Tool: NeoTrace (Now McAfee Visual Trace)

NeoTrace is a diagnostic and investigative tool. It traces the network path across the Internet from the host system to a target system anywhere on the Internet. Automatic retrieval of data includes registration details for the owner of each computer on the route (address, phone, email address) and the network each node IP is registered to. Easy to read views of the data include a world map showing the locations of nodes along the route, a graph showing the relative response time of each node along the path, and a configurable list of node data.

In the screenshot shown above, we have done a traceroute for www.google.com The 3.20 version had node view, map view and list view. Note that the DNS entries have been retrieved for the various nodes and the map view allows the user to see relatively easily if a particular system is based geographically where it claims to be.

There are two aspects to traceroute - depth and breadth. There are two basic methods for searching graphs - breadth and depth. Breadth searches branch out examining all nodes within a certain hop distance, slowly increasing until the destination is discovered. Depth first search follows one path until it is exhausted, and then backs up slowly recalculating all the permutations of the preceding paths. Traceroute generates an UDP message to an unused port and sends this message with an increasing TTL value. The search ends when a port unreachable message is received.


There are many ICMP error messages that can be generated. One of these messages is ICMP port unreachable (since ports exist in TCP or UDP). However, the port unreachable message must be distinguished from such messages generated from different applications - such as from a packet filtering device

Tool: VisualRoute Trace

VisualRoute is a graphical tool that determines where and how traffic is flowing on the route between the desired destination and the user trying to access it, by providing a geographical map of the route, and the performance on each portion of that route.

VisualRoute delivers the functionality of key Internet "ping," "whois," and "traceroute" tools, in a visually integrated package. In addition, VisualRoute has the ability to identify the geographical location of routers, servers, and other IP devices. This is valuable information for identifying the source of network intrusions and Internet abusers. It helps in establishing the identify of the originating network, the web software that a server is running, detecting routing loops and identifying hosts that have the ICMP TTL bug.

VisualRoute's traceroute provides three types of data: an overall analysis, a data table, and a geographical view of the routing. The analysis is a brief description in of the number of hops, areas where problems occurred, and the type of Web server software running at the destination site. The data table lists information for each hop, including the IP address, node name, geographical location and the major Internet backbone where each server resides.

The World map gives a graphical representation of the actual path of an Internet connection. Users can zoom in/out and move the map around to position it as desired. A mouse click on a server or network name opens a pop-up window with the whois information including name, telephone and email address, providing instant contact information for problem reporting.

The screenshot above shows traceroute done to www.google.com VisualRoute can be downloaded at http://www.visualware.com/download

Tool: SmartWhois

SmartWhois is a network information utility that allows the user to find all the available information about an IP address, hostname, or domain, including country, state or province, city, name of the network provider, administrator and technical support contact information.

Unlike standard Whois utilities, SmartWhois can find the information about a computer located in any part of the world, intelligently querying the right database and delivering all the related records in a short time. The program can retrieve information from more than 20 servers all over the world. SmartWhois can also save obtained information to an archive file. This is particularly useful in tracking incidents and incident handling. It allows users to load this archive the next time the program is launched and add more information to it. Thus, the list is updated on a regular basis. This feature allows building and maintaining a user defined database of IP addresses and hosting names. Alternatively, users can also load a list of IP addresses as a text file and have SmartWhois process the whole list. SmartWhois is available for download at www.tamos.com SmartWhois is capable of performing both IP address/hostname and domain name queries. TamoSoft, Inc. also hosts a tools interface at http://all-nettools.com/tools1.htm

---

Share

0digg

.

Tools-Visual Lookout

Visual Lookout provides high level views as well as detailed and historical views that provide traffic information in real-time or on a historical basis.

In addition the user can request a "connections" window for any server, which provides a real-time view of all the active network connections showing

who is connected,

what service is being used,

whether the connection is inbound or outbound, and

how many connections are active and how long they have been connected.

Traffic is an important measure when identifying possible hacker attacks or even Denial of Service (DOS) attacks. A change in traffic patterns from normal values is an important first clue to possible unwanted visitors. Visual Lookout provides the ability to view any of the important traffic metrics as a graphical representation both from a real-time and historical perspective. Visual Lookout provides the ability to capture connection activity for any server or computer system that it is monitoring. The search feature locates any connection activity based on inbound or outbound port or IP address/domain name, and can replay the history period of interest as though the session were in real time.

Share

0digg

.

Release Neopwn: Pocket Pentesting

The NeoPwn network auditng system's core is a modified Linux 2.6.24 kernel, with cross-compiled module driver support for the numerous compatible addon devices running on a FULL Debian (ARMEL) operating system.The filesystem has been optimized for performance and size and includes the NeoPwn menu system and several GUI dialogs for hardware control and attack automation.Simplifying the process of performing... 

Blue Screen of Death as Screensaver

Make your co-worker think their PC crashed when they get back from lunch. The BSOD ("Blue Screen of Death") screensaver is a free download from Microsoft (ironically.) For other operating system "support," check out theLinux BSOD 'saver with support for Apple, Windows, and Linux crash screen...

Hacking Domino

For the last three years I've been sitting on a draft article, with the working title Domino Security by Obscurity, which I've always been in two minds about publishing. The methods it talks about display a considerable security flaw in Domino. Well, at least in the way applications are developed. Domino is, as we all know, as secure...