Solved

Proxy for port

Posted on 2007-03-21
12
374 Views
Last Modified: 2013-12-23
Hi all

Is there any way to setup some kind of proxy between a program and a server?

We have a service running some shady and obscure protocol that I am trying to port to PHP but not a lot of information is available regarding this protocol, so I want to kinda reverse engineer it by looking at the traffic going on between this program and the remote server.

Is there any way to have a STORE&FORWARD thing on a port?

I mean, let's say this program connects to server X on port n

Client --------------------> X:n

Then, what I want to do is:

Client ------> Client:n ----------> X:n

And have the stream saved to a file

Are there any ready-made solutions for this, and how does one call this kinda beast?
0
Comment
Question by:x_terminat_or_3
  • 6
  • 5
12 Comments
 
LVL 17

Accepted Solution

by:
RDAdams earned 250 total points
ID: 18767335
Do you have a protocol sniffer available?  If not get ethereal.  http://www.ethereal.com/

You can limit which protocol to look at etc.  If you can I would stick it on a computer on a hub and attach both the server and the computer to the hub.  That way you can analyze the traffic.  
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767447
Yeah, I know about ethereal, but this is headless server, do you suggest I do this over ssh with X forwarding?  Or can this ethereal (now Wireshark) run without a head?
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767450
headless server in a server farm on the other end of the ocean that is...
0
Master Your Team's Linux and Cloud Stack

Come see why top tech companies like Mailchimp and Media Temple use Linux Academy to build their employee training programs.

 
LVL 40

Assisted Solution

by:noci
noci earned 250 total points
ID: 18767607
Have you looked into socat  (http://www.dest-unreach.org/socat/)
you might need to add an option to the tool so that it also
dumps it's data (or enable debugging mode) en disect it;s logfile.
0
 
LVL 40

Expert Comment

by:noci
ID: 18767621
tcpdump  is it's commandline companion....
same filter expressions same pcap format dumpfiles.
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767655
Thank you for the socat suggestion, let's see how it does tomorrow
0
 
LVL 40

Expert Comment

by:noci
ID: 18767722
To clearify tcpdump is wireshark/ethereals commandline companion...

And another, although wireshark/ethereal is graphic, if you have a ssh connection started with the -X option (and X sessions are allowed) then you can view the output on your own screen...., program executes remote though, logfiles also exist there.
The X libraries need to be available on remote too.
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18773002
Tried to make heads and tails of this socat, but it doesn't look as though this can be configured as a real man in the middle to do what I need it doing

s=source process
d=destination process
q=proxy

Normal flow
s<<====>>d

What I want

s<<===>>[ q ]<<===>>d

q also writes stream(s) to specified files so that they can be analysed later.


I tried ethereal on that server but it is red hat's version of wireshark for RHLES 3 and does not seem to have a gui.

I know about all the different layers in networking but not enough to make enough sense of them to configure the program.

If I can get an input stream and an output stream, or maybe one file with both streams in them (as long as they are marked accordingly) then I'll be more then satisfied.
0
 
LVL 40

Expert Comment

by:noci
ID: 18773993
User tcpdump to create a sample like:

tcpdump -s 1500 -w somefile -ni eth0 port WHATEVER

and it will dump traffic (packet data until 1500 bytes enough for normal ehternet)
with either source or destination port WHATEVER (name or number, if http or 80 are equvalent) names are resolved in /etc/services.  

fetch the somefile to a local system and use wireshare/etherreal on that file.

Re. socat,

it is a tool that handles 2way traffic, if you take the source you have everything for a man in the middle except write data to a file. I you take the write routines send data to the other socket and also write the data to (1 or 2 files, you have your data logger).
Maybe you need to add some headers to not which side it travelled to as well as a timestamp).

0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18778437
Can you show me the actual command line I would need to use with socat to achieve what I need, which is listening on port x, and writing everything to port y while saving to a file as well
0
 
LVL 40

Expert Comment

by:noci
ID: 18781674
socat cannot do that currently...,

socat handles two way communication, from a source to a target.
Inside socat all the infrastructure for what you need is there.
The source can be adapted to write not only to a target socket but also to a file..., you can modify socat yourself to do just that.

0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18832761
In the end I installed wireshark-gnome on there and used that to see the packets, and am working from there to reverse-engineer the protocol.

This socat utility is very handy though, so I'll accept that answer.

Thanks
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
extend vlan through a layer 3 connection 31 147
Need help with VLAN issue 6 59
ifconfig 4 46
How to change the nameserver on Ubuntu Server 6 20
Meet the world's only “Transparent Cloud™” from Superb Internet Corporation. Now, you can experience firsthand a cloud platform that consistently outperforms Amazon Web Services (AWS), IBM’s Softlayer, and Microsoft’s Azure when it comes to CPU and …
Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

778 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question