Novell Shareware - Sniffer Tools

Sniffer Tools - AdRem NetCrunch 5

Mon, 21 Apr 2008 18:26:57 UT

No time for downtime? AdRem netcrunch auto-detects and presents graphical network maps, which reflect up-to-the-minute device and host status. You can define alerts and send them using any medium you wish (like phone, pager, e-mail, or ICQ). Includes handy IP package tools: graphical ping, traceroute, bandwidth utilization and port scanner. The program tests network response time, throughput and transmission performance. Includes IP subnetwork calculator.

NetCrunch 5 is a unique combination of agentless monitoring of Linux, Windows, NetWare and SNMP devices in one package.

It centralizes fault management by collecting and alerting on events from SNMP sources, Windows Event Logs and syslog messages.

NetCrunch consists of WMI, RPC, SSH and SNMP monitors for monitoring variety of systems and devices. It contains over 65 built-in Network Service monitors (i.e. HTTP, POP3, FTP, SMTP).

NetCrunch 5 additionally includes 5 new user experience monitors for services like DNS, FTP, POP3, SMTP and HTTP/HTTPS.

New version comes with over 200 predefined monitoring rules grouped in Monitoring Policies for common devices and applications.

NetCrunch 5 includes over 200 new features like extended MIB database, new Desktop notification Client, many user interface enhancements just to name a few.

Features of AdRem NetCrunch :

Auto Discovery:
Perform initial and scheduled discovery and classification of network resources.

Network Views:
Present physical and logical network topology as graphical maps and dynamic network views.

Event Management:
Collect events from Windows, Syslog and SNMP traps. Get alerted when problem occurs.

Monitoring Policies:
Use predefined or customized monitoring rules and data collection settings.

Availability Monitoring:
Monitor availability of network devices and services. (HTTP, POP3, SMTP, etc.).

Performance Monitoring:
View real-time statistics, multi-server charts, and performance trends.

Long-term Trend Analysis:
Define and generate reports on demand or have them delivered periodically via email.

Remote Access:
Receive alerts on remote notification client, view network status via web browser.

NetCrunch 5 contains over 200 new features and changes.

Major Changes
Agentless Linux monitor
Windows Event Log monitor
Remote Desktop Notification client
Extended Service Monitoring (user experience monitors) of: FTP, SMTP, HTTP/S, POP3, DNS
Redesigned Event/Alert management
Redesigned Reporting
Extended Web Access capabilities
Many user interface improvements (i.e. drag & drop)

Download Location : Download AdRem NetCrunch 5

Homepage : http://www.adremsoft.com/netcrunch/index.php

Sniffer Tools - NETWORK INTERFACE MONITOR (NETMON.NLM)

Mon, 21 Apr 2008 17:54:59 UT

NETMON.NLM is a NetWare loadable module which acts on the server console and monitors network traffic on a given network interface card. It uses text based window interface and provides comprehensive statistics and colored histogram. It also allows to capture and analyze packets on a given server's network interface directly from server console. Main screen provides quick overview of what is happening on the network segment monitored NIC is connected to.

Semigraphical, colored histogram as well as various counters provide with comprehensive information.

Capture screen allows to capture packets on a given network interface. Because switching to and from promiscuous mode is also supported by this program, not only the traffic, which belongs to the server can be captured, but in fact any packet on the segment. Capture screen provides information about captured packets and can be effectively used for first and quick analysis of any server/client problem.

Captured data can also be filtered "on the fly", according to what the actual need is. Filtering is based on source/destination MAC addresses and/or on protocol type (IPX/SPX, TCP/IP). Once packets are captured in the buffer, they can be either shown and dumped on the screen or they can be saved into the file for later detailed analysis. File format used is compatible with Novell's LANalyzer file format or Sniffer CAP format.

One of the biggest advantages of NETMON.NLM is that there is no need for any extra PC or other device when capturing traffic between the server and the client PC. Even intelligent switching hubs are not a problem because NETMON.NLM runs directly on the server of the interest.

NetMon recognizes and supports multiple boards/interfaces on the NetWare server, and supports switching to/from promiscuous mode, which is needed for capturing the whole traffic on the given network segment.
NetMon understands and supports Ethernet 10MBit, Ethernet 100MBit, and Ethernet 1GBit technologies, Token-Ring 4MBit, Token-Ring 16MBit, and FDDI technologies are also supported but their support is rather limited.

Features for both NETMON v.2.x & NETMON v.1.x :

TOTAL,PEAK,CURR pkts
TOTAL,PEAK,CURR bytes
PEAK,CURR load
PROTOCOL DISTRIBUTION
PACKET SIZE DISTRIBUTION
BROADCAST STATS
PROMISCUOUS MODE SUPPORT
PACKET CAPTURING
PRE-FILTERING
SAVE data to file
LOAD data from file
LANalyzer data format
BUFFER MEMORY adjustment
POST FILTERING capabilities
SEARCH for pattern
EXPORT trace summary

Additional Features in NETMON v.2.x :

CAPABLE TO MONITOR UP TO 4 BOARDS CONCURRENTLY
SUPPORTS ALTERNATIVE BINDING METHOD USING PRESCAN STACK
CLEVER WRAP BUFFER TECHNOLOGY
MULTIPLE PROCESSOR SUPPORT (LibC version only)
SIGNIFICANTLY REDUCED OVERHEAD
CAP FILE FORMAT SUPPORT
LAST MINUTE & LAST DAY HISTOGRAM
PROFILES & CURRENT SETTING STORED INTERNALLY
CONSOLE LOCK POSSIBILITY

NETMON v.2 supported o.s. versions:

NetWare 4.x, NetWare 5.x, NetWare 6.x
NetMon v.2 has been ported to both latest Novell LibC technology, and also legacy Novell CLib technology.
LibC version can be loaded on NetWare 5.1 SP4 (or higher), and NetWare 6.x.
CLib version can be loaded on NetWare 4.x, 5.x, and 6.x.

NETMON v.1 supported o.s. versions:

NetWare 3.x, NetWare 4.x, NetWare 5.x, NetWare 6.x

Download Location 1: Download NETMON.NLM

Download Location 2: Download NETMON.NLM

Homepage : http://www.roletosoft.cz/info/index.shtml

Sniffer Tools - SerialView 1.23

Mon, 21 Apr 2008 17:22:42 UT

SerialView is a DOS based async protocol analyzer that supports capture and decode of async SLIP, PPP and NRN (Novell Remote Node) protocols.SerialView decodes LCP, PAP, CHAP, IPCP, IPXCP, ATCP and NBFCP, as well as TCP/UDP/IP, SNMP, IPX/SPX/NCP, and more.

Download Location 1: Download SerialView 1.23

Download Location 2: Download SerialView 1.23

Homepage : http://www.klos.com/

Sniffer Tools - PacketView 1.23

Mon, 21 Apr 2008 16:54:05 UT

PacketView is a DOS based LAN protocol analyzer designed to work with ethernet, token-ring and ARCNET networks. PacketView decodes many protocols including TCP/UDP/IP, SNMP, DNS, BOOTP/DHCP, NCP/SPX/IPX, XNS, VINES, and more.

Download Location 1: Download PacketView 1.23

Download Location 2: Download PacketView 1.23

Homepage : http://www.klos.com/

Sniffer Tools - SAPMN12

Mon, 14 Apr 2008 17:54:00 UT

SAP Monito v1.2 this utility is written to help troubleshooting network problems related to the distribution of SAP packets DOS

Download SAPMN12 :

SAPMN12 (36 KB)

Sniffer Tools - ETHCPT10

Mon, 14 Apr 2008 17:51:24 UT

Ethcapt captures the packets coming to your ethenet, depending upon ethernet mode. All packets saved to filename specified. The file format is simple, each packet is saved in format DOS

Download ETHCPT10 :

ETHCPT10 (18 KB)

Sniffer Tools - NETWATCH

Mon, 14 Apr 2008 17:48:31 UT

Netwatch is a utility for monitoring various information on an Ethernet network. It will allow you to see: a list of currently active stations with there main statistics a list of conversations going on between stations some global information like total load, protocol distribution a list of stations generating erroneous packets packets captured matching some user configurable conditions IPX routing information IPX SAP information server serial numbers IP RIP routing information Netwatch will automatically discover names and IP addresses of stations. DOS WIN

Download NETWATCH :

NETWATCH (119 KB)

Sniffer Tools - NETMON

Mon, 14 Apr 2008 17:43:23 UT

To monitor ethernet, full-screen windowed environment, capture ethernet frames, choose filters etc. and dump frames to a file. Use NetView to take a look at the capture-file. NetCure - reports the packet-length distribution - reports the packet-type distribution - reports the network-load - reports the station top ten - makes dumps of selected packets - displays dumps in a formatted way. DOS WIN

Download NETMON :

NETMON (178 KB)

Sniffer Tools - EVENT

Mon, 14 Apr 2008 17:40:01 UT

Event system provides a simple means to monitor DOS based system events in a way which should generally be transparent to users of the system by Roy Coates 45k DOS 3x

Download EVENT :

EVENT (45 KB)

Protocol analyzer for Novell/'s IPX protocol - IPXWAT10

Mon, 14 Apr 2008 17:37:21 UT

Protocol analyzer for Novell/'s IPX protocol, allows for identification of all routers, servers (file servers, print servers etc.) and nodes across an IPX internet, provides limited diagnostic facilities been tested on the following packet drivers: NE1000, NE2000, WD8003E, ARCETHER, can analyze the following protocols : IPX, SPX, NCP, SAP, RIP, includes source files DOS 3x 4x

Download IPXWAT10 :

IPXWAT10 (78 KB)

GOBBLER 2.1.01

Wed, 05 Mar 2008 12:22:33 UT

Download GOBBLER 2 (152 KB)

Download GOBBLER (Old version) (117 KB)

Capture ethernet packets write to dump file with filtering DOS.

There are two phases to performing OS detection from a spoofed source, first creating a host and second performing a scan.

To create a host we have to exploit a well known vulnerability within Ethernet, MAC address spoofing. By spoofing a MAC address, a host can be created on the network. If the MAC address replies to ARP requests with a valid IP address the spoofed machine can be contacted over a network. This is the same method as how a virtual honeypot is created. A program selects a MAC address and spoofs a TCP/IP stack accordingly.

To perform a scan, packets need to be sent from the spoofed machine created in the first phase. This is done by spoofing the entire frame, e.g. MAC address, IP address, and TCP / UDP / ICMP packet headers. By sending packets from packets from this spoofed source and by also spoofing the TCP/IP stack we can effectively scan a machine from a spoofed source. The remote OS tests are the same ones as what nmap performs, with the added bonus of scanning from a spoofed MAC address.

Where does DHCP come into play? DHCP aids the attack by allowing spoofed machines to be created simply. By spoofing the DHCP packet exchange to assign a MAC address an IP address spoofed machines can be created. 200 machines can be created via DHCP and from there a target host may be port scanned and OS detection performed.

In addition to OS detection and port scanning, the gobbler can also perform trace route and ping functions from multiple spoofed sources.

You can find more information about GOBBLER in

Download Sniffer Tools

Fri, 21 Dec 2007 08:47:05 UT