[Etherape-users] Re: etherape

[Juan T. <to...@us...>]

Nathan Hurst wrote:

> Hi,
> Downloaded and played with etherape - it's very cool, and helped me track
> down a trojan machine on our network.  It compiles cleanly on linuxppc.

Thanks. :-)
What particular distribution version, so that I can mention it on the README?

>
> There seems to be a bug where hosts can change from ipaddrs to hwaddrs,
> this may or may not be related to the fact that our network has appletalk
> traffic on it(which doesn't use IP, instead talking at the ethernet
> layer).

I guess you mean from session. Etherape determines whether a particular host
is IP based depending on the first packet from it that it hears about. That
means
that if the first packet is ARP, for instance, it will wrongly think it
doesn´t have
an IP address. But then again, presenting IP addressess while in etherape mode

(not interape, I mean), is a hack that I don´t feel very confortable about.
The Right Thing (R) to do is to have a proper /etc/ethers file in your system.

> Couple of suggestions/requests:
> * The ability to name hosts, or perform a rev-name lookup

Copied. Per node preferences are planned for the future.
Rev-name lookup? Do you mean what you get with the -r option? :-)
And the resolving will be non-blocking with the next version to come out
shortly (matter of minutes).

> * A client which can be posted on another network and display the traffic
> on that network(i.e. we have several routers, and it seems that
> etherape(like tcpdump) only sees traffic not masqueraded to outside
> machines.

The "easy" solution would be to simply forward the X display. Remote
capturing is a problem in itself and I would want etherape to be pretty
independent of the capture procedure. Talk on the ethereal-dev mailing
list is that their wiretap library may eventually become a capturing
daemon as well. Stay tuned.

>
> * The ability to move nodes around(I know your current layout approach is
> better dynamically, but it would be nice if I could put the network into a
> topology more like our own).

This has always been a goal of mine, but it is dependent on the ability
to keep per-node preferences. I'll be getting there, but keep in mind
that etherape only has one developer at this moment. :-)

Regards,
Juan.