6 grml-sniff - script for configuring a network sniffing setup
10 *grml-sniff* [OPTIONS]
14 This manual page documents briefly the *grml-sniff* command.
15 *grml-sniff* is a script for configuring a network sniffing setup.
16 It does NOT sniff on a hub/switch but instead sets up a man-in-the-middle (MITM)
17 configuration using a bridge device with two network devices.
28 Stop sniffing setup (set interfaces down and remove bridge device).
36 Display status of configuration.
38 *info*|*-h*|*--help*::
40 Show usage information.
45 This section describes the setup and configuration for capturing network traffic
46 on a setup like follows (assuming the 'Sniffing Computer' is the box where
47 you are using Grml with grml-sniff):
52 | Interface known as 'eth0' in the documentation
55 v Interface known as 'eth2'
56 Sniffing Computer <---------------------------> Control Computer (optional,
57 ^ providing GUI, Wireshark,
58 | Backup of dumpfiles, etc)
60 | Interface known as 'eth1' in the documentation
68 Start with booting Grml using the 'nodhcp' bootoption. This makes sure that no
69 network configuration is being executed automatically while booting. If you
70 booted your Grml system without the nodhcp option by accident, just execute
71 'killall pump; killall dhclient' after booting finished to make sure there
72 aren’t any running DHCP clients anymore.
74 After booting finished check out the available network interfaces:
78 At least two interfaces should be present (usually named eth0 and eth1, that’s
79 what we are using in this documentation as well). Make sure the network cards
80 are connected with the hub/switch/router and the client accordingly! The third
81 interface (known as eth2 in this documentation) is just optional and not
82 necessary for sniffing itself.
84 Simple (but not necessarily 100% reliable) check for network connnection using a
91 Look for 'Advertised auto-negotiation: Yes' and 'Link detected: yes'.
96 Make sure the according network interfaces are configured as BRIDGE_DEVICES in
97 /etc/grml/router-setup. If you are using eth0 and eth1 you don't have to do
98 anything (the default is just fine)! Otherwise adjust BRIDGE_DEVICES in
99 /etc/grml/router-setup accordingly. For example if the devices you would like to
100 use within the sniffing bridge are named eth2 and eth4 use:
102 BRIDGE_DEVICES='eth2 eth4'
107 Assuming you configured /etc/grml/router-setup as documented in the previous
108 section, finally invoke grml-sniff:
112 That's it. Now your system should be set up accordingly for capturing network
120 tcpdump -s0 -C 50 -v -w pcap -i br0
122 to generate files named pcap, pcap1, pcap2,... each with a file size of ~50MB.
123 Press CTRL-C to stop capturing traffic. You can analyse the generated pcap files
124 for example using wireshark(1).
128 grml-ap(8), grml-bridge(8), grml-router(8)
132 grml-sniff was written by Michael Prokop <mika@grml.org>.