CS 426, Spring, 2008, HW 6.
Due March 21, 2008, 11:30 AM.
The purpose of this PSO is to experiment with ethernet "sniffing" and
session encryption.
You should do the experiments on the sslab02-sslab25 machines in LWSN
B131.
The lore machines or the pod machines do not have secondary
interfact to safely snoop traffic.
Use ssh to login to sslab machines to work on them.
First, you should familiarize yourself with two commands: script and
tcpdump. script will allow you to save a copy of whatever you type and
what is output from a command during an interactive session. You will
use this to save evidence of what you type and see during your PSO.
tcpdump is a command to observe traffic on the network. Now, experiment
running tcpdump using the following command: sudo
/usr/local/etc/tcpdumpwrap-eth1 [options]
Study the options of tcpdump yourself (and if you need help, see the TA
in your Lab).
If you use the -w option to save output to a file, the output should be
a simple name like "out", which will create the output file
/var/tmp/-out (i.e. /var/tmp/ashishk-out). The eth1 network
interfaces are on a private network (10.0.0.0/24). The IP addresses are
10.0.0.n where n is 100+station number. For example, the IP address for
sslab05 is 10.0.0.105.
Use the options to the tcpdump command that allow you to see the
contents of packets, not simply the headers.
Run tcpdump under script to observe network traffic. ssh to your
account on another connected machine.
The stations are only connected in pairs as
sslab02 <-> sslab03
sslab04 <-> sslab05
...
sslab24 <-> sslab25
1. You can generate traffic by using ssh to the IP address of the other
station (or ping).
2. Start a new session of script and tcpdump. This time, use "telnet them echo"
on the same machine (in a new ssh session on a different terminal).
3. Run a third session, and use ftp to your account in CS on a paired machine (sslab-?? as mentioned above).
It would not work, but the messages recorded by tcpdump is about the "no connection".
4. Start a fourth session, and send email to your CS account from the
machine. See what is recorded by tcpdump.
Turn in the following documents. Write a short analysis of
what you have recorded in steps 1-4. What does this mean? What would
happen if an attacker had broken into the machine and was running his or
her own version of tcpdump (or something like it?). What if someone is
running a "sniffer" program like this on one of the server machines, or
your ISP?