Packet Capture AND recreation

[mmkhan]

checkout tcpflow (http://www.circlemud.org/~jelson/software/tcpflow/)

tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis.

Thanks

[phatcat42141]

Kudos to Iron for sharing the link to NetworkActiv. I love this program. Its simple and don't use much space/resources or hog the memory. It tells a lot of info also )

[wildred]

I will second that phatcat. I used this program just a few days ago. Combined with Caine, doing the ARP poisoning...I now am down one less coworker....

A word of advice to those out there...if its something you just maybe shouldnt be doing...dont do it. If your boss wants to find it, he/she will.

[treanglin]

Maybe It's just me, but if your boss asked you to observe the actions of a user on the computer i'd assume that you are a net admin or someone similar on that network. So why are you using Cain to sniff the data. Couldn't you just setup a snort box/proxy? I'm also assming that this person is doing bad stuff on the internet or whatever. The reason I ask is because i just read a book about K.M. and he talkes a lot about social engineering and deception and stuff. But then again I assume that many of the users of this site are sketchy characters also and just pretent that the information that they give out is being used as productive and to counter malicious computer users.

[wildred]

Actually, no, Im not a net admin.....my boss knows that I am "in" the hackers/crackers/call it what you want field...meaning I associate with them...not that I do "bad things"....
He presented this more of a challenge than anything else. Setting up a snort box/proxy would take more time then simply firing up Cain, dont ya think?