Solved

Proxy for port

Posted on 2007-03-21
12
377 Views
Last Modified: 2013-12-23
Hi all

Is there any way to setup some kind of proxy between a program and a server?

We have a service running some shady and obscure protocol that I am trying to port to PHP but not a lot of information is available regarding this protocol, so I want to kinda reverse engineer it by looking at the traffic going on between this program and the remote server.

Is there any way to have a STORE&FORWARD thing on a port?

I mean, let's say this program connects to server X on port n

Client --------------------> X:n

Then, what I want to do is:

Client ------> Client:n ----------> X:n

And have the stream saved to a file

Are there any ready-made solutions for this, and how does one call this kinda beast?
0
Comment
Question by:x_terminat_or_3
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 5
12 Comments
 
LVL 17

Accepted Solution

by:
RDAdams earned 250 total points
ID: 18767335
Do you have a protocol sniffer available?  If not get ethereal.  http://www.ethereal.com/

You can limit which protocol to look at etc.  If you can I would stick it on a computer on a hub and attach both the server and the computer to the hub.  That way you can analyze the traffic.  
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767447
Yeah, I know about ethereal, but this is headless server, do you suggest I do this over ssh with X forwarding?  Or can this ethereal (now Wireshark) run without a head?
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767450
headless server in a server farm on the other end of the ocean that is...
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 40

Assisted Solution

by:noci
noci earned 250 total points
ID: 18767607
Have you looked into socat  (http://www.dest-unreach.org/socat/)
you might need to add an option to the tool so that it also
dumps it's data (or enable debugging mode) en disect it;s logfile.
0
 
LVL 40

Expert Comment

by:noci
ID: 18767621
tcpdump  is it's commandline companion....
same filter expressions same pcap format dumpfiles.
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767655
Thank you for the socat suggestion, let's see how it does tomorrow
0
 
LVL 40

Expert Comment

by:noci
ID: 18767722
To clearify tcpdump is wireshark/ethereals commandline companion...

And another, although wireshark/ethereal is graphic, if you have a ssh connection started with the -X option (and X sessions are allowed) then you can view the output on your own screen...., program executes remote though, logfiles also exist there.
The X libraries need to be available on remote too.
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18773002
Tried to make heads and tails of this socat, but it doesn't look as though this can be configured as a real man in the middle to do what I need it doing

s=source process
d=destination process
q=proxy

Normal flow
s<<====>>d

What I want

s<<===>>[ q ]<<===>>d

q also writes stream(s) to specified files so that they can be analysed later.


I tried ethereal on that server but it is red hat's version of wireshark for RHLES 3 and does not seem to have a gui.

I know about all the different layers in networking but not enough to make enough sense of them to configure the program.

If I can get an input stream and an output stream, or maybe one file with both streams in them (as long as they are marked accordingly) then I'll be more then satisfied.
0
 
LVL 40

Expert Comment

by:noci
ID: 18773993
User tcpdump to create a sample like:

tcpdump -s 1500 -w somefile -ni eth0 port WHATEVER

and it will dump traffic (packet data until 1500 bytes enough for normal ehternet)
with either source or destination port WHATEVER (name or number, if http or 80 are equvalent) names are resolved in /etc/services.  

fetch the somefile to a local system and use wireshare/etherreal on that file.

Re. socat,

it is a tool that handles 2way traffic, if you take the source you have everything for a man in the middle except write data to a file. I you take the write routines send data to the other socket and also write the data to (1 or 2 files, you have your data logger).
Maybe you need to add some headers to not which side it travelled to as well as a timestamp).

0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18778437
Can you show me the actual command line I would need to use with socat to achieve what I need, which is listening on port x, and writing everything to port y while saving to a file as well
0
 
LVL 40

Expert Comment

by:noci
ID: 18781674
socat cannot do that currently...,

socat handles two way communication, from a source to a target.
Inside socat all the infrastructure for what you need is there.
The source can be adapted to write not only to a target socket but also to a file..., you can modify socat yourself to do just that.

0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18832761
In the end I installed wireshark-gnome on there and used that to see the packets, and am working from there to reverse-engineer the protocol.

This socat utility is very handy though, so I'll accept that answer.

Thanks
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
tamper proof asset tags - benefits 4 60
assignment of laptops - risks 6 85
Problems with VPN 4 25
VMware:  Virtual switches and multiple NICs 9 52
If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
Meet the world's only “Transparent Cloud™” from Superb Internet Corporation. Now, you can experience firsthand a cloud platform that consistently outperforms Amazon Web Services (AWS), IBM’s Softlayer, and Microsoft’s Azure when it comes to CPU and …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question