full-disclosure - PCAP and LP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200406020604.i5264V314791@singularity.tronunltd.com>
From: Ian.Latter at mq.edu.au (Ian Latter)
Subject: PCAP and LP

Hello Ali,


   According to the FAQ, this doesn't look entirely possible;

        [...]
        4.10 Replaying Client Traffic to a Server 

        A common question on the tcpreplay-users list is how 
        does one replay the client side of a connection back to
        a server. Unfortunately, tcpreplay doesn't support this 
        right now. The major problem concerns syncing up TCP
        Seq/Ack numbers which will be different. ICMP also 
        often contains IP header information which would need 
        to be adjusted. About the only thing that could be easy 
        to do is UDP, which isn't usually requested.  
        [...]

        From; http://tcpreplay.sourceforge.net/FAQ.html


  I've had one other suggestion, and that is contacting the author
of "chaosreader" (with greenback or source);

  http://users.tpg.com.au/bdgcvb/chaosreader.html


's'cool ... I'll fish the web a little more and see what comes out ... if
nothing comes out, and I can't make a quick contribution to 
chaosreader, then I'll probably change the target host to acquire
the asset via another protocol (http/smtp/etc).


Thanks all.




----- Original Message -----
>From: "Ali-Reza Anghaie" <ali@...ketknife.com>
>To: "Ian Latter" <Ian.Latter@...edu.au>
>Subject:  Re: [Full-Disclosure] PCAP and LP
>Date: Tue, 01 Jun 2004 23:12:19 -0400
>
> On Tue, 2004-06-01 at 23:32, Ian Latter wrote:
> >   Quick question, I'm going through the results of an investigation
> > and have a PCAP file that contains Line Printing ... I'd like to 
> > reconstruct the postscript files (or just reprint them), is there a
> > tool that will allow this? 
> 
> I'm not sure about reconstructing the PS file in a reasonable fashion
> (there is a good spec, it's a grokkable format, but it's not easily
> regexed in comparison to any other text)...
> 
> Perhaps using tcpreplay to push it to a printer would do?
> 
> -Ali
> 
> --
> OpenPGP Key: 030E44E6
> --
> Was I helpful?: http://svcs.affero.net/rm.php?r=packetknife
> --
> I wouldn't get out of an electric chair to get in one of these
> things. -- Rusty Wallace (on IRL)
> 

--
Ian Latter
Internet and Networking Security Officer
Macquarie University