Re: SSH bruteforce on its way...

Hello Michael,

In the wise words of Michael.Lang@jackal-net.at, on Tuesday 25 October 2005 
09:29:
[SNIP]
> I've put the session data on a website
> (http://www.jackal-net.at/tiki-read_article.php?articleId=20)  where you can
> see what i've setup and what the guys where doing. (currently only one
> session is online but i'm sure, others will follow :) ... )   
Just had a look at that page, and I would recommend against using ethereal to 
capture traffic: there are too many vulnerabilities in ethereal's decoders (a 
few have been disclosed last week) to allow that program to run unattended as 
root (needed to capture traffic). Instead, I always recommend to use tcpdump:
 tcpdump -s 1500 -w traffic.trace port 22
(in your case you're only interested in ssh traffic, aren't you? otherwise, 
just skip the 'port 22' part).

Then, *as a normal user*, open the trace file with ethereal if you don't like 
tcpdump's output of
 tcpdump -s 1500 -r traffic.trace -X

Regards,

Lionel

-- 
"To understand how progress failed to make our lives easier,
please press 3"

Lionel Ferette
BELNET CERT Coordinator

Tel: +32 2 7903385                  http://cert.belnet.be/
Fax: +32 2 7903375                  PGP Key Id: 0x5662FD4B

pgpYheX415YEy.pgp
Description: PGP signature