|THIS WEEK'S GLOSSARY|
Intrusion detection software: Specialized security programs that monitor log-on attempts, security logs and other information to try to detect unauthorized attempts to access the corporate network.
TCP/IP fingerprinting: The process of analyzing the TCP/IP protocol stack of a target host computer on a network to discover its operating system and version.
Ping: This utility for TCP/IP-based networks sends a query packet to a target network user or host address and waits for a reply to confirm its presence on the network.
The PacketStorm Web site bills itself as an online security library. Follow this link to download the Firewalk program.
Visit this hacker Web site to download the Nmap program.
This link takes you to the Sniffit packet-sniffer utility, available from Proditti Network Security Co. in Parma, Italy.
Visit this site to download Swatch, a log analyzer, and Tripwire, a file-integrity checker program.
We also run Internet Scanner from Atlanta-based Internet Security Systems Inc. (ISS). Internet Scanner can do exactly what Nmap can do and much more. The big difference between the tools - apart from the fact that Nmap is free and Internet Scannerr most certainly isn't - is the slant each puts on this function.
The ISS tool gives a much more user-friendly graphical user interface (GUI), advertises its presence to anyone being scanned and so on. It's clearly designed to fit into a corporate environment.
Nmap, on the other hand, is designed for technical staffers who want to dispense with the frills: It's much faster, and it's designed to be run in "stealth mode" so as to avoid detection by intrusion detection software. It certainly snuck in beneath the radar of our intrusion detection software, RealSecure from ISS. That's something we'll have to sort out.
Sniffing for Hack Attacks
Next up was Sniffit, a network packet sniffer. Packet sniffers are rather intriguingly named pieces of software that monitor network traffic.
Under many networking protocols, data that you transmit gets split into small segments, or packets, and the Internet Protocol address of the destination computer is written into the header of each packet. These packets then get passed around by routers and eventually make their way to the network segment that contains the destination computer.