network programming

[flea]

I'm thinking of doing some kind of network
related program as a project for college.
I'm in 2nd year, i have experience with
Java, C++ and a few other languages. I'm an
excellent Java programmer, and a good C++ programmer
(i'm going by my grades, 93 and 79 respectively).

I've got a month and a half for the project
i was thinking of doing a network tools package,
and including some security features - well i'm
only a security newbie, so these might not
seem fantastic - like a port listener that notifys
the admin/keeps a record of attempted pings/port
scans along with the IP of the scanner or pinger?

I had an idea to do a ethernet packet sniffer detector,
i was going to work on the idea that if i think a
PC is running a sniffer i could send it data with
and incorrect ethernet address (but a correct IP)
address, if its acks then it is probably running
a sniffer...is that a sound theory? I know that will only
work if we're on the same ethernet.

If anyone, with more technical knowledge, could give
me some advice - project idea wise - i'd be very grateful.

cheers m'dears!

flea

[a_420_hacker_24]

I have been thinking of the same thing.I am a grad of a networking program, and i'm currently working on my degree...but i have been programming in perl for about 3 years, and I wanted to make a networking tool I could use.It would have network ping sweep,traceroute,DNS,socket connections, and Im thinking fo more stuff.But we should share note's or progress.So far i have the ping portion done Im just writing the GUI for the program then.,......on to the next task...but with school and work I dont think I will done all the fast.;(

[wahaha]

i like programming but something i can't do it
i must be learn i like use linux and embedded system with your mobile phone
it's great

[Networker]

Originally posted here by flea
if i think a
PC is running a sniffer i could send it data with
and incorrect ethernet address (but a correct IP)
address, if its acks then it is probably running
a sniffer...is that a sound theory? I know that will only
work if we're on the same ethernet.

A sniffer detector is a good idea but I don't know if this is achievable.
Your idea worth a try, did you simply test the theory?
Use dsniff to forge a packet at the Mac layer encapsulating a simple ping ...

[tampabay420]

something using the pcap library would be nice...

http://www.tcpdump.org/ #tcpdump.org is cool
http://www.tcpdump.org/pcap.htm #programming with pcap

Here is a simple demonstration of using pcap_next() to sniff a packet.
    #include <pcap.h>
    #include <stdio.h>
    int main()
    {
        pcap_t *handle;                        /* Session handle */
        char *dev;                                /* The device to sniff on */
        char errbuf[PCAP_ERRBUF_SIZE]; /* Error string */
        struct bpf_program filter;            /* The compiled filter */
        char filter_app[] = "port 23";       /* The filter expression */
        bpf_u_int32 mask;                     /* Our netmask */
        bpf_u_int32 net;                        /* Our IP */
        struct pcap_pkthdr header;          /* The header that pcap gives us */
        const u_char *packet;                 /* The actual packet */
        /* Define the device */
        dev = pcap_lookupdev(errbuf);
        /* Find the properties for the device */
        pcap_lookupnet(dev, &net, &mask, errbuf);
        /* Open the session in promiscuous mode */
        handle = pcap_open_live(dev, BUFSIZ, 1, 0, errbuf);
        /* Compile and apply the filter */
        pcap_compile(handle, &filter, filter_app, 0, net);
        pcap_setfilter(handle, &filter);
        /* Grab a packet */
        packet = pcap_next(handle, &header);
        /* Print its length */
        printf("Jacked a packet with length of [%d]\n", header.len);
        /* And close the session */
        pcap_close(handle);
        return(0);
    }