| reply to kpatz
Re: Call for participation! Msgr Spam investigation You don't have to use Ethereal, but anything that will capture the Time-to-Live (TTL) in the packet. If you're on a Unix box than I assume you have tcpdump, so just do:
tcpdump -i # -s 0 -w trace.dat "udp and (port 135 or port 1026 or port 1027 or port 1028 or port 1029)"
This will save to binary trace file. Because Ethereal uses the same packet capture engine as tcpdump, its traces can be read with Ethereal.
Ethereal users would need to add the above filter (no quotes) in the Ethereal capture window...yet another nicety...the capture filter syntax is identical.
--
Lawrence Baldwin
myNetWatchman
The Internet Neighborhood Watch |
