Solved

Proxy for port

Posted on 2007-03-21
12
362 Views
Last Modified: 2013-12-23
Hi all

Is there any way to setup some kind of proxy between a program and a server?

We have a service running some shady and obscure protocol that I am trying to port to PHP but not a lot of information is available regarding this protocol, so I want to kinda reverse engineer it by looking at the traffic going on between this program and the remote server.

Is there any way to have a STORE&FORWARD thing on a port?

I mean, let's say this program connects to server X on port n

Client --------------------> X:n

Then, what I want to do is:

Client ------> Client:n ----------> X:n

And have the stream saved to a file

Are there any ready-made solutions for this, and how does one call this kinda beast?
0
Comment
Question by:x_terminat_or_3
  • 6
  • 5
12 Comments
 
LVL 17

Accepted Solution

by:
RDAdams earned 250 total points
ID: 18767335
Do you have a protocol sniffer available?  If not get ethereal.  http://www.ethereal.com/

You can limit which protocol to look at etc.  If you can I would stick it on a computer on a hub and attach both the server and the computer to the hub.  That way you can analyze the traffic.  
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767447
Yeah, I know about ethereal, but this is headless server, do you suggest I do this over ssh with X forwarding?  Or can this ethereal (now Wireshark) run without a head?
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767450
headless server in a server farm on the other end of the ocean that is...
0
 
LVL 39

Assisted Solution

by:noci
noci earned 250 total points
ID: 18767607
Have you looked into socat  (http://www.dest-unreach.org/socat/)
you might need to add an option to the tool so that it also
dumps it's data (or enable debugging mode) en disect it;s logfile.
0
 
LVL 39

Expert Comment

by:noci
ID: 18767621
tcpdump  is it's commandline companion....
same filter expressions same pcap format dumpfiles.
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18767655
Thank you for the socat suggestion, let's see how it does tomorrow
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 
LVL 39

Expert Comment

by:noci
ID: 18767722
To clearify tcpdump is wireshark/ethereals commandline companion...

And another, although wireshark/ethereal is graphic, if you have a ssh connection started with the -X option (and X sessions are allowed) then you can view the output on your own screen...., program executes remote though, logfiles also exist there.
The X libraries need to be available on remote too.
0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18773002
Tried to make heads and tails of this socat, but it doesn't look as though this can be configured as a real man in the middle to do what I need it doing

s=source process
d=destination process
q=proxy

Normal flow
s<<====>>d

What I want

s<<===>>[ q ]<<===>>d

q also writes stream(s) to specified files so that they can be analysed later.


I tried ethereal on that server but it is red hat's version of wireshark for RHLES 3 and does not seem to have a gui.

I know about all the different layers in networking but not enough to make enough sense of them to configure the program.

If I can get an input stream and an output stream, or maybe one file with both streams in them (as long as they are marked accordingly) then I'll be more then satisfied.
0
 
LVL 39

Expert Comment

by:noci
ID: 18773993
User tcpdump to create a sample like:

tcpdump -s 1500 -w somefile -ni eth0 port WHATEVER

and it will dump traffic (packet data until 1500 bytes enough for normal ehternet)
with either source or destination port WHATEVER (name or number, if http or 80 are equvalent) names are resolved in /etc/services.  

fetch the somefile to a local system and use wireshare/etherreal on that file.

Re. socat,

it is a tool that handles 2way traffic, if you take the source you have everything for a man in the middle except write data to a file. I you take the write routines send data to the other socket and also write the data to (1 or 2 files, you have your data logger).
Maybe you need to add some headers to not which side it travelled to as well as a timestamp).

0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18778437
Can you show me the actual command line I would need to use with socat to achieve what I need, which is listening on port x, and writing everything to port y while saving to a file as well
0
 
LVL 39

Expert Comment

by:noci
ID: 18781674
socat cannot do that currently...,

socat handles two way communication, from a source to a target.
Inside socat all the infrastructure for what you need is there.
The source can be adapted to write not only to a target socket but also to a file..., you can modify socat yourself to do just that.

0
 
LVL 2

Author Comment

by:x_terminat_or_3
ID: 18832761
In the end I installed wireshark-gnome on there and used that to see the packets, and am working from there to reverse-engineer the protocol.

This socat utility is very handy though, so I'll accept that answer.

Thanks
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Suggested Solutions

Short answer to this question: there is no effective WiFi manager in iOS devices as seen in Windows WiFi or Macbook OSx WiFi management, but this article will try and provide some amicable solutions to better suite your needs.
If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now