RFI-Software: We want to see what our network is sending to the cable modem.

Hi. just a general question.
We have a cable modem and a small home network with smoothwall, a switch and
lotsa other clients.
We have a laptop with two pcmcia network cards and some funky cables.

Our question is: We will run linux on the laptop to act as a router and
sniffer but what EXACT softwares should I run.

We need a BaseOS, router, packet sniffer and decent log analyzer for linux.

Setup: CABLEMODEM ----- LAPTOP ----- SMOOTHWALL ---- SWITCH -----
LOTSA-CLIENTS.
Surfboard SB5100 PII 64Mb 2Gb Crappy Box
un-managed WinXP, Win2K, Linux.

Basically we are going to start with Trinux (0.890) and follow their list of
packages and freshmeat.net.
If anyone one knows of a tried and tested solution, we would be most
grateful.

Thanx.
RoseBay SizeQueens

On Mon, 14 Jun 2004 10:41:45 +1000, Size Queen wrote:

> Hi. just a general question.
> We have a cable modem and a small home network with smoothwall, a switch and
> lotsa other clients.
> We have a laptop with two pcmcia network cards and some funky cables.
>
> Our question is: We will run linux on the laptop to act as a router and
> sniffer but what EXACT softwares should I run.
>
> We need a BaseOS, router, packet sniffer and decent log analyzer for linux.
>
> Setup: CABLEMODEM ----- LAPTOP ----- SMOOTHWALL ---- SWITCH -----
> LOTSA-CLIENTS.
> Surfboard SB5100 PII 64Mb 2Gb Crappy Box
> un-managed WinXP, Win2K, Linux.
>
> Basically we are going to start with Trinux (0.890) and follow their list of
> packages and freshmeat.net.
> If anyone one knows of a tried and tested solution, we would be most
> grateful.
>
> Thanx.
> RoseBay SizeQueens

Have you looked into Freesco? It is a minimal os with routing, intended to
be a free replacement for Cisco routers.
url is: http://www.freesco.info/

Renegade wrote:

> On Mon, 14 Jun 2004 10:41:45 +1000, Size Queen wrote:
>
>
>>Hi. just a general question.
>>We have a cable modem and a small home network with smoothwall, a switch and
>>lotsa other clients.
>>We have a laptop with two pcmcia network cards and some funky cables.
>>
>>Our question is: We will run linux on the laptop to act as a router and
>>sniffer but what EXACT softwares should I run.
>>
>>We need a BaseOS, router, packet sniffer and decent log analyzer for linux.
>>
>>Setup: CABLEMODEM ----- LAPTOP ----- SMOOTHWALL ---- SWITCH -----
>>LOTSA-CLIENTS.
>> Surfboard SB5100 PII 64Mb 2Gb Crappy Box
>>un-managed WinXP, Win2K, Linux.
>>
>>Basically we are going to start with Trinux (0.890) and follow their list of
>>packages and freshmeat.net.
>>If anyone one knows of a tried and tested solution, we would be most
>>grateful.
>>
>>Thanx.
>>RoseBay SizeQueens
>
>
> Have you looked into Freesco? It is a minimal os with routing, intended to
> be a free replacement for Cisco routers.
> url is: http://www.freesco.info/
>
>

Indeed. Freesco is awesome, compact, and super easy to use. I
second the Freesco advice.

Adios,

Robert De Mars

--
===========================
http://b-o-b.homelinux.com
Long 93:18W Lat 45:09N
===========================

In article <40ccf44b$0$11525$afc38c87@news.optusnet.com.au> ,
sizequeens@optusnet.com.au says...
> Our question is: We will run linux on the laptop to act as a router and
> sniffer but what EXACT softwares should I run.
>
> We need a BaseOS, router, packet sniffer and decent log analyzer for linux.
>
>

Don't forget also, for some basic tests, you have some options that can
be run from right on smoothwall itself. Start with an "ifconfig" or "ip
addr" and figure out the name of you external interface (most likely,
its one of eth0, eth1 or eth2 - the one which does not have an internal
ip 192.168.x.x or 10.0.x.x for example), then you can do either of the
following to get info on every packet coming/going from the red
interface (for my examples, eth0 is the red interface):

tcpdump -I eth0 <---- will give you a one line summary for every
packet, you can see source and destination ips

snort -v -I eth0 <---- will give you the header for every packet
snort -v -x -I eth0 <---- will dump the contents of every packet


tcpdump also has extensive filtering capabilities. You can filter on
pretty much all TCP packet attributes (source, dst, size protocol,
flags, etc)