Page 2 of 3

Posted: Mon 16 May 2011, 21:53
by DPUP5520
@ stiginge
I will post a pet of it later for you , I initially created a pet and sfs but didn't post the pet cause of the size and didn't take into consideration full installs.

@ Béèm
I really can't go into an in depth analysis of the two programs however i'd say one of the most major differences between the two is that Wireshark is capable of packet injection which Kismet is not. On the other hand Kismet is able to capture gps data with a plugin where Wireshark can't, I've seen many people ask why have Kismet and Wireshark both installed and the answer is simple, they both have different functions that they do better than the other, Kismet is mostly used for Wardriving/Network Decloaking, while Wireshark is geared more towards capturing live network data/data injection after gaining access to a network.

Edit: sorry Béèm I only now realized I wrote the above from a hacker's/intruder's point of view rather than a network admin or end user as you were probably asking for, for the most part they are both fine for monitoring traffic however if you are looking to use one as an IDS i'd say Kismet is the way to go, way easier to monitor.

Posted: Tue 17 May 2011, 15:20
by stiginge
Ok dpup thanks for that i'll wait in eager anticipation

Posted: Tue 17 May 2011, 15:50
by DPUP5520
@ stiginge
Sorry I was a bit busy the other day, will be out later today after I get out of work, promise.

Edit: Pet file for 1.4.6 is up, sorry it took me so long.

Posted: Wed 18 May 2011, 17:27
by Béèm
DPUP5520
I will rephrase my issue.
I experience loss of connection.
I have tried things like the stay-connected pet, as it often happens during a period of inactivity.

When I saw kismet and wireshark, I wonder which one of the two is best for tracking this issue.
Maybe neither of the two is suitable.

Hence the question.

Posted: Wed 18 May 2011, 18:43
by stiginge
The application doesn't launch from menu entries (under >internet and >system).

Entering the wireshark command in a console brings up an error message:

Code: Select all

wireshark: error while loading shared libraries: libpcap.so.0.8: cannot open shared object file: No such file or directory

Posted: Wed 18 May 2011, 18:45
by DPUP5520
Ah so verry sorry about that Béèm, I would reccomend using Kismet if you want to find out when the computer is disconnecting as you can set up a log/filter to track when a client connects and disconnects but it obviously would not be usefull for tracking specific issues with your connection. Wireshark wouldn't really be useful at all in a situation like this.

Posted: Wed 18 May 2011, 18:47
by DPUP5520
@stiginge

You are missing the libpcap library, I will add a fix to the first post tonight.

Posted: Wed 18 May 2011, 19:16
by Béèm
Thank you DPUP5520 for confirming my feeling that Kismet was more appropriate.
I'll concentrate on it.

Posted: Wed 18 May 2011, 21:47
by DPUP5520
Added libpcap pet for wary users or anyone else missing the libraries

Kismet/Wreshark for monitor

Posted: Wed 18 May 2011, 22:35
by gcmartin
Asking for recommendation:
Most of the world uses router. Most of these router can be configured to direct messages of router activity to syslog, Somewhere.

With 2 tools discussed here; Kismet and Wireshark brings me to ask for help.

(from my iSP) I want to know when my Public IP is active and when my IP changes (for like most, I have dynamic account) from ISP.

Questions:
  • Which does anyone recommend for obtaining the Public IP information?
  • Is there a way to capture it into a file, simply?
Thanks in advance
P.S. You guidance here has been absolutely rewarding. Thanks for your contributions.

Posted: Wed 18 May 2011, 23:20
by DPUP5520
Once again i'd reccomend Kismet as it can capture the ip address and you can compare it to the mac address(which will never change unless you change it with a tool like macchanger) however as long as you stay connected your IP address will not change unless you disconnect and then reconnect.

Posted: Wed 18 May 2011, 23:34
by gcmartin
DPUP5520 wrote:Once again i'd reccomend Kismet as it can capture the ip address and you can compare it to the mac address(which will never change unless you change it with a tool like macchanger) however as long as you stay connected your IP address will not change unless you disconnect and then reconnect.
Actually, ISPs over the world has a regular process of harvesting and re-issuing public IP (WAN) addresses contiunually each and every day. My private IP (LAN) never changes as you mentioned. I'm concerned about my Public IP address only and want to log it in my Puppy distro.

Last question: Your feelings about the usefulness of NMAP and ZENMAP? neither of which is included in PUPs.

Thanks in advance.

Posted: Thu 19 May 2011, 01:45
by DPUP5520
@gcmartin

My bad I missed the "public IP" part there I thought u said private IP, I gotta read over posts more carefully. NMAP can technically be used to monitor your public ip but I wouldn't recommend it, if you want to monitor your public IP for changes I would recommend using IP Monitor. And I believe The only reason I never posted a pet of nmap was that someone else beat me to it I believe it may have been ttuuxxx but it was part of another thread and not in it's own.

Edit: found the thread I was thinking of, it was ettercap he posted not nmap so if anyone wants it posted let me know.

Posted: Thu 19 May 2011, 19:24
by stiginge
App still doesn't launch from menu or console:

Code: Select all

# wireshark
wireshark: error while loading shared libraries: libgcrypt.so.11: cannot open shared object file: No such file or directory
# 
After installing pet and reboot.

Posted: Thu 19 May 2011, 21:49
by DPUP5520
Wow can't believe Wary is missing all these dependencies, sorry I don't use Wary so I was unaware of all the missing files, I've had to compile dependencies for people using Wary and Quirky for other programs I made into pets too, will put together a new pet for libgcrypt.

Edit: Added libgcrypt pet in first post.

Posted: Sat 21 May 2011, 09:53
by stiginge

Code: Select all

# wireshark
wireshark: error while loading shared libraries: libgnutls.so.26: cannot open shared object file: No such file or directory
# 
Looks like there's more than a couple missing from 5.1.1.56!

Posted: Sat 21 May 2011, 15:48
by DPUP5520
i'll tell ya what, instead of doin this back and forth stuff, ima burn a copy of Wary tonight and figure out all the dependencies and i'll let you know when I have everything worked out in a day or two.

Posted: Sat 21 May 2011, 15:58
by stiginge
Righto Dpup that sounds like a good plan.

But maybe there are other puppy distros with dep's missing also?

Posted: Sat 21 May 2011, 18:50
by DPUP5520
@ stiginge

Ok so i've come to a conclusion that my Wireshark pet will not work for Wary users and Quirky users most likely at all due to different versions of GLIBC being installed, being that wireshark is compiled on lupu with GLIBC-2.11 it will not work on Wary at all even if all the other dependencies are found and installed, sorry but you are gonna have to get someone to compile Wireshark in Wary, I tried to compile it in Wary but was getting too many errors and gave up after half an hour.

Posted: Sat 21 May 2011, 18:52
by stiginge
Darn