Comments on: CDPSnarf – CDP Packet Sniffer

By: dentonj

dentonj — Sun, 03 Aug 2008 15:56:55 +0000

@yoshi

From the code, CDPSnarf supports more CDP value types than cdpr.

By: Umesh Chaurasia

Umesh Chaurasia — Tue, 29 Jul 2008 10:53:18 +0000

Hi,

I want to capture CDP packets from windows environment. I downloaded you CDPSnarf sample.
I also downloded getopt.c and getopt.h file from some other website.
I am able to comile CDPSnarf application by commenting 2 lines //#include
//#include

In place of unistd.h, i am using getopt.h.

When I am running my binary I am getting “unable to open Adapter” error. Following is the error details.
———————————————————-

C:\Documents and Settings\umesh.c.PARSEC>D:\SW\CDPSnarf-v0.1.6\CDPSnarf-v0.1.6\R
elease\cdpsnarf.exe -i CDP
CDPSnarf v0.1.6 [$Rev: 797 $] initiated.
Author: Zapotek
Website: http://www.segfault.gr

Couldn’t open device CDP: Error opening adapter: The system cannot find the device specified. (20)

————————————————————–

Can you please suggest what I am doing wrong?

Regards,
Umesh

By: Reticent

Reticent — Sun, 04 May 2008 00:37:47 +0000

true. I usually capture stuff using tcpdump and write it to a file I open with wireshark; tcpdump gives you lots of nice options so you only end up with the traffic you wan’t to analyse (so it still suitable on busy networks). Alternatively, using the -A flag means you get to see the clear text protocols without using any sort of specialised tool anyway.

Sorta offtopic, does anyone know a urlsnarf type application which is able to reconstruct html pages. Ie I run the tool and it’s able to write html pages locally as it see’s them? Wouldn’t mind having a play with such a tool.

By: yoshi

yoshi — Fri, 02 May 2008 21:02:36 +0000

nothing new here – cdpr has been doing this for years

By: Bogwitch

Bogwitch — Fri, 02 May 2008 08:47:00 +0000

@Reticent,
I was talking specifically about capture filters rather than view filters. Sure, it can filter the view of cdp packets but the background capture is still capturing more packets than are specifically required. On a heavily loaded network, Wireshark can start running out of memory pretty fast if it is capturing large numbers of packets.
Don’t get me wrong, wireshark is an exellent product and I use it often. If they could narrow the capture filters the same way that they narrow the view filters, I would probably use it even more!

By: Reticent

Reticent — Fri, 02 May 2008 03:40:15 +0000

@Bogwitch: I think you’ll find typing ‘cdp’ in the filter will do exactly that.

By: watcher

watcher — Thu, 01 May 2008 15:33:54 +0000

its nice to have something small like this, just think of how easy it is to see someone using wireshark or some other bandwidth hog, now try this one.

By: Bogwitch

Bogwitch — Thu, 01 May 2008 11:18:17 +0000

@Giacomo

Yes, Wireshark will discover this information but you cannot set a capture filter for JUST this information.
It’s the same as the dsniff tools, it has a much smaller footprint and performs a single task. I use the mailsnarf and urlsnarf utilities from dsniff on a regular basis for constant monitoring when Wireshark would be overkill.

By: Giacomo

Giacomo — Thu, 01 May 2008 00:12:02 +0000

I think ethereal/wireshark is enought to discover this infos, without any other extra tool, isn’t it ?

By: ZaD MoFo

ZaD MoFo — Wed, 30 Apr 2008 22:32:29 +0000

I must admit: I’am kinda addicted to this site…

Thank you http://www.darknet.org.uk !
You have a very informative website. I come to visit periodically and whenever I visit each time I learn new tricks & tools.

By the way: shutdown day this saturday…

My best regards.

ZaD MoFo