Communications Sniffer Ed Paradise, Rob Lingle, Todd Hoffenberg, Henry Barnes, Robert Brooke Senior Design Proposal ECE4006D Internetworking Design Georgia Institute of Technology Fall 2002
Proposal Overview Introduction Project Organization Design Details Project Challenges Product Verification
Intro - Concept Sniffing from network traffic Used to search for specific threatening keywords Valuable to police organizations
Intro – Product Back end – retrieve packets and piece them together Database – store packets Front end – web-based access to database
Intro – Competing Products Carnivore FBI use - intercepts large volumes of Data handled differently Etherpeek Admin. use - capture packets of data from many different sources AIM, Real Networks, Windows Media Player, Yahoo! Instant Messenger, and MSN Messenger Lacks database features
Project Organization Communications Sniffer Sniffer Python Code MySQL Database PHP GUI Sniffer Python Code: Ed, Rob, Hank MySQL Database: Todd, Bobby, Hank PHP GUI: Todd, Bobby
Project Organization WeekSniffer TaskDatabase/GUI Task 4 Preliminary GUI design 5 ArchitectureMeet to discuss database organization 6 ArchitectureSet up database and code search/scoring algorithm 7 Basic SMTP captureRun tests to ensure algorithms are fast enough for high traffic 8 Advanced SMTPWork on GUI/database interface 9 Basic POP capture / Python-MySQL DatabaseWork on GUI/database interface 10 Advanced POPWork on GUI/database interface 11 Basic IMAPFinishing touches/help database 12 Advanced IMAPWork on security/SSL connections to interface 13 TestingWork on security/SSL connections to interface 14 Interoperability of features with database/GUITesting/Additional Features 15 Interoperability of features with database/GUITesting/Additional Features 16 Documentation and paperTesting/Additional Features
Design Details - Sniffer Ideas: Ethereal, tcpdump, Sniffit None written in Python Tasks of code Differentiate s from other traffic Reassemble Translate code for tailored needs Starting point: Pylibpcab (sniff.py)
Design Details – Database/GUI GUI is web-based HTML PHP interface to database GUI highlights Only brief header information shown initially Body, full header, etc. available on request separation By address Scoring system for “offensive” s – separate table
Design Details - Database MySQL Database GUI config/help address 1 address N Scored s address list Storage Unit Scoring Rules Back-end table Intermediate sorter table GUI table Back-end + sorter table Sorter + GUI table
Challenges - Sniffer Sorting messages from multiple users Multi-packet messages attachments
Challenges – Database/GUI PHP/Python Interface Manipulation of filters during operation
Product Demonstration Small network required Mail server (Linux) “Listening post” system (Linux) System with communications sniffer software package End-user system (OS TBD)
Product Verification Reconstruct single-packet messages Reconstruct multi-packet messages Reconstruct attachments Handle different protocols: SMTP IMAP POP3