?
Solved

Proxy for port

Posted on 2007-03-21
12
Medium Priority
?
381 Views
Last Modified: 2013-12-23
Hi all

Is there any way to setup some kind of proxy between a program and a server?

We have a service running some shady and obscure protocol that I am trying to port to PHP but not a lot of information is available regarding this protocol, so I want to kinda reverse engineer it by looking at the traffic going on between this program and the remote server.

Is there any way to have a STORE&FORWARD thing on a port?

I mean, let's say this program connects to server X on port n

Client --------------------> X:n

Then, what I want to do is:

Client ------> Client:n ----------> X:n

And have the stream saved to a file

Are there any ready-made solutions for this, and how does one call this kinda beast?
0
Comment
Question by:x_terminat_or_3
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 5
12 Comments
 
LVL 17

Accepted Solution

by:
RDAdams earned 1000 total points
ID: 18767335
Do you have a protocol sniffer available?  If not get ethereal.  http://www.ethereal.com/

You can limit which protocol to look at etc.  If you can I would stick it on a computer on a hub and attach both the server and the computer to the hub.  That way you can analyze the traffic.  
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767447
Yeah, I know about ethereal, but this is headless server, do you suggest I do this over ssh with X forwarding?  Or can this ethereal (now Wireshark) run without a head?
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767450
headless server in a server farm on the other end of the ocean that is...
0
Containers & Docker to Create a Powerful Team

Containers are an incredibly powerful technology that can provide you and/or your engineering team with huge productivity gains. Using containers, you can deploy, back up, replicate, and move apps and their dependencies quickly and easily.

 
LVL 40

Assisted Solution

by:noci
noci earned 1000 total points
ID: 18767607
Have you looked into socat  (http://www.dest-unreach.org/socat/)
you might need to add an option to the tool so that it also
dumps it's data (or enable debugging mode) en disect it;s logfile.
0
 
LVL 40

Expert Comment

by:noci
ID: 18767621
tcpdump  is it's commandline companion....
same filter expressions same pcap format dumpfiles.
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767655
Thank you for the socat suggestion, let's see how it does tomorrow
0
 
LVL 40

Expert Comment

by:noci
ID: 18767722
To clearify tcpdump is wireshark/ethereals commandline companion...

And another, although wireshark/ethereal is graphic, if you have a ssh connection started with the -X option (and X sessions are allowed) then you can view the output on your own screen...., program executes remote though, logfiles also exist there.
The X libraries need to be available on remote too.
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18773002
Tried to make heads and tails of this socat, but it doesn't look as though this can be configured as a real man in the middle to do what I need it doing

s=source process
d=destination process
q=proxy

Normal flow
s<<====>>d

What I want

s<<===>>[ q ]<<===>>d

q also writes stream(s) to specified files so that they can be analysed later.


I tried ethereal on that server but it is red hat's version of wireshark for RHLES 3 and does not seem to have a gui.

I know about all the different layers in networking but not enough to make enough sense of them to configure the program.

If I can get an input stream and an output stream, or maybe one file with both streams in them (as long as they are marked accordingly) then I'll be more then satisfied.
0
 
LVL 40

Expert Comment

by:noci
ID: 18773993
User tcpdump to create a sample like:

tcpdump -s 1500 -w somefile -ni eth0 port WHATEVER

and it will dump traffic (packet data until 1500 bytes enough for normal ehternet)
with either source or destination port WHATEVER (name or number, if http or 80 are equvalent) names are resolved in /etc/services.  

fetch the somefile to a local system and use wireshare/etherreal on that file.

Re. socat,

it is a tool that handles 2way traffic, if you take the source you have everything for a man in the middle except write data to a file. I you take the write routines send data to the other socket and also write the data to (1 or 2 files, you have your data logger).
Maybe you need to add some headers to not which side it travelled to as well as a timestamp).

0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18778437
Can you show me the actual command line I would need to use with socat to achieve what I need, which is listening on port x, and writing everything to port y while saving to a file as well
0
 
LVL 40

Expert Comment

by:noci
ID: 18781674
socat cannot do that currently...,

socat handles two way communication, from a source to a target.
Inside socat all the infrastructure for what you need is there.
The source can be adapted to write not only to a target socket but also to a file..., you can modify socat yourself to do just that.

0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18832761
In the end I installed wireshark-gnome on there and used that to see the packets, and am working from there to reverse-engineer the protocol.

This socat utility is very handy though, so I'll accept that answer.

Thanks
0

Featured Post

Don't Cry: How Liquid Web is Ensuring Security

WannaCry is just the start. Read how Liquid Web is protecting itself and its customers against new threats.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
This month, Experts Exchange’s free Course of the Month is focused on CompTIA IT Fundamentals.
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question