <destination port>

Port mirroring can be an ideal solution in some circumstances, it does have some problems though:

• Port mirroring can indirectly affect the system being analysed. The switch, especially under high load, can cause the switch to drop packets and indeed to pause operation altogether;
• Port mirroring can potentially pose a security risk. You can start mirroring a port via the switch’s command line interface, something or someone can stop mirroring it too;
• Things become tricky on full duplex ports — in other words, where devices can send and receive at the same time, turning a 100 Mbp/s link into an effective 200 Mbp/s link — you may lose traffic if the port is running close to capacity.

The solution to the above problems comes in the shape of a network tap. Network taps remove the need to perform port mirroring on the switch so avoiding the chance that the switch’s performance will be affected.

Network taps are also completely out of band, nothing on the network can switch them off. If you wish to perform intrusion detection, you can be sure that your monitoring efforts are completely invisible to the potential intruders.

In the unlikely event of the network tap failing, the monitored system is completely unaffected.

Of course, the downside is that network taps cost money.

Greg Conti has released a new version of rumint that now works with WinPcap 4.0.1. If you tried rumint before and had problems, I suggest you give it another go.

Protocol analysers are difficult tools to master. Though, once mastered you’ll see the pay-off in increased productivity for the rest of your career. Many technologies come and go, but the fundamentals of how networks work changes slowly.

You can slug it out with books but structured learning will help speed things along.

If self paced learning suits you best, a series of four self study courses are available:

• Wireshark Functionality and Fundamentals
• TCP/IP Network Analysis
• Troubleshooting Network Performance
• Wireshark Network Forensics and Security

If you prefer face to face, instructor led learning, that’s available too from the Wireshark Bootcamp. Courses are scheduled worldwide including the London, Munich, Netherlands & Sweden. Courses are scheduled for October so get your skates on!

WinPCap is a great Windows based, open source driver for packet sniffing wire-based networks using a bog standard network interface card. WinPCap is licensed under the General Public License (GPL).

From a commercial software developers perspective, the GPL can be quite intimidating. Consequently, a lot of commercial developers won’t touch GPL’ed code with a very long barge pole.

Fortunately, the developers of WinPCap have come up with a commercial developer friendly version of WinPCap, WinPCap Professional. Of course, you’ve got to pay, but as a commercial developer, you’re used to that!

With WinPCap Professional you get an excellent packet sniffing library without the scary license and you get to support WinPCap open source development too. Everybody’s a winner!

Tools like the Test-Um Wi-Net are great for trouble shooting wireless networks. But, Wi-Net falls a long way short of giving you real technical insight into your wireless network. What do you do if you need more? Say, you need to capture packets and the like.

One solution is to use the WireShark + AirPcap combination.

WireShark I’m sure most of you have heard of. Formerly known as Ethereal, it is a very capable open source packet capture tool for a variety of platforms including Microsoft Windows. And the best bit? It’s free!

AirPcap is a family of wireless interface cards and associated drivers, ideal for use with WireShark, to capture packets on wireless networks all the way up to 802.11n. The cards cost from $198 each.

One of the tools recommended in Chris Sander’s Practical Packet Analysis book is called Rumint.

Rumint is a free, open source packet visualization tool available for Microsoft Windows (written in Visual Basic.)

Roomint’s author, Greg Conti, has a book to be published by No Starch Press called Security Data Visualization.

One problem I’ve run into with Rumint is that it doesn’t work on my setup. I run Windows XP and I’ve got WinPCap 4.0.1. It looks to me like a problem between Rumint and the latest version of WinPCap. The problem is that Rumint won’t show any network interfaces to sniff, so obviously things don’t work too well.