How can I monitor whats leaving my ports, what the data is and where its going?

[devonrevenge]

could I build a simple program that would simply copy the data leaving selected ports and out put it a file, or maybe monitor all ports for say a screen shot image stream and only pop those in a file?

could you give me some clues where to start? Could I use c++11?

[Catfish3]

CurrPorts is good enough.
http://www.nirsoft.net/utils/cports.html

Although if you have an actual firewall, you shouldn't need it.

[devonrevenge]

thanks catfish.

I wonder what some things I have allowed are.

I got skype listening to four ports, I can imagine a program that altered skype to do bad things, I got an imagination but I also got friends who can take practical jokes way too far, I fear revenge for things like rocket cake

[chrisname]

You mean port scanning? Use nmap. Or you could write a port scanner, it isn't very hard.

[Catfish3]

From the same page, you can also get SmartSniff, which is like a miniature Wireshark.
http://www.nirsoft.net/utils/smsniff.html

Or you could write a port scanner, it isn't very hard.

I'd like to see that posted in Articles if you do it chrisname.

[chrisname]

Challenge accepted.

[devonrevenge]

just want to monitor info coming and going, I can imagine listening to each port consecutively would be easy to build, but I don't know how you could know if it is an image data stream or something else

Challenge accepted.

great I will read the article and build me a port scanner, thanks guys :)

[ResidentBiscuit]

Sounds like you don't know a lot about networks yet. I recommend grabbing wireshark and just playing with that and maybe grab a networking book to learn some of the theory behind all of it.

[devonrevenge]

ResidentBiscuit wrote:

Sounds like you don't know a lot about networks yet. I recommend grabbing wireshark and just playing with that and maybe grab a networking book to learn some of the theory behind all of it.

okay ^_^

[chrisname]

Done. It's working, but it's slow on remote sites:

cppscan: Scanning scanme.nmap.org...
  22 : OPEN
  80 : OPEN

I'll do some more work on it later. I'm writing the article now, but here's the code in the meantime: https://www.dropbox.com/s/875bt55tksl7k6r/cppscan.tar.gz

[keskiverto]

There are plenty of tools for network analysis. Some are more OS-specific than others. Tcpdump and iptables have sufficed for me in Linux.

Writing an own tool can be interesting excercise though.

[devonrevenge]

I want to write tools, I hope the c++book i ordered has something on networking.

[chrisname]

I wrote the article, it should be up soon.

[devonrevenge]

How come you could do that so quickly??

rapidchrisname.

[chrisname]

It wasn't that quick, it was four hours in total. But be grateful, that's longer than I spend on my homework.

[chrisname]

It's up: http://cplusplus.com/articles/o2N36Up4/

[devonrevenge]

this code can only scan ports on local host, how could I get data from the port? I also dont really know what im doing, I also had to use java because I cant install sfml

public class swing extends JFrame {

    public Socket connect;
    public JTextArea outpop;
    public JButton go;

    swing(){
        super("port scanner");
        go = new JButton("GO!");
        go.setVisible(true);
        go.setSize(100,30);
        add(go);
        go.addActionListener(new ActionListener() {
            @Override
            public void actionPerformed(ActionEvent event) {
            Integer count = 60;
            while(count != 11000){

                try {
                    outpop.append(get_port_info(count));
                    outpop.append("\n");
                    count++;

                } catch (IOException e) {
                    System.out.println(e);
                }
            }
            }
        });
        outpop = new JTextArea();
        add(new JScrollPane(outpop));

    }

    public String get_port_info (Integer port) throws IOException {

        String outputstring = null;
        connect = new Socket("127.0.0.1",port);
        if(connect.isConnected()){
        outputstring = port.toString() + ": open";
        connect.close();
        }

        return outputstring;
    }

}

[chrisname]

There's usually a method called recv() or receive(). I've never done networking in Java.

[devonrevenge]

.