🚀 go-pugleaf

Ian Stirling <0000352FECBD.NO_UCE@mauve.demon.co.uk> wrote in article
<0000352FECBD.NO_UCE@mauve.demon.co.uk>...
> Anyone know how to take raw bytestreams, and produce a tcpdump-like
> dump of the packets going over a PPP connection? Preferably without
> having to write a PPP stack.
> I'm trying to reverse engineer the protocols used to talk to an online
> service, so I can make a linux client.
> It's currently running on windows.

The easy way to do this would be to download the telnet specification
RFC's.

I was writing a client similar to this but I knocked it on the head a while
ago.

The telnet stuff for port 23 (the default for unspecified) on Linux is a
different protocol.  Things like mail (25 / 110) and news (119) are just 7
bit ASCII.

TB

Ian Stirling <0000352FECBD.NO_UCE@mauve.demon.co.uk> wrote:
> 
> Anyone know how to take raw bytestreams, and produce a tcpdump-like
> dump of the packets going over a PPP connection? Preferably without
> having to write a PPP stack.
> I'm trying to reverse engineer the protocols used to talk to an online
> service, so I can make a linux client.
> It's currently running on windows.
> 
> I can get bytestreams easily, by making up the appropriate cables,
> to take RX/TX to two ports on another PC.
> OS I'm running on is linux, but a 95 solution would be fine.

You can download a program called tcplog which accesses RAW IP data.
It'd be easy to modify this to look at and dump the ports that you
are interested in.

Paul

Tom Bird <hamster@nospam.demon.co.uk> wrote:
: Ian Stirling <0000352FECBD.NO_UCE@mauve.demon.co.uk> wrote in article
: <0000352FECBD.NO_UCE@mauve.demon.co.uk>...
:> Anyone know how to take raw bytestreams, and produce a tcpdump-like
:> dump of the packets going over a PPP connection? Preferably without
:> having to write a PPP stack.
:> I'm trying to reverse engineer the protocols used to talk to an online
:> service, so I can make a linux client.
:> It's currently running on windows.

: The easy way to do this would be to download the telnet specification
: RFC's.

I know how to do telnet, ... that's not the problem, I'm trying to 
work out when/where some out of band data is being sent.

: I was writing a client similar to this but I knocked it on the head a while
: ago.

: The telnet stuff for port 23 (the default for unspecified) on Linux is a
: different protocol.  Things like mail (25 / 110) and news (119) are just 7
: bit ASCII.

I wrote a news-server once.
About 50 lines of awk IIRC, with integrated slurper.
Not that bad performance, though it was only tested with a couple 
of readers.
Annoyingly, I don't have access to the code any more.

-- 
Ian Stirling.   Designing a linux PDA, see  http://www.mauve.demon.co.uk/
----- ******* If replying by email, check notices in header ******* -----
What a wonderfull world it is that has girls in it!     Robert A Heinlein.

Ian Stirling <00003530BE5B.NO_UCE@mauve.demon.co.uk> wrote in article
<00003530BE5B.NO_UCE@mauve.demon.co.uk>...
> Tom Bird <hamster@nospam.demon.co.uk> wrote:
> : Ian Stirling <0000352FECBD.NO_UCE@mauve.demon.co.uk> wrote in article
> : <0000352FECBD.NO_UCE@mauve.demon.co.uk>...
> :> Anyone know how to take raw bytestreams, and produce a tcpdump-like
> :> dump of the packets going over a PPP connection? Preferably without
> :> having to write a PPP stack.
> :> I'm trying to reverse engineer the protocols used to talk to an online
> :> service, so I can make a linux client.
> :> It's currently running on windows.
> 
> : The easy way to do this would be to download the telnet specification
> : RFC's.
> 
> I know how to do telnet, ... that's not the problem, I'm trying to 
> work out when/where some out of band data is being sent.

Like the 'wrapper' around the packet?

e.g. #packet header# --- D A T A --- #packet end#

and you want to see inside the header and end?

Dunno how / why you'd want to do that.

TB

In article <0000352FECBD.NO_UCE@mauve.demon.co.uk>,
Ian Stirling  <0000352FECBD.NO_UCE@mauve.demon.co.uk> wrote:
>Anyone know how to take raw bytestreams, and produce a tcpdump-like
>dump of the packets going over a PPP connection? Preferably without
>having to write a PPP stack.
>I'm trying to reverse engineer the protocols used to talk to an online
>service, so I can make a linux client.
>It's currently running on windows.
>
>I can get bytestreams easily, by making up the appropriate cables,
>to take RX/TX to two ports on another PC.
>OS I'm running on is linux, but a 95 solution would be fine.

Sounds like you need SerialView, our $399 async PPP protocol analyzer
that does exactly what you're asking for.  It decodes LCP, PAP, CHAP,
SPAP, MSCHAP, IPCP, IPXCP, NBFCP, etc., as well as TCP/UDP/IP, SNMP,
IPX/SPX/NCP, and more.  Check out our site (http://www.klos.com/), call
or email if you have any questions.
============================================================================
    Patrick Klos                           Email: klos@klos.com
    Klos Technologies, Inc.                Voice: (603) 424-8300
    604 Daniel Webster Highway             FAX:   (603) 424-9300
    Merrimack, New Hampshire  03054        Web:   http://www.klos.com/
============================================================================

In demon.tech.unix Ian Stirling <0000352FECBD.NO_UCE@mauve.demon.co.uk> wrote:
> Anyone know how to take raw bytestreams, and produce a tcpdump-like
> dump of the packets going over a PPP connection? Preferably without
> having to write a PPP stack.

If it's convenient to setup, you could use FreeBSD's 
(http://www.freebsd.org) built-in support for ppp connections
in tcpdump. i.e. with FreeBSD

tcpdump -i tun0

shows all packets passing through the tun0 (ppp) interface.

Mark Blackman

Mark Blackman <tmb@maddog.u-net.com> wrote:
: In demon.tech.unix Ian Stirling <0000352FECBD.NO_UCE@mauve.demon.co.uk> wrote:
:> Anyone know how to take raw bytestreams, and produce a tcpdump-like
:> dump of the packets going over a PPP connection? Preferably without
:> having to write a PPP stack.

: If it's convenient to setup, you could use FreeBSD's 
: (http://www.freebsd.org) built-in support for ppp connections
: in tcpdump. i.e. with FreeBSD

: tcpdump -i tun0

: shows all packets passing through the tun0 (ppp) interface.

Indeed, that would work if I had access to the server, and it was running
FreeBSD.
However, I'm trying to transparently snoop on the connection, so
any solution that involves connecting in another PPP stack will fail,
as it makes it non-transparent.

-- 
Ian Stirling.   Designing a linux PDA, see  http://www.mauve.demon.co.uk/
----- ******* If replying by email, check notices in header ******* -----
Two parrots sitting on a perch. One asks the other, "Can you smell fish?"

Tom Bird <hamster@nospam.demon.co.uk> wrote:
: Ian Stirling <00003530BE5B.NO_UCE@mauve.demon.co.uk> wrote in article
: <00003530BE5B.NO_UCE@mauve.demon.co.uk>...
:> Tom Bird <hamster@nospam.demon.co.uk> wrote:
:> : Ian Stirling <0000352FECBD.NO_UCE@mauve.demon.co.uk> wrote in article
:> : <0000352FECBD.NO_UCE@mauve.demon.co.uk>...
:> :> Anyone know how to take raw bytestreams, and produce a tcpdump-like
:> :> dump of the packets going over a PPP connection? Preferably without
:> :> having to write a PPP stack.
:> :> I'm trying to reverse engineer the protocols used to talk to an online
:> :> service, so I can make a linux client.
:> :> It's currently running on windows.
:> 
:> : The easy way to do this would be to download the telnet specification
:> : RFC's.

:> I know how to do telnet, ... that's not the problem, I'm trying to 
:> work out when/where some out of band data is being sent.

: Like the 'wrapper' around the packet?

: e.g. #packet header# --- D A T A --- #packet end#

: and you want to see inside the header and end?

: Dunno how / why you'd want to do that.

I want to determine how a 95 box logs into an oddball server, so I can
clone it, and get a linux version of the client up and working.
Hence, some of the obvious solutions, such as tcpdump, ...
won't work, as they all only work  on the server, which I don't have
access to.
I seem to have found a program which purports to do a tcpdumpalike for
95, don't know how that will work.


-- 
Ian Stirling.   Designing a linux PDA, see  http://www.mauve.demon.co.uk/
----- ******* If replying by email, check notices in header ******* -----
"The device every conquerer, yes, every altruistic liberator should be required
to wear on his shield... is a little girl and her kitten, at ground zero"
Sir Dominic Flandry in Poul Anderson's A Knight of Ghosts and Shadows

Ian Stirling <0000353265BF.NO_UCE@mauve.demon.co.uk> wrote in article
<0000353265BF.NO_UCE@mauve.demon.co.uk>...

> I want to determine how a 95 box logs into an oddball server, so I can
> clone it, and get a linux version of the client up and working.
> Hence, some of the obvious solutions, such as tcpdump, ...
> won't work, as they all only work  on the server, which I don't have
> access to.
> I seem to have found a program which purports to do a tcpdumpalike for
> 95, don't know how that will work.

You've been beaten to it - do an altavista on 'Samba' - it's a MS
networking client / server for Unix.

TB

Tom Bird <hamster@nospam.demon.co.uk> wrote:
: Ian Stirling <0000353265BF.NO_UCE@mauve.demon.co.uk> wrote in article
: <0000353265BF.NO_UCE@mauve.demon.co.uk>...

:> I want to determine how a 95 box logs into an oddball server, so I can
:> clone it, and get a linux version of the client up and working.
:> Hence, some of the obvious solutions, such as tcpdump, ...
:> won't work, as they all only work  on the server, which I don't have
:> access to.
:> I seem to have found a program which purports to do a tcpdumpalike for
:> 95, don't know how that will work.

: You've been beaten to it - do an altavista on 'Samba' - it's a MS
: networking client / server for Unix.

Sorry, I'm not looking for samba, I have it installed, unless there is 
some way to do PPP snooping on a client using SMB, which I doubt.

-- 
Ian Stirling.   Designing a linux PDA, see  http://www.mauve.demon.co.uk/
----- ******* If replying by email, check notices in header ******* -----
Two parrots sitting on a perch. One asks the other, "Can you smell fish?"

Tom Bird <hamster@nospam.demon.co.uk> wrote:
: Ian Stirling <00003543B9B2.NO_UCE@mauve.demon.co.uk> wrote in article
: <00003543B9B2.NO_UCE@mauve.demon.co.uk>...
:> Tom Bird <hamster@nospam.demon.co.uk> wrote:
:> : Ian Stirling <0000353476BF.NO_UCE@mauve.demon.co.uk> wrote in article
:> : <0000353476BF.NO_UCE@mauve.demon.co.uk>...
:> 
:> :> Sorry, I'm not looking for samba, I have it installed, unless there is

:> :> some way to do PPP snooping on a client using SMB, which I doubt.
:> 
:> : I've had a new idea on this - get a modem and plug it into another
:> : machine's COM1.  Next, run a null modem cable from machine 2 to the
<snip>
:> 
:> This is the easy bit, trivially done with the correct cabling.
:> The hard bit is decoding this data into something usefull.

: Also, there is IIRC, an option on PPPD to dieplay all packets... I think.

If I had access to the server, and it was running linux, that would work,
but I'm trying to monitor the data connection between a 95 box, and
a remote server, that I don't have access to.
I may have found a 95 program which can do this, I have yet to get it setup
though, been busy.

: Shouldn't it go <packet header> DATA <packet end> or something like that...
: you can probably get a book on PPP.

I know, I'd like to avoid doing that.

-- 
Ian Stirling.   Designing a linux PDA, see  http://www.mauve.demon.co.uk/
----- ******* If replying by email, check notices in header ******* -----
Among a man's many good possessions, A good command of speech has no equal.