n0t
Aloha,
I'd like to announce version 1.86 of n0t - network 0S tracer
In short n0t is an easy to use sniffer with remote OS and NAT
detection, simple IDS (NMap, XMAS, NULL scans), output
configuration scripts (very useful for really big traffic)
and BPF filter (tcpdump-style).
I believe discussion will help in process of debugging and
developing next versions of this tool. Please send any comments,
suggestions and (what's probably the most important) new OS
fingerprints to n0t database.
Also, please send any information about successful or unsuccessful
attempts of compiling/launching n0t on different platforms.
n0t in action:
(root!osiris ~/n0t)# ./n0t -c n0t-sample.out -i ppp0 -S
n0t - network 0S tracer, version 1.86
(c) Marcin Ulikowski <r3b00t@xxxxxxxx>
n0t: parsed 156 signatures in 'n0t.fp'
n0t: listening on 'ppp0'
22:30:46 83.28.253.45:1145 -> 217.153.145.198:80 [.S....]
LEN:48 TTL:64 WSS:5840 DF (0 hops)
OS: Linux 2.4
22:30:57 83.28.253.45:2563 -> 216.136.204.117:80 [.S....] (NAT)
LEN:60 TTL:63 WSS:57344 DF (1 hops)
OS: FreeBSD 4.6 - 4.9
caught SIGINT(2) signal, exiting... (2 packets, 108 bytes read)
Newest version is always available at
http://r3b00t.itsec.pl/n0t/n0t-latest.tgz
--
----------------------------------------------
Marcin Ulikowski && http://r3b00t.itsec.pl/
Accidents are accidents only to ignorance
-------------------- `kill${IFS}-9${IFS}-1` --