Packet Capture AND recreation

[wildred]

OK, so I am in a clench here, I use Ethereal and love it. I also use it with Cain. I would like to know if there is a good (hopefully free too) packet capture and recreator program out there for windows (xp). I am sure it has already been listed on here, but agh....boss wants info from a coworkers pc asap. I know ethereal can "recreate" the html, but its not in a pretty little website form. I would hate to decode ALL of the pages captured :(

Thanks (prays for no negs)

[sec_ware]

Hi

Not sure, what you really try to do, but there are well known tools
out there. Here is a small collection of the ones I best know, which
have the capability to manipulate or craft packets. This might enable
you to achieve what you want.

Burbproxy[1]
Ettercap[2]
Hping2[3]
Packet Excalibur[4]
Proxomitron[5]


Cheers

[1] http://portswigger.net/proxy/
[2] http://ettercap.sourceforge.net/
[3] http://wiki.hping.org/86
[4] http://www.securitybugware.org/excalibur/
[5] http://www.proxomitron.info/

[wildred]

Essentially I want to capture packets, then recreate them to the proper files (for example, capture HTML and have it be recreated into a file)

[Irongeek]

Try NetworkActiv in windows, I have a video of it here:

http://www.irongeek.com/i.php?page=videos/networkactiv

it should do what you want.

[wildred]

Hey Iron, I am going to presume that this does not require the network to be wifi correct? Other then that, it looks good.

[Irongeek]

As long as you can sniff it, it can try to put the files together. Wi-fi is not necessary for it to work.

[wildred]

Ok cool. Any hints on how to set this up...
Router IP .0.1
My IP .0.6
IP needed to be monitored .0.2

I am thinking Cain will come in handy...do I need to activate the sniffer AND APR or just one or the other? BTW, thanks for your help with all of this.

[Irongeek]

If it will let you just APR with Cain.

[mmkhan]

hi all,
are there any open source tools for that i.e. recreating the streams from packets e.g. like irc conversation, html pages etc.

Thanks

[Irongeek]

Originally posted here by mmkhan
hi all,
are there any open source tools for that i.e. recreating the streams from packets e.g. like irc conversation, html pages etc.

Thanks

The Dsniff package comes with some tools (filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy) that do some of that:

http://www.monkey.org/~dugsong/dsniff/