Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                

Remote Monitoring System For Cyber Forensic

Download as rtf, pdf, or txt
Download as rtf, pdf, or txt
You are on page 1of 9

How to obtain network information

programetically ?
---- >
Network Commands :

TRACEROUTE COMMAND :
Traceroute command is a very useful network diagnostic tool. Traceroute displays each
host that a packet travels through as it tries to reach its destination. We can see how many
“hops” from the Slackware web site you are with this command:
% traceroute www.slackware.com
Each host will be displayed, along with the response times at each host. Here is an
example output:
% traceroute www.slackware.com
traceroute to www.slackware.com (204.216.27.13), 30 hops max, 40 byte packets
1 zuul.tdn (192.168.1.1) 0.409 ms 1.032 ms 0.303 ms
2 207.171.227.254 (207.171.227.254) 18.218 ms 32.873 ms 32.433 ms
3 border-sf-2-0-4.sirius.com (205.134.230.254) 15.662 ms 15.731 ms 16.142 ms
4 pb-nap.crl.net (198.32.128.20) 20.741 ms 23.672 ms 21.378 ms
5 E0-CRL-SFO-03-E0X0.US.CRL.NET (165.113.55.3) 22.293 ms 21.532 ms 21.29 ms
6 T1-CDROM-00-EX.US.CRL.NET (165.113.118.2) 24.544 ms 42.955 ms 58.443 ms
7 www.slackware.com (204.216.27.13) 38.115 ms 53.033 ms 48.328 ms
traceroute is similar to ping in that it uses ICMP packets.

DNS Tools
Domain Name Service (DNS for short) is that magical protocol that allows your
computer to turn meaningless domain names like www.slackware.com into meaningful
IP address like 64.57.102.34. Computers can't route packets to www.slackware.com, but
they can route packets to that domain name's IP address. This gives us a convenient way
to remember machines. Without DNS we'd have to keep a mental database of just what
IP address belongs to what computer, and that's assuming the IP address doesn't change.
Clearly using names for computers is better, but how do we map names to IP addresses?

host
host(1) can do this for us. host is used to map names to IP addresses. It is a very quick
and simple utility without a lot of functions.
% host www.slackware.com
www.slackware.com is an alias for slackware.com.
slackware.com has address 64.57.102.34
dig
The meanest dog in the pound, the domain information groper, dig(1) for short, is the go-
to program for finding DNS information. dig can grab just about anything from a DNS
server including reverse lookups, A, CNAME, MX, SP, and TXT records.
% dig @192.168.1.254 www.slackware.com mx

; <<>> DiG 9.2.2 <<>> @192.168.1.254 www.slackware.com mx


;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26362
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;www.slackware.com. IN MX

;; ANSWER SECTION:
www.slackware.com. 76634 IN CNAME slackware.com.
slackware.com. 86400 IN MX 1 mail.slackware.com.

;; AUTHORITY SECTION:
slackware.com. 86400 IN NS ns1.cwo.com.
slackware.com. 86400 IN NS ns2.cwo.com.

;; ADDITIONAL SECTION:
ns1.cwo.com. 163033 IN A 64.57.100.2
ns2.cwo.com. 163033 IN A 64.57.100.3

;; Query time: 149 msec


;; SERVER: 192.168.1.254#53(192.168.1.254)
;; WHEN: Sat Nov 6 16:59:31 2004
;; MSG SIZE rcvd: 159
This should give you an idea how dig works. “@192.168.1.254” specifies the dns server
to use. “www.slackware.com” is the domain name I am performing a lookup on, and
“mx” is the type of lookup I am performing. The above query tells me that e-mail to
www.slackware.com will instead be sent to mail.slackware.com for delivery.

finger Command
finger will retrieve information about the specified user. You give finger a username or
an email address and it will try to contact the necessary server and retrieve the username,
office, telephone number, and other pieces of information. Here is an example:
% finger johnc@idsoftware.com
finger can return the username, mail status, phone numbers, and files referred to as “dot
plan” and “dot project”. Of course, the information returned varies with each finger
server. The one included with Slackware returns the following information by default:
• Username

• Room number

• Home phone number

• Work phone number

• Login status

• Email status

• Contents of the .plan file in the user's home directory

• Contents of the .project file in the user's home directory


The first four items can be set with the chfn command. It stores those values in the
/etc/passwd file. To change the information in your .plan or .project file, just edit them
with your favorite text editor. They must reside in your home directory and must be
called .plan and .project.
Many users finger their own account from a remote machine to quickly see if they have
new email. Or, you can see a user's plan or current project.

telnet
Telnet allows you to log in to a computer, just as if you were sitting at the terminal. Once
your username and password are verified, you are given a shell prompt. From here, you
can do anything requiring a text console. Compose email, read newsgroups, move files
around, and so on. If you are running X and you telnet to another machine, you can run X
programs on the remote computer and display them on yours.
To login to a remote machine, use this syntax:
% telnet <hostname>
If the host responds, you will receive a login prompt. Give it your username and
password. That's it. You are now at a shell. To quit your telnet session, use either the exit
command or the logout command.
telnet does not encrypt the information it sends. Everything is sent in plain text, even
passwords. It is not advisable to use telnet over the Internet. Instead, consider the Secure
Shell. It encrypts all traffic and is available for free.

The other use of telnet


You can also use the telnet command to connect to a host on a certain port.
% telnet <hostname> [port]
This can be quite handy when you quickly need to test a certain service, and you need full
control over the commands, and you need to see what exactly is going on. You can
interactively test or use an SMTP server, a POP3 server, an HTTP server, etc. this way.
In the next figure you'll see how you can telnet to a HTTP server on port 80, and get
some basic information from it.
Figure 13-1. Telnetting to a webserver
% telnet store.slackware.com 80
Trying 69.50.233.153...
Connected to store.slackware.com.
Escape character is '^]'.
HEAD / HTTP/1.0

HTTP/1.1 200 OK
Date: Mon, 25 Apr 2005 20:47:01 GMT
Server: Apache/1.3.33 (Unix) mod_ssl/2.8.22 OpenSSL/0.9.7d
Last-Modified: Fri, 18 Apr 2003 10:58:54 GMT
ETag: "193424-c0-3e9fda6e"
Accept-Ranges: bytes
Content-Length: 192
Connection: close
Content-Type: text/html

Connection closed by foreign host.


%

netstat
Displays contents of /proc/net files. It works with the Linux Network Subsystem, it
will tell you what the status of ports are ie. open, closed, waiting, masquerade
connections. It will also display various other things. It has many different options.

tcpdump
This is a sniffer, a program that captures packets off a network interface and
interprets them for you. It understands all basic internet protocols, and can be used to
save entire packets for later inspection.

nmap
“ network exploration tool and security scanner”. nmap is a very advanced network
tool used to query machines (local or remote) as to whether they are up and what
ports are open on these machines.
A simple usage example:
nmap machine_name
This would query your own machine as to what ports it keeps open. nmap is a very
powerful tool, documentation is available on the nmap site as well as the information
in the manual page.

ifconfig
This command is used to configure network interfaces, or to display their current
configuration. In addition to activating and deactivating interfaces with the “up” and
“down” settings, this command is necessary for setting an interface's address
information if you don't have the ifcfg script.

route
The route command is the tool used to display or modify the routing table. To add a
gateway as the default you would type:
route add default gw some_computer

How to Ping a machine programmatically


using Windows Forms
The ‘Ping’ class in the System.Net.NetworkInformation namespace provides
functionality to determine if a remote machine can be accessed over a network. In
this article, we will use the methods and properties of the ‘Ping’ class to determine
availability of a machine.

The ‘Ping’ class is similar to the Ping.exe tool. You can send an Internet Control
Message Protocol (ICMP) echo request using both synchronous and asynchronous
methods of the ‘Ping’ class. The Send() method is a synchronous method and returns
a ‘PingReply’ containing the results of an ICMP request. It blocks the application
while waiting for a reply. The SendAsync() is an asynchronous method which uses a
separate thread to send the request. The ‘PingCompleted’ event is raised when the
operation completes and you can use the ‘PingCompletedEventHandler’ delegate to
handle it.

Let us see how to use these classes to send a request both synchronously and
asynchronously:

Use the namespace System.Net.NetworkInformation

C#

using System.Net.NetworkInformation;

VB.NET

Imports System.Net.NetworkInformation

Using the Send() method:


C#

string mac = "www.dotnetcurry.com"; // use any other machine name

Ping pingreq = new Ping();

PingReply rep = pingreq.Send(mac);

Console.WriteLine("Pinging {0} [{1}]", mac, rep.Address.ToString());

Console.WriteLine("Reply From {0} : time={1} TTL={2}",

rep.Address.ToString(), rep.RoundtripTime, rep.Options.Ttl );

Console.ReadLine();

Using the SendAsync() method:

C#

System.Threading.AutoResetEvent autores = new System.Threading.AutoResetEvent(false);

string mac = "www.dotnetcurry.com";

Ping pingasync = new Ping();

pingasync.PingCompleted += new PingCompletedEventHandler(PingCompletedMethod);

pingasync.SendAsync(mac, "ping");

autores.WaitOne();

private static void PingCompletedMethod(object sender, PingCompletedEventArgs e)

PingReply rep = e.Reply;

Console.WriteLine("Pinging {0}", rep.Address.ToString());

Console.WriteLine("Reply From {0} : time={1} TTL={2}",

rep.Address.ToString(), rep.RoundtripTime, rep.Options.Ttl);

Console.ReadLine();

if(e.Error != null)

Console.WriteLine("Ping was not successful");

Console.WriteLine(e.Error.ToString());

}
WINIPCFG
The winipcfg command available in Windows allows a user to display network and
network adapter information. Here, a user can find such information as an IP address,
Subnet Mask, Gateway, etc...

TCP Socket Component


A socket is an end point in network communication, it is uniquely identified by an ip
address and a port number. TCP/IP is the most common protocol used for inter-process
communication.

What we want to know about our


computer
The complete list of categories is Bios, Components, Computer, CPU, DateAndTime,
Desktop, Drivers, Drives, EnvironmentVariables, EventViewer, FileTypes, Fonts,
InstalledPrograms, Introduction, Keyboard, MultimediaCodecs, Network,
OEMInformation, OperatingSystem, PointingDevice, Ports, Processes, Services,
Shares, Sound, SpecialFolders, StartupPrograms, UsbDevices, UserInformation,
Video, VisualStyles, Win32Explorer Hardware, Win32Explorer Memory,
Win32Explorer Network, Win32Explorer Storage, Win32Explorer System, and
Win32Explorer Users.

Retrieving MAC address programmatically


You could install libnet and use libnet_get_hwaddr().

NETWORK PROCESSES
The basic function for creating network connections and network servers is make-
network-process.

Function: make-network-process &rest args

:name name
Use the string name as the process name. It is modified if necessary to make it
unique.
:type type
Specify the communication type. A value of nil specifies a stream connection (the
default); datagram specifies a datagram connection; seqpacket specifies a
“sequenced packet stream” connection. Both connections and servers can be of these
types.
:server server-flag
If server-flag is non-nil, create a server. Otherwise, create a connection. For a stream
type server, server-flag may be an integer which then specifies the length of the
queue of pending connections to the server. The default queue length is 5.
:host host
Specify the host to connect to. host should be a host name or Internet address, as a
string, or the symbol local to specify the local host. If you specify host for a server,
it must specify a valid address for the local host, and only clients connecting to that
address will be accepted.
:service service
service specifies a port number to connect to, or, for a server, the port number to
listen on. It should be a service name that translates to a port number, or an integer
specifying the port number directly. For a server, it can also be t, which means to let
the system select an unused port number.
:family family
family specifies the address (and protocol) family for communication. nil means
determine the proper address family automatically for the given host and service.
local specifies a Unix socket, in which case host is ignored. ipv4 and ipv6 specify
to use IPv4 and IPv6 respectively.
:local local-address
For a server process, local-address is the address to listen on. It overrides family, host
and service, and you may as well not specify them.
:remote remote-address
For a connection, remote-address is the address to connect to. It overrides family,
host and service, and you may as well not specify them.
:nowait bool
If bool is non-nil for a stream connection, return without waiting for the connection
to complete. When the connection succeeds or fails, Emacs will call the sentinel
function, with a second argument matching "open" (if successful) or "failed". The
default is to block, so that make-network-process does not return until the
connection has succeeded or failed.
:stop stopped
Start the network connection or server in the `stopped' state if stopped is non-nil.

:buffer buffer
Use buffer as the process buffer.
:coding coding
Use coding as the coding system for this process. To specify different coding systems
for decoding data from the connection and for encoding data sent to it, specify
(decoding . encoding) for coding.

:noquery query-flag
Initialize the process query flag to query-flag. See Query Before Exit.
:filter filter
Initialize the process filter to filter.
:sentinel sentinel
Initialize the process sentinel to sentinel.
:log log
Initialize the log function of a server process to log. The log function is called each
time the server accepts a network connection from a client. The arguments passed to
the log function are server, connection, and message, where server is the server
process, connection is the new process for the connection, and message is a string
describing what has happened.
:plist plist
Initialize the process plist to plist.

A TDI filter driver to collect the stats, a service which communicates with the driver
and gets the stats once per second.

You might also like