Solved

Proxy for port

Posted on 2007-03-21
12
378 Views
Last Modified: 2013-12-23
Hi all

Is there any way to setup some kind of proxy between a program and a server?

We have a service running some shady and obscure protocol that I am trying to port to PHP but not a lot of information is available regarding this protocol, so I want to kinda reverse engineer it by looking at the traffic going on between this program and the remote server.

Is there any way to have a STORE&FORWARD thing on a port?

I mean, let's say this program connects to server X on port n

Client --------------------> X:n

Then, what I want to do is:

Client ------> Client:n ----------> X:n

And have the stream saved to a file

Are there any ready-made solutions for this, and how does one call this kinda beast?
0
Comment
Question by:x_terminat_or_3
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 5
12 Comments
 
LVL 17

Accepted Solution

by:
RDAdams earned 250 total points
ID: 18767335
Do you have a protocol sniffer available?  If not get ethereal.  http://www.ethereal.com/

You can limit which protocol to look at etc.  If you can I would stick it on a computer on a hub and attach both the server and the computer to the hub.  That way you can analyze the traffic.  
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767447
Yeah, I know about ethereal, but this is headless server, do you suggest I do this over ssh with X forwarding?  Or can this ethereal (now Wireshark) run without a head?
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767450
headless server in a server farm on the other end of the ocean that is...
0
Creating Instructional Tutorials  

For Any Use & On Any Platform

Contextual Guidance at the moment of need helps your employees/users adopt software o& achieve even the most complex tasks instantly. Boost knowledge retention, software adoption & employee engagement with easy solution.

 
LVL 40

Assisted Solution

by:noci
noci earned 250 total points
ID: 18767607
Have you looked into socat  (http://www.dest-unreach.org/socat/)
you might need to add an option to the tool so that it also
dumps it's data (or enable debugging mode) en disect it;s logfile.
0
 
LVL 40

Expert Comment

by:noci
ID: 18767621
tcpdump  is it's commandline companion....
same filter expressions same pcap format dumpfiles.
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767655
Thank you for the socat suggestion, let's see how it does tomorrow
0
 
LVL 40

Expert Comment

by:noci
ID: 18767722
To clearify tcpdump is wireshark/ethereals commandline companion...

And another, although wireshark/ethereal is graphic, if you have a ssh connection started with the -X option (and X sessions are allowed) then you can view the output on your own screen...., program executes remote though, logfiles also exist there.
The X libraries need to be available on remote too.
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18773002
Tried to make heads and tails of this socat, but it doesn't look as though this can be configured as a real man in the middle to do what I need it doing

s=source process
d=destination process
q=proxy

Normal flow
s<<====>>d

What I want

s<<===>>[ q ]<<===>>d

q also writes stream(s) to specified files so that they can be analysed later.


I tried ethereal on that server but it is red hat's version of wireshark for RHLES 3 and does not seem to have a gui.

I know about all the different layers in networking but not enough to make enough sense of them to configure the program.

If I can get an input stream and an output stream, or maybe one file with both streams in them (as long as they are marked accordingly) then I'll be more then satisfied.
0
 
LVL 40

Expert Comment

by:noci
ID: 18773993
User tcpdump to create a sample like:

tcpdump -s 1500 -w somefile -ni eth0 port WHATEVER

and it will dump traffic (packet data until 1500 bytes enough for normal ehternet)
with either source or destination port WHATEVER (name or number, if http or 80 are equvalent) names are resolved in /etc/services.  

fetch the somefile to a local system and use wireshare/etherreal on that file.

Re. socat,

it is a tool that handles 2way traffic, if you take the source you have everything for a man in the middle except write data to a file. I you take the write routines send data to the other socket and also write the data to (1 or 2 files, you have your data logger).
Maybe you need to add some headers to not which side it travelled to as well as a timestamp).

0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18778437
Can you show me the actual command line I would need to use with socat to achieve what I need, which is listening on port x, and writing everything to port y while saving to a file as well
0
 
LVL 40

Expert Comment

by:noci
ID: 18781674
socat cannot do that currently...,

socat handles two way communication, from a source to a target.
Inside socat all the infrastructure for what you need is there.
The source can be adapted to write not only to a target socket but also to a file..., you can modify socat yourself to do just that.

0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18832761
In the end I installed wireshark-gnome on there and used that to see the packets, and am working from there to reverse-engineer the protocol.

This socat utility is very handy though, so I'll accept that answer.

Thanks
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Short answer to this question: there is no effective WiFi manager in iOS devices as seen in Windows WiFi or Macbook OSx WiFi management, but this article will try and provide some amicable solutions to better suite your needs.
Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…

717 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question