synsniff.pl v0.4b - a SYN sniffer in perl
James W. Abendschan (jwa@nbs.nau.edu)
29 March 1996

WHAT IT NEEDS:

Required programs: tcpdump, perl (written in perl v5.002)
Tested under Solaris 2.3 and Linux 1.2; should work on any unix
w/ perl5 and tcpdump.

WHAT IT DOES:

synsniff, as the name would imply, is a simple program which watches for
inbound connections (SYNs) to a particular network and logs them.

This is particularly helpful if you're concerned about security
and want to watch for "suspcious" inbound connections, but don't
want to page through megs of tcpdump logs.  synsniff logs
only connections which originate on a net other than the specified net
and are destined for the specified net.

synsniff will also attempt to identify portscans and flag them as
such.

Sample run:

03/15 13:32:22 -- monitoring network 134.114.84
03/15 13:32:22 -- ignoring ports [80 113]
03/15 13:32:22 -- logging started

03/15 13:38:50 tcp rs1.internic.net:43 -> canyon.nbs.nau.edu:1248 

	[ whois reply from canyon to rs1 - the initial whois request
          is not seen because we're ignoring data that originates from our 
          network. ]

03/15 13:42:35 tcp sitanion.nrel.colostate.edu:32795 -> ecosys.nbs.nau.edu:25 

	[ mail from sitanion to ecosys ]

03/15 13:48:54 tcp nauvax.ucc.nau.edu:110 -> mac4.cps.nau.edu:1281 

	[ pop reply from mac4 ]

03/15 14:13:30 tcp naumvs.ucc.nau.edu:23 -> pc1.cps.nau.edu:3343 

	[ telnet reply from naumvs to pc1 ]

03/15 14:35:05 tcp jan.ucc.nau.edu:4995 -> north1lt-gw.net.nau.edu:21 
03/15 14:35:06 tcp jan.ucc.nau.edu:20503 -> north1lt-gw.net.nau.edu:23 
03/15 14:35:12 tcp jan.ucc.nau.edu:32079 -> north1lt-gw.net.nau.edu:25 
03/15 14:35:12 tcp jan.ucc.nau.edu:22165 -> north1lt-gw.net.nau.edu:79 
03/15 14:35:12 tcp jan.ucc.nau.edu:27945 -> north1lt-gw.net.nau.edu:119 
03/15 14:35:12 tcp jan.ucc.nau.edu:3170 -> north1lt-gw.net.nau.edu:139 [PORTSCAN]
03/15 14:35:13 tcp jan.ucc.nau.edu:28472 -> north1lt-gw.net.nau.edu:8000 
03/15 14:35:13 tcp jan.ucc.nau.edu:19618 -> north1lt-gw.net.nau.edu:8080 
03/15 14:35:24 tcp jan.ucc.nau.edu:10633 -> pc3.nbs.nau.edu:21 
03/15 14:35:25 tcp jan.ucc.nau.edu:28363 -> pc3.nbs.nau.edu:23 
03/15 14:35:26 tcp jan.ucc.nau.edu:6071 -> pc3.nbs.nau.edu:25 
03/15 14:35:26 tcp jan.ucc.nau.edu:12533 -> pc3.nbs.nau.edu:79 
03/15 14:35:28 tcp jan.ucc.nau.edu:17480 -> pc3.nbs.nau.edu:119 
03/15 14:35:30 tcp jan.ucc.nau.edu:24997 -> pc3.nbs.nau.edu:139 
03/15 14:35:31 tcp jan.ucc.nau.edu:1333 -> pc3.nbs.nau.edu:8000 
03/15 14:35:32 tcp jan.ucc.nau.edu:6116 -> pc3.nbs.nau.edu:8080 
03/15 14:35:33 tcp jan.ucc.nau.edu:32976 -> pc1.cps.nau.edu:21 
03/15 14:35:33 tcp jan.ucc.nau.edu:14594 -> pc1.cps.nau.edu:23 
03/15 14:35:33 tcp jan.ucc.nau.edu:30785 -> pc1.cps.nau.edu:25 
03/15 14:35:34 tcp jan.ucc.nau.edu:32289 -> pc1.cps.nau.edu:79 
03/15 14:35:34 tcp jan.ucc.nau.edu:7282 -> pc1.cps.nau.edu:119 
03/15 14:35:34 tcp jan.ucc.nau.edu:7857 -> pc1.cps.nau.edu:139 
03/15 14:35:34 tcp jan.ucc.nau.edu:18308 -> pc1.cps.nau.edu:8000 [PORTSCAN]
03/15 14:35:34 tcp jan.ucc.nau.edu:20482 -> pc1.cps.nau.edu:8080 
03/15 14:35:34 tcp jan.ucc.nau.edu:6488 -> plateau.nbs.nau.edu:21 

	[ small portscan of a few systems ] 

03/15 14:42:51 tcp bogus8.ut.blm.gov:1048 -> plateau.nbs.nau.edu:21 

	[ ftp from bogus8 to plateau ]

03/15 14:43:59 tcp pine.cse.nau.edu:79 -> ecosys.nbs.nau.edu:54038 

	[ finger reply from pine to ecosys ]

03/15 14:53:10 tcp info.asu.edu:70 -> pc2.cps.nau.edu:3222 

	[ gopher reply from info to pc2 ]

HOW TO USE IT.

Adjust @exclude_ports to list the ports you don't want synsniff to watch.
Modify $net to reflect the network you want to watch
Make sure you have perl and tcpdump in the path.
Run it.

NOTES

By default, I'm excluding WWW (80/tcp) and ident (113/tcp) traffic
because they tend to use alot of traffic and are one-way connections.

BUGS

If name resolution takes forever, synsniff will miss some data.
the program works like so:

 while (reading a line from tcpdump) {
  analyze the line
  ask dns for the src and dst ip addresses
  print the line
 }

To help even things out, i'm using a gethostbyaddr routine lifted
from zen & venom's "SATAN" tool; it automatically caches DNS lookups
for faster results.  However, it can still be hosed by slow DNS servers.

