CDPSnarf – CDP Packet Sniffer

Use Netsparker


CDPSnarf if a network sniffer exclusively written to extract information from CDP packets. It provides all the information a “show cdp neighbors detail” command would return on a Cisco router and even more.

The application is written in C using the popular PCAP library.

Sample Output

Cisco AIR-AP1231G-E-K9 Access Point:

You can download CDPSnarf here:

CDPSnarf 0.1.6

Or read more here.

Posted in: Hacking Tools, Networking Hacking

, , ,


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


10 Responses to CDPSnarf – CDP Packet Sniffer

  1. ZaD MoFo April 30, 2008 at 10:32 pm #

    I must admit: I’am kinda addicted to this site…

    Thank you http://www.darknet.org.uk !
    You have a very informative website. I come to visit periodically and whenever I visit each time I learn new tricks & tools.

    By the way: shutdown day this saturday…

    My best regards.

    ZaD MoFo

  2. Giacomo May 1, 2008 at 12:12 am #

    I think ethereal/wireshark is enought to discover this infos, without any other extra tool, isn’t it ?

  3. Bogwitch May 1, 2008 at 11:18 am #

    @Giacomo

    Yes, Wireshark will discover this information but you cannot set a capture filter for JUST this information.
    It’s the same as the dsniff tools, it has a much smaller footprint and performs a single task. I use the mailsnarf and urlsnarf utilities from dsniff on a regular basis for constant monitoring when Wireshark would be overkill.

  4. watcher May 1, 2008 at 3:33 pm #

    its nice to have something small like this, just think of how easy it is to see someone using wireshark or some other bandwidth hog, now try this one.

  5. Reticent May 2, 2008 at 3:40 am #

    @Bogwitch: I think you’ll find typing ‘cdp’ in the filter will do exactly that.

  6. Bogwitch May 2, 2008 at 8:47 am #

    @Reticent,
    I was talking specifically about capture filters rather than view filters. Sure, it can filter the view of cdp packets but the background capture is still capturing more packets than are specifically required. On a heavily loaded network, Wireshark can start running out of memory pretty fast if it is capturing large numbers of packets.
    Don’t get me wrong, wireshark is an exellent product and I use it often. If they could narrow the capture filters the same way that they narrow the view filters, I would probably use it even more!

  7. yoshi May 2, 2008 at 9:02 pm #

    nothing new here – cdpr has been doing this for years

  8. Reticent May 4, 2008 at 12:37 am #

    true. I usually capture stuff using tcpdump and write it to a file I open with wireshark; tcpdump gives you lots of nice options so you only end up with the traffic you wan’t to analyse (so it still suitable on busy networks). Alternatively, using the -A flag means you get to see the clear text protocols without using any sort of specialised tool anyway.

    Sorta offtopic, does anyone know a urlsnarf type application which is able to reconstruct html pages. Ie I run the tool and it’s able to write html pages locally as it see’s them? Wouldn’t mind having a play with such a tool.

  9. Umesh Chaurasia July 29, 2008 at 10:53 am #

    Hi,

    I want to capture CDP packets from windows environment. I downloaded you CDPSnarf sample.
    I also downloded getopt.c and getopt.h file from some other website.
    I am able to comile CDPSnarf application by commenting 2 lines //#include
    //#include

    In place of unistd.h, i am using getopt.h.

    When I am running my binary I am getting “unable to open Adapter” error. Following is the error details.
    ———————————————————-

    C:\Documents and Settings\umesh.c.PARSEC>D:\SW\CDPSnarf-v0.1.6\CDPSnarf-v0.1.6\R
    elease\cdpsnarf.exe -i CDP
    CDPSnarf v0.1.6 [$Rev: 797 $] initiated.
    Author: Zapotek
    Website: http://www.segfault.gr

    Couldn’t open device CDP: Error opening adapter: The system cannot find the device specified. (20)

    ————————————————————–

    Can you please suggest what I am doing wrong?

    Regards,
    Umesh

  10. dentonj August 3, 2008 at 3:56 pm #

    @yoshi

    From the code, CDPSnarf supports more CDP value types than cdpr.