

                                  H U N T E R
                                 >+++++++++++<

Purpose:  HUNTER is a full-duplex sniffer for Linux that captures data from/to
          a specified source/destination. It saves all data, that passes the
          wire from SYN till FIN.

Usage:    hunter [-s <source>] [-d <destination>] [-p <port>]

          You must either specify an <destination> or <source> or both.
          If you haven't specified a port HUNTER will use DFLTPORT.
          If port is 0, then HUNTER will exclude the port# from the
          filter rules -> port numbers from 2^0 till 2^16 are valid.

          HUNTER masks himself in the process list to PS_FAKE.

          Sniffed data will be written to LOG.

Example:  hunter -d nis.master.org -p 23  or...
          hunter -d 10.2.10.11 -p 23

          HUNTING RULES...

          HUNTING RULES
          ^^^^^^^^^^^^^
                SOURCE:      DOESN'T MATTER
                DESTINATION: nis.master.org
                DEST. PORT:  23

          HUNTER becomes an deamon and waits for TELNET connections
          from "any host on the subnet" to nis.master.org.

          If a connection is detected HUNTER will capture user input
          and the server's output.

Log File: 

################################[ LOG START ]################################

any.host.on.subnet.com [1352] => nis.master.org [23]

|-------------------------------[    DATA   ]-------------------------------|

< Cray M94  UNICOS 9.0 (nis.master.org) (ttyp0)
<
<
< d0d login:
> root
< Password:
> R00TY
< Last login: Wed Nov 26 10:36:46 on tty3
<
< root:nis #
> w
< 12:31pm  up  1:56,  4 users,  load average: 0.00, 0.00, 0.04
< User     tty      from             login@  idle   JCPU   PCPU  what
< root     ttyp0    localhost       12:30pm                      w
< root:nis #
> exit

|-------------------------------[  CLOSED   ]------------------------------|

CLOSED BY: FIN Flag
INIT AT  : Wed Nov 26 12:30:32 MET 1997
RESET AT : Wed Nov 26 12:33:18 MET 1997
AMOUNT   : 682 Bytes

################################[ LOG  END ]################################

          The '>' char indicates user input and the '<' char server output.



Disclaimer:   I'm not responsible for the usage of this program/code.

Last Update:  1997/11/26
Author:       TICK (t_i_c_k@hotmail.com)

Src of Info:  Linux Sniffer by Mike Edulla
Credits to:   route and halflife for lnw.h


[EOF]
