tomahawk-users — Mailing list for users of Tomahawk

Re: [Tomahawk-users] [Tomahawk-devs] tomahawk test tool

[Andrey F. <fa...@re...>]

px li wrote:
> Hi everyone,
>  
> I'm interested in NIPS testing. 
> http://www.tomahawktesttool.org/install.html mentioned qa.tgz and 
> pcaps.tgz. Do you know where I can download them?
http://tomahawk.sourceforge.net/
>  
> Thanks in advance,
>  
> Peixue
>  
>  
> ------------------------------------------------------------------------
>
> -------------------------------------------------------------------------
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
> ------------------------------------------------------------------------
>
> _______________________________________________
> Tomahawk-devs mailing list
> Tom...@li...
> https://lists.sourceforge.net/lists/listinfo/tomahawk-devs
>   

[Tomahawk-users] tomahawk test tool

[px l. <pei...@gm...>]

Hi everyone,

I'm interested in NIPS testing.
http://www.tomahawktesttool.org/install.html mentioned
qa.tgz and pcaps.tgz. Do you know where I can download them?

Thanks in advance,

Peixue

 <http://www.tomahawktesttool.org/install.html>

[Tomahawk-users] Shell script with Tomahawk

[KURUPPANKANDI, S. \(SANDEEP\) <ksa...@al...>]

Hi All,
     I was executing the following script using the zenity for tomahawk.

 
#####################################################################
repeat=$(zenity --entry --text "Run pcap hw many times?" --title
"Repeats")

parallel=$(zenity --entry --text "How many pcaps to run ?)

pcap=$(zenity --file-selection)

address=$(zenity --entry --text "Start addes:" )

rate=$(zenity --entry --text "Desire pkt rate in Mbps")

zenity --info --text=$pcap

tomahawk -n $parallel -l $repeat -f $pcap -i eth0 -j eth1 -a $address -R
$rate -t 10

########################################################################

But when I run the following script the following error pops up;

##################################

[root@and d]# bash tshell.sh

:command not found

:command not found

:command not found

for readingg /home/d/test.pcap

: No such file or directory

: command not found

[root@and d]#

######################################

But when the embedd the same file path in $pcap it works fine. It doesnt
work when I pass the variable of the path file to tomahawk. If you know
a solution for this, expecting a response.

 

Thanks in advance,

-Sandy

Re: [Tomahawk-users] Trouble reproducing CPS results

[Andrey F. <fa...@re...>]

Koconis, David wrote:
> Andrey,
>
> Although I did not participate in the testing cited by the
> whitepaper, I have contacted one of the authors who provided me with
> the cps script referred to on page 20 and gave me permission to share
> it with you and the list.  It is attached to this email.
>
> From what you have posted about your configuration, I do not see any
> issues.  I also reviewed the 1000conn.pcap you created and it looks
> very similar to the one the author provided me.
>
> One important thing to know before attempting to run the script is it
>  will only work with tomahawk version 1.0.
You are 100% correct about this. We are now getting good results with 1.0.
> Some of the changes made in release 1.1 will cause the command line
> in the script to fail. Specifically, the maximum number of handlers
> in v1.1 is 250, so "-n 10000" will fail.  Also, the second byte of
> the IP address, which is a shell variable $ADDR in the script, is now
> reserved for use as the handler ID.  Although I have not verified it,
> I believe the following changes should make things work with v1.1:
>
> loops=1000 time tomahawk -i eth0 -j eth1 -q -m 200 -r 10 -t 100 -a
> 10.0.0.0 -n 250 \ -l $loops -f /usr/local/pcaps/1000conn.pcap >
> /dev/null
>
We tried this, but got even worse results than when running the command
for 1.0.
> If you are still having difficulty getting the results you want,
> please post the command line you are using and the version of the
> code.
>
> Regards, David Koconis
>
Thank you for your help! Using 1.0, we are getting results, which is
good enough
for us.

Sorry it took so long to reply, we've been playing with tomahawk to see
if anything
strange would arise. Right now, tests over wire show worse results than
over our
IPS, but we suspect packets are not actually going over wire. We'll post
back if we
are unable to figure this out.

Thanks!

Best regards,
Andrey Falko

Re: [Tomahawk-users] Trouble reproducing CPS results

[Koconis, D. <dav...@ic...>]

Andrey,

Although I did not participate in the testing cited by the whitepaper, I
have contacted one of the authors who provided me with the cps script
referred to on page 20 and gave me permission to share it with you and
the list.  It is attached to this email.

>From what you have posted about your configuration, I do not see any
issues.  I also reviewed the 1000conn.pcap you created and it looks very
similar to the one the author provided me.

One important thing to know before attempting to run the script is it
will only work with tomahawk version 1.0.  Some of the changes made in
release 1.1 will cause the command line in the script to fail.
Specifically, the maximum number of handlers in v1.1 is 250, so "-n
10000" will fail.  Also, the second byte of the IP address, which is a
shell variable $ADDR in the script, is now reserved for use as the
handler ID.  Although I have not verified it, I believe the following
changes should make things work with v1.1:

	loops=3D1000
	time tomahawk -i eth0 -j eth1 -q -m 200 -r 10 -t 100 -a 10.0.0.0
-n 250 \
		-l $loops -f /usr/local/pcaps/1000conn.pcap > /dev/null

If you are still having difficulty getting the results you want, please
post the command line you are using and the version of the code.

Regards,
David Koconis

-----Original Message-----
From: tom...@li...
[mailto:tom...@li...] On Behalf Of
Andrey Falko
Sent: Monday, October 01, 2007 10:12 PM
To: tom...@li...
Subject: [Tomahawk-users] Trouble reproducing CPS results

Hi everyone,

I hope someone still reads this list. We are trying to achieve the
connections per second recorded in the white paper (76,500 cps) on page
20. We are getting only around 9865 cps.

We are using the cps script provided in qa.tgz. We had to generate our
own 1000conn.pcap trace. We generated 1000 TCP connections with full
3-way handshakes using a Perl script that that connected to an apache
server on a machine on the network (I have attached the tcpdump of that
transaction and the Perl script). Is this trace proper?
Is it possible to get the trace the author utilized in the white paper?
Are we supposed to be generating full 3-way handshakes another way?

Our hardware consists of six machines with the following specs:

AMD64 4400+ CPU
2G of DDR memory
Two Intel NICs (eth0 and eth1)
One Nvidia NIC (eth2, which is the management port)

These machines are connected to GigE 48-port and 24-port Netgear
switches. The Intel NICs are one the same subnet.

We also tried to utilize one dual AMD64 machine with 12G of ram and two
Broadcom GigE adapters connected to a Dell GigE switch. Our results were
the same.

Thank you in advance for any suggestions and help.

Best regards,
Andrey Falko

[Tomahawk-users] Trouble reproducing CPS results

[Andrey F. <fa...@re...>]

Hi everyone,

I hope someone still reads this list. We are trying to achieve the
connections per second recorded in the white paper (76,500 cps) on
page 20. We are getting only around 9865 cps.

We are using the cps script provided in qa.tgz. We had to generate
our own 1000conn.pcap trace. We generated 1000 TCP connections with
full 3-way handshakes using a Perl script that that connected to an 
apache server on a machine on the network (I have attached the tcpdump 
of that transaction and the Perl script). Is this trace proper?
Is it possible to get the trace the author utilized in the white paper?
Are we supposed to be generating full 3-way handshakes another way?

Our hardware consists of six machines with the following specs:

AMD64 4400+ CPU
2G of DDR memory
Two Intel NICs (eth0 and eth1)
One Nvidia NIC (eth2, which is the management port)

These machines are connected to GigE 48-port and 24-port Netgear
switches. The Intel NICs are one the same subnet.

We also tried to utilize one dual AMD64 machine with 12G of ram and
two Broadcom GigE adapters connected to a Dell GigE switch. Our results
were the same.

Thank you in advance for any suggestions and help.

Best regards,
Andrey Falko

[Tomahawk-users] qa.tgz full file

[Tharaka N. <tha...@ya...>]

Hi,
   
  I install the TomaHawk. But the problem is i cant find some files in qa.tgz.  I download qa.tgz from sourceforge.net. There is no such files as /install etc. Please advice me.
   
  Thanks
  Tharaka

       
---------------------------------
Ahhh...imagining that irresistible "new car" smell?
 Check outnew cars at Yahoo! Autos.

Re: [Tomahawk-users] pcap-int.h: No such file or directory

[Koconis, D. <dav...@ic...>]

Yuvaraj,

Since you are using Makefile.independent to compile the code, it is
better to try to get all the required files from RPMs, instead of
compiling them from source.  This should help to insure that versions of
all the libraries will all be compatible.

I discovered the name of the RPM containing the file the compiler is
looking for by using the interface at http://rpm.pbone.net/. Click on
the advanced search button, then click on uncheck all the boxes then
check only Fedora 5 (your target OS).  Type in the filename (pcap-int.h)
and the result shows that the file is provided by the tcpdump-debuginfo
package.  Install this RPM, then copy the file from=20

/usr/src/debug/tcpdump-3.9.4/libpcap-0.9.4/pcap-int.h

To the place where the compiler is looking for it

/usr/include/pcap-int.h

Note that there are other libpcap header files in the tcpdump-debuginfo
RPM that the code might also need, so you might have to copy others,
too.

Hope that helps.
David Koconis

-----Original Message-----
From: tom...@li...
[mailto:tom...@li...] On Behalf Of
yu...@af...
Sent: Thursday, April 05, 2007 12:27 AM
To: tom...@li...
Subject: [Tomahawk-users] pcap-int.h: No such file or directory

hello,

I am trying to make tomahawk 1.1 using fedora core 5 machine by typing
the command,

[root@localhost tomahawk1.1]# make -f Makefile.independent rm -f
tomahawk gcc -O2 -pipe -Wall -funroll-loops -fomit-frame-pointer
-minline-all-stringops -DNDEBUG -DHAVE_CONFIG_H  `libnet-config =20
--defines` -o tomahawk tomahawk.c eventloop.c packetutil.c alloc.c  =20
-lnsl /usr/lib/libpcap.a
tomahawk.c:39:22: pcap-int.h: No such file or directory
make: *** [tomahawk] Error 1

I installed libpcap-0.8.1 from sourceforge.  Still, I am getting this
error.
Plz suggest a fix.  Thanks in advance.

--yuvaraj.


------------------------------------------------------------------------
-
Take Surveys. Earn Cash. Influence the Future of IT Join
SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=3Djoin.php&p=3Dsourceforge&CID=3D=
DEVDE
V
_______________________________________________
Tomahawk-users mailing list
Tom...@li...
https://lists.sourceforge.net/lists/listinfo/tomahawk-users

Re: [Tomahawk-users] Error while making: invalid option `tune=pentium4'

[Koconis, D. <dav...@ic...>]

Yuvaraj,

Perhaps you have solved this already, but in case you have not, here is
something you can try.  Based on the error messages, it seems like the
system you are compiling on may not have a Pentium 4 chip.  The compiler
option "-mtune=3Dpentium4" was added to try to squeeze some more
performance out of the code for that specific architecture.

Edit the file "Makefile.independent" and remove that string from the
following line

CFLAGS =3D -O2 -mtune=3Dpentium4 -pipe -Wall -funroll-loops
-fomit-frame-pointer -minline-all-stringops -DNDEBUG

So the line will now read

CFLAGS =3D -O2 -pipe -Wall -funroll-loops -fomit-frame-pointer
-minline-all-stringops -DNDEBUG

Hopefully, that will solve the problem.

David Koconis

-----Original Message-----
From: tom...@li...
[mailto:tom...@li...] On Behalf Of
yu...@af...
Sent: Wednesday, April 04, 2007 8:18 AM
To: tom...@li...
Subject: [Tomahawk-users] Error while making: invalid option
`tune=3Dpentium4'

hello,

i am facing problem installing tomahawk1.1 on redhat machine.  I have
successfully installed libnet1.2a.

When I tried to 'make -f Makefile.independent', I am getting the
following error.

[root@localhost tomahawk1.1]# make -f Makefile.independent rm -f
tomahawk gcc -O2 -mtune=3Dpentium4 -pipe -Wall -funroll-loops =20
-fomit-frame-pointer -minline-all-stringops -DNDEBUG -DHAVE_CONFIG_H  =20
`libnet-config --defines` -o tomahawk tomahawk.c eventloop.c
packetutil.c alloc.c  -lnsl /usr/lib/libpcap.a
cc1: invalid option `tune=3Dpentium4'
cc1: invalid option `tune=3Dpentium4'
cc1: invalid option `tune=3Dpentium4'
cc1: invalid option `tune=3Dpentium4'
make: *** [tomahawk] Error 1


Can somoene help me regarding this.  Thanks in advance --yuvaraj.


------------------------------------------------------------------------
-
Take Surveys. Earn Cash. Influence the Future of IT Join
SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=3Djoin.php&p=3Dsourceforge&CID=3D=
DEVDE
V
_______________________________________________
Tomahawk-users mailing list
Tom...@li...
https://lists.sourceforge.net/lists/listinfo/tomahawk-users

[Tomahawk-users] pcap-int.h: No such file or directory

[<yu...@af...>]

hello,

I am trying to make tomahawk 1.1 using fedora core 5 machine by typing  
the command,

[root@localhost tomahawk1.1]# make -f Makefile.independent
rm -f tomahawk
gcc -O2 -pipe -Wall -funroll-loops -fomit-frame-pointer  
-minline-all-stringops -DNDEBUG -DHAVE_CONFIG_H  `libnet-config  
--defines` -o tomahawk tomahawk.c eventloop.c packetutil.c alloc.c   
-lnsl /usr/lib/libpcap.a
tomahawk.c:39:22: pcap-int.h: No such file or directory
make: *** [tomahawk] Error 1

I installed libpcap-0.8.1 from sourceforge.  Still, I am getting this error.
Plz suggest a fix.  Thanks in advance.

--yuvaraj.

[Tomahawk-users] Error while making: invalid option `tune=pentium4'

[<yu...@af...>]

hello,

i am facing problem installing tomahawk1.1 on redhat machine.  I have  
successfully installed libnet1.2a.

When I tried to 'make -f Makefile.independent', I am getting the  
following error.

[root@localhost tomahawk1.1]# make -f Makefile.independent
rm -f tomahawk
gcc -O2 -mtune=pentium4 -pipe -Wall -funroll-loops  
-fomit-frame-pointer -minline-all-stringops -DNDEBUG -DHAVE_CONFIG_H   
`libnet-config --defines` -o tomahawk tomahawk.c eventloop.c  
packetutil.c alloc.c  -lnsl /usr/lib/libpcap.a
cc1: invalid option `tune=pentium4'
cc1: invalid option `tune=pentium4'
cc1: invalid option `tune=pentium4'
cc1: invalid option `tune=pentium4'
make: *** [tomahawk] Error 1


Can somoene help me regarding this.  Thanks in advance
--yuvaraj.

[Tomahawk-users] tabChangeListener

[Chris C. <Ch...@Di...>]

I have been trying the tabChangeListener but am l having problems.

 As you can see from the code below I've added
 selectedIndex="#{tabSupport.selectedTabIndex}"  serverSideTabSwitch="true"
 to the <t:panelTabbledPane, created a backing bean and included a output
 text in the page shown in the tab.
 But the selected index is always 0.
 
 
 <f:view>
 <h:form>
 <t:panelTabbedPane selectedIndex="#{tabSupport.selectedTabIndex}"
 serverSideTabSwitch="true">
 <t:tabChangeListener type="myapp.tabSupport" />

 
 <t:panelTab id="tab00" label="Tab00">
 <f:subview id="inc1">
 <jsp:include page="Page1.jsp" flush="false">
 <jsp:param name="filter" value="all" />
 </jsp:include>
 </f:subview>
 </t:panelTab>
 
 <t:panelTab id="tab01" label="Tab01" >
 <f:subview id="inc2">
 <jsp:include page="Page1" flush="false">
 <jsp:param name="filter" value="new" />
 </jsp:include>
 </f:subview>
 </t:panelTab>
 
 
 </t:panelTabbedPane>
 </h:form>
 </f:view>
 
 
 package myapp;
 
 import java.io.Serializable;
 
 import org.apache.log4j.Logger;
 import org.apache.myfaces.custom.tabbedpane.TabChangeListener;
 import org.apache.myfaces.custom.tabbedpane.TabChangeEvent;
 
 public class tabSupport implements Serializable, TabChangeListener
 {
  private static final long serialVersionUID = 1;
  int selectedTabIndex;
  private final transient Logger logger =
 Logger.getLogger(myapp.tabSupport.class);
 
  public int getSelectedTabIndex() {
   return selectedTabIndex;
  }
public void setSelectedTabIndex(int selectedTabIndex) {
  this.selectedTabIndex = selectedTabIndex;
 }
  public void processTabChange(TabChangeEvent event){
 //logger.error("ZZ" + event.getNewTabIndex() + " " + event.getPhaseId());
 //logger.error ("This bit executed");
 this.selectedTabIndex = event.getNewTabIndex();
  }
 }
 
 
 <managed-bean>
   <managed-bean-name>tabSupport</managed-bean-name>
   <managed-bean-class>myApp.tabSupport</managed-bean-class>
 <managed-bean-scope>session</managed-bean-scope>
 </managed-bean>
 
 
 In  Page1.jsp  
 
 <t:outputText value="ZXZ  #{tabSupport.selectedTabIndex}" />
 
Using tomahawk 1.1.3

Re: [Tomahawk-users] Q: Invalid pcap

[<bri...@3c...>]

Tomahawk's complaining because the packet trace doesn't have the full 
packet, only the first 144 bytes of a 201 byte packet.

By default, tcpdump truncates the packet capture (apparently to 144 bytes, 
in your case);  use the -s0 flag to tcpdump and it should work.

# tcpdump -i eth0 -s0 -w testdump.pcap

        Brian




"도꼬비" <il...@pa...> 
Sent by: tom...@li...
03/20/2007 08:57 PM
Please respond to
도꼬비 <il...@pa...>


To
<tom...@li...>
cc

Subject
[Tomahawk-users] Q: Invalid pcap






I tried to run with the tomahawk1.1 package.
 
# tcpdump -i eth0 -w testdump.pcap
..

# tomahawk -l 1 -f testdump.pcap
Invalid pcap: Complete packet not stored in file (time: 1007329426.360919, 
201 bytes on wire, 144 bytes in file)
#
 
But a general tcpdump data occurrs above error.
What's problem?
I need to your help.




-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share 
your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Tomahawk-users mailing list
Tom...@li...
https://lists.sourceforge.net/lists/listinfo/tomahawk-users

[Tomahawk-users] =?euc-kr?q?Q=3A_Invalid_pcap?=

[<il...@pa...>]

<HTML><HEAD><STYLE>P{margin-top:2px;margin-bottom:2px;}</STYLE></HEAD><BODY><DIV style='width:700px;height:150px;font-size:10pt; font-family:Dotum,AppleGothic,sans-serif;background:#FFFFFF'><P>I tried to run with the tomahawk1.1 package.</P>
<P>&nbsp;</P>
<P># tcpdump -i eth0 -w testdump.pcap<br>
..</P>
<P><br>
# tomahawk -l 1 -f testdump.pcap<br>
Invalid pcap: Complete packet not stored in file (time: 1007329426.360919, 201 bytes on wire, 144 bytes in file)<br>
</P>
<P>#</P>
<P>&nbsp;</P>
<P>But a general tcpdump data occurrs above error.<br>
What's problem?<br>
I need to your help.</P></DIV></BODY><HTML>

		<table border='0' cellpadding='0' cellspacing='0' width='100%' style='margin-top:20px'>
			<tr>
				<td style='background-image:
				url(http://mailimg.paran.com/skin/dotline3.gif) ; 
				background-repeat:repeat-x;	background-position:top left; 
				height:1px;' width='100%' colspan='2'></td>
			</tr>
			<tr>
				<td width='70%' valign='top' marginHeight='0' marginWidth='0' 
				style='padding:2px 0px 0px 5px'><!--
<table border="0" cellpadding="0" cellspacing="0" width="100%">
    <tr>
        <td style="padding:10 0 0 2;" valign="top">
            <a href="http://shopping.paran.com/event/200702/event_main.jsp" target=_blank>
                <font style="font-size : 12px ; font-family : 굴림 ; color:#D57D09; text-decoration : none" >
                    <B>☞ 애니콜 최신형 핸드폰이 100,000원 !  ☜</B>
                </font>
            </a>
        </td>
    </tr>
</table>
-->
</td><td width='30%' align='right' valign='top' style='padding:7px 5px 0px 0px'><a href='http://paran.com' target='blank'><img src='http://mailimg.paran.com/skin/write_logo.gif' border='0'></a></td></tr></table><img src='http://mail18.paran.com/read/put_ack.php?hp=L0QxOC9pL2wvaC9pbGFuY2hAcGFyYW4uY29tLy5Db25maXJtLzExNzQ0NDIyNDUuMTU3Ni5tYWlsMTh4MQ==&from=il...@pa...&to=tom...@li...__________________________________________________________________________________________________________________' width=1 border=0 height=1>

Re: [Tomahawk-users] Changing the IP source and destination.

[Koconis, D. <dav...@ic...>]

In case you have not already received the answer to your question, here
is some insight.  Tomahawk can be forced to use the IP addresses present
in the packet capture with the command-line option "-A 0".  Therefore,
if you want a specific source and destination IP address, make a capture
that has the addresses you want in it and use that option.

However, performing layer 3 testing will probably introduce some
problems.  Specifically, the receiving intercface  used by tomahawk
expects the source MAC address on the packet to be the MAC address of
the sending interface NIC.  If the packet has been routed by a layer 3
device, it is almost guaranteed that the source MAC address in the
packet has been altered.  This will cause tomahawk to incorrectly
conclude that the packet is not the same one that it sent out.

David

-----Original Message-----
From: tom...@li...
[mailto:tom...@li...] On Behalf Of Ishay
Ben Shushan
Sent: Sunday, December 24, 2006 12:42 PM
To: tom...@li...
Subject: [Tomahawk-users] Changing the IP source and destination.

Hi,
I am trying to run some attacks on layer3 device.
Is there any way to set the exact source and destination IP?
Ishay

------------------------------------------------------------------------
-
Take Surveys. Earn Cash. Influence the Future of IT Join
SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=3Djoin.php&p=3Dsourceforge&CID=3D=
DEVDE
V
_______________________________________________
Tomahawk-users mailing list
Tom...@li...
https://lists.sourceforge.net/lists/listinfo/tomahawk-users

[Tomahawk-users] How can I use Tomahawk to test Layer 3 network?

[Torvald s. <tor...@gm...>]

Thank you.

[Tomahawk-users] Changing the IP source and destination.

[Ishay B. S. <ish...@ch...>]

Hi,
I am trying to run some attacks on layer3 device.
Is there any way to set the exact source and destination IP?
Ishay

Re: [Tomahawk-users] Exploit pakets for tomahawk

[Yem S. <ys...@pr...>]

Hi,

There is the IPS test software ( www.bladesoftware.net )that could help you
to test the IPS. You could run it directly or if you want to test with
tomahawk just capture the packet using ethereal.

Hope this help

Yem


-----Original Message-----
From: tom...@li...
[mailto:tom...@li...] On Behalf Of Beyerle,
Christian
Sent: Tuesday, December 19, 2006 8:56 PM
To: tom...@li...
Subject: [Tomahawk-users] Exploit pakets for tomahawk

Hello Everyone,

I try to test and evaluate my IDS System with tomahawk.

Is there any source to get some exploit paketes for testing? 
Maybe it's possible to create exploit packets with metasploit by myself,
but i think this take much time. 

Regrads

Chris


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Tomahawk-users mailing list
Tom...@li...
https://lists.sourceforge.net/lists/listinfo/tomahawk-users

-- 
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.409 / Virus Database: 268.15.24/592 - Release Date: 12/18/2006
 

-- 
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.409 / Virus Database: 268.15.24/592 - Release Date: 12/18/2006
 



DISCLAIMER:
Information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error.

[Tomahawk-users] Exploit pakets for tomahawk

[Beyerle, C. <Be...@ew...>]

Hello Everyone,

I try to test and evaluate my IDS System with tomahawk.

Is there any source to get some exploit paketes for testing?=20
Maybe it's possible to create exploit packets with metasploit by myself,
but i think this take much time.=20

Regrads

Chris

Re: [Tomahawk-users] Attack PCAP files for use with Tomahawk

[Ankur J. <ank...@cm...>]

Nothing good but I found some pcap captures on the Lawrence Berkeley National Laboratory website. 

Ankur Jindal


J.T. Buice said:
> I see several postings to the mailing list archives of people asking for 
> attack or harmful packet capture files, but no replies.  Has anyone found
>  some good files to test against IPS devices yet?  Any help would be 
> appreciated.
> 
> J.T.B. 
> -------------------------------------------------------------------------
>  Using Tomcat but need to do more? Need to support web services,
> security? Get stuff done quickly with pre-integrated technology to make
> your job easier Download IBM WebSphere Application Server v.1.0.1 based on
> Apache Geronimo 
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642_
> ______________________________________________ Tomahawk-users mailing list
>  Tom...@li... 
> https://lists.sourceforge.net/lists/listinfo/tomahawk-users
> 

[Tomahawk-users] Attack PCAP files for use with Tomahawk

[J.T. B. <jb...@gm...>]

I see several postings to the mailing list archives of people asking for
attack or harmful packet capture files, but no replies.  Has anyone found
some good files to test against IPS devices yet?  Any help would be
appreciated.

J.T.B.

[Tomahawk-users] Hi~ about tomahwk test pcap

[<bs...@na...>]

CkhlbGxvLCBoYXZlIGFueGlvdXMgdGhpbmcgYW5kIGlucXVpcmUuClRoZXJlIGlzIHRlc3QgcGNh
cCB0aG91Z2ggd2FudCB0byB0ZXN0IHRvbWFoYXdrCkkgd2FudCB0byByZWNlaXZlIHRlc3QgcGNh
cCBmaWxlLgpJIGFtIGEgc3R1ZGVudCBhbmQgYW0gc3R1ZHlpbmcgc2VjdXJpdHkuCkkgd2FudCBp
ZiB0aGVyZSBpcyByZWZlcmVuY2Ugc2l0ZSBvciBmaWxlLiAKUmVnYXJkcywgCkxlZS4=

[Tomahawk-users] VMWare and Tomhawk

[Mike G. <mic...@gm...>]

Hello,

I have the following 2 VMWare images setup in a team.

1) Tomahawk server
3 NICs (eth0, eth1, eth2)

2) IPS Server
2 NICs (eth0, eth1)

Now in VMWare both eth0 devices are on the same LAN segment and both
eth1 devices are on another.  Will this configuration work with
Tomahawk??

I am not sure how my NIPS device will take the packet sent out eth0
from the tomhawk server, process it and send it back on eth1.

Mike

[Tomahawk-users] Directing traffic to a different machine

[Ankur J. <ank...@cm...>]

Hi
Is it possible to direct the packet capture traffic to a different machine than the one tomahawk is installed on. Does tomahawk support that functionality? If so how can that be used? 
The machines I am using are on the same network.

Another thing is that I was receving a time out error while running tomahawk. I ran it through many traces and for all of them it showed the same thing. Can anyone help me out with that? 

Thanks
Ankur 

Re: [Tomahawk-users] Installation Problems

[Ankur J. <ank...@cm...>]

Hey all
It gave me a non-static declaration before a static declaration error. Turns out that the code had declared extern Handler *handlerList in packetutils.h (134) and used a static Handler *handlerlist (119) in tomahawk.c. I commented out the one in packetutils.h becuase that was not being used anywhere else. I got it to work now. 

Thanks 
Ankur 



bri...@3c... said:
> Feel free to fix the source and send me the diffs along with a changes 
> file and I'll post them.  I'm just getting ready to push a bunch of
> really good changes/enhancements submitted by ICSA labs.
> 
> Brian
> 
> 
> 
> 
> "Ankur Jindal" <ank...@cm...> Sent by:
> tom...@li... 04/26/2006 01:03 PM
> 
> To tom...@li... cc
> 
> Subject [Tomahawk-users] Installation Problems
> 
> 
> 
> 
> 
> 
> Hi all I am a new tomahawk user. During installation I received an error 
> informing about multiple declarations. Just wanted to know if anyone else
>  received this and is it okay to change the source.
> 
> Thanks Ankur
> 
> 
> 
> ------------------------------------------------------- Using Tomcat but
> need to do more? Need to support web services, security? Get stuff done
> quickly with pre-integrated technology to make your job easier Download IBM
> WebSphere Application Server v.1.0.1 based on Apache Geronimo 
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 
> _______________________________________________ Tomahawk-users mailing
> list Tom...@li... 
> https://lists.sourceforge.net/lists/listinfo/tomahawk-users
> 
>