I have had some luck with getting this 'system' built but have not successfully captured fragmented traffic. I am tyring to create a system that fragments any traffic passing across a linux machine set up as a router. As a result I have created the following network:
a) Dual NIC system running Knoppix Auditor. eth0 connected through hub to router-'internet'(10.x.x.x). eth1 (172.16.2.1) connected via x-over to "internal" (172.16.2.2) PC Knoppix set up as router to internet. b) Internal (Client) PC running Windows - or - Linux c) 3rd machine running Ethereal captures off the eth0 hub. With no fragmentation involved I can reach the web server on the 'internet' side with no problem. When I run Fragrouter I see the fragments being generated in the console window and the client machine experiences a definite impact as a result. However, ethereal captures from the client, the eth1 hub, and on the knoppix box itself do not list any IP FRAGMENTS - I see lots of retrans and lost packets but nothing that indicates that ethereal was seeing fragmented packets. It 'has' been a while since I had to work at the packet level but I thought I remembered ethereal listing such traffic as "IP FRAGMENT". Go ahead and "Learn me" something if I am mistaken please! The only thing I notice is that when I run "fragrouter -i eth1 -F2" I can see the fragmentation listed in console but if I use "fragrouter -i eth0 -F2" nothing happens. I would think that I should want to fragment traffic going through eth0 if I want to pick it up off the hub ... I can guess that the problem lies in my routing configuration on the knoppix (auditor) machine but can't think of what to change to make it work. Any thoughts? Hank ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
