Hi there,
I was wondering whether it has been in ur attention any sniffer
to be run in command mode .I know there are nice sniffers with interface
but i am looking for one that can be run under dos ..less visible as possible..

Any opinions are welcome

Windump : tcp dumb for windows
http://windump.polito.it/

and ettercap (with cygwin)
http://ettercap.sourceforge.net

AFAIK ettercap (win32) does not rely on cygwin.

Both ettercap and windump rely on Winpcap (polito.it). If you're into Winpcap, you could also give dsniff a try (clear text passwords only).

NGSniff is another sniffer, which is truely stand alone, however it is difficult to manage remotely, and usually gives HUGE dumps (esp if it's a busy machine).


Conclusion? I have still to find a good command line sniffer for windows, with parsing abilities. If anyone knows of one, speak up!

Give tethereal a try, it can be made to work alone, without winpcap.. (I copied it, and a few (6 actually) dll files onto my usb key disk and I can use it anywhere)... it runs from the command line and all that.
Only downside is the executable file is a bit large, but it has lots of nice options which come in handy.. libpcap file captures, filtering, etc..

Here's the help output ...

personnaly i like
tcpdump and its w32 version windump
since it is command line and windows
and linux alike.
decoding packets with dice.
works like a charm.
regards,
u.

yes tcpdump for win32 is a adaptation of Linu Tcpdump.
it s really a great tool
Only problem it s we can install windump :/

lcrzoex is the only way to go.

I suggest use "dsniff" to sniffer passwrod.
win32 version download dsniff download

ps:dsniff must install winpcap.

PSniffer.exei dont know how you can find it, i dont upload anything at this time, but it´s only one exe it´s small (555 KBytes) and commandline.


metrox

which is the tool that can decode SSH packets ?
the Ettercap or Ethereal ? i forgot!!!

wuhhh decode ssh packets, which one is it ?????????????
very interesting

I know cain can sniff ssh-1 packets, using a MiM technique.. so it isnt really decoding the way you might think... ettercap is similar.. it does MiM stuff (arp cache poisoning) .. It probably uses the same technique with ssh.

Both programs use the ARP protocol, which is not routeable..

In my opinion, sniffing ssh isn't as useful as it sounds, usually the user will get some warning that the key is different, if they were trying to connect to a ssh server they had been to before.