Hnet Info Netware

You can run other modules either using toolbar or menu. Both variants are equivalent.

Packet editor
This module is a text editor with several functions for working with caught packets and logs. All logs created by other modules are automatically moved to the packet editor. Among other functions, packet editor is able to send the content via e-mail using SMTP protocol.

MATRIX
Provides possibility to monitor transmission at selected network interface. Allows logging of all packets, view real-time graphs, summary graphs and statistics. You can of course work only with packets that get to the appropriate network segment. Network interface is switched to promiscuous mode during monitoring, which results in bigger processor load. Interface switched in this way can reply to bad packets on the ethernet (this is a way of detecting interfaces in promiscuous mode, which is commonly used against hackers).

SNMP client
Provides possibility to get information from distant SNMP agents and interpret it in graphics. So far it cannot set particular items in tables. Tables include: table of network interfaces, ARP table, table of IP addresses, routing table and table of connections. Further you can get statistics of network interfaces, IP protocol, ICMP protocol, TCP protocol and UDP protocol. You can create logs from all captured information.

HView
Implements graphical environment for Windows SMB client, which allows overall network browsing.

Local connections
Provides list of all opened local connections and listening ports.

Local statistics
Allow you to get information from local resources (IP helper) and interpret it in graphical form. So far it cannot set particular local tables. Tables include: table of local interfaces, ARP table, IP addresses table, routing table and connections table. Further you can get statistics of local interfaces, IP protocol, ICMP protocol, TCP protocol and UDP protocol. You can create logs from all captured information.

Packet capture
Allows you to capture packets on selected interface and analyze them deeply. Network interface is switched to promiscuity mode. Of course, you can capture only packets in appropriate network segment. Packet analysis includes MAC header analysis, IP and IPX headers and for IP protocol analysis of TCP, UDP headers and ICMP messages. Further the analysis includes recognition of application level protocol according to ports and possible search and view of passwords from autentification services' packets and in POP3 protocols.

Packet generator
Is designed to generate own packets including own MAC header and send them to chosen interface. Allows generation of larger amount of those packets in order to simulate network load.

HPing
Creates list of stations that will be pinged in certain time interval. Allows you to create logs from particular pings and graphical interpretation of response time.

Finger
Implements standard Finger protocol client.

WhoIs
Implements standard WhoIs protocol client.

TraceRoute
Is a graphical version of standard traceroute tool. Provides graphical interpretation of particular routers response.

DNS lookup
Is a graphical version of standard tool for monitoring DNS servers records.

Scan ports
Is designed to scan particular ports in given range on selected hosts (you can set range of IP addresses too). In case that there is another service listening on the port being scanned and it sends initialization string, it is displayed. It detects if there is an active SNMP client too. If there is a HTTP server detected, some further information about it is displayed.

Remote shutdown
Allows you to make remote restart of another computer running Windows NT or Windows 2000. Remote restart can be initialized only by user administrator from OS Windows or Windows 2000.

BASE64 encoder/decoder
Encodes/Decodes parts of text using BASE64 system. This system is used to transmit strings via channels with bandwidth of 7 bits and is commonly unreadable.

Packet editor
Is a common text editor that is able to save files as a plain text, RTF or HTML (File->Save as...), print (File->Print) and forwarding the content via mail using SMTP protocol. To use this function you must have correctly setup SMTP server and sender's name in the Settings. Send itself (File->Send by E-mail) requires entered recipient's address and enables you to set the priority, subject and copies.


MATRIX

Having selected an adapter, press the button Start and network starts to be scanned. Results can be logged to a summary log (you can set path on a fold MAC layer log and IP layer log). You can see only current part of the log on the screen. MAC layer log records all valid packets that come to the interface. IP layer log records only valid IP packets that come to the interface. Statistics is being created (fold Statistics), which contain IP addresses, share of computer in bandwidth usage in percent and summary information about number of packets and bytes of a particular computer.
Created graphs: graph Packet counter summarizes how many packets were sent or received by a single computer in comparison to others. Data transmission graph summarizes share of single computers on bandwidth load. Real-time graphs are also being created: packets/second, which summarizes how many packets get to an interface and graph bytes/second, which shows how many bytes passed through the scanned interface. A real-time transmission graph is also being created, showing the station currently loads the network at most.
Selected interface is switched to promiscuity mode during scanning, so it is able to catch all valid packets that get to appropriate network segment.
Statistics can be moved to Packet editor by the button Edit, where you can print it, send it by mail or save it.


SNMP client

After you have selected target computer's address (you can enter IP address in format 192.168.1.2, MAC address in format AB:CD:EF:12:34:56, or domain name), press the button for start and client connects to a SNMP agent. If the agent is active and provides all information, the data is stored and ready for browsing. You can browse selected parts or remote MIB by selecting a category form left part of the window. In the right part, there are appropriate items from the remote MIB. You can create a log from particular items, which will automatically emerge in the packet editor. You can also create a summary log from all obtained information.


HView

This tool shows resources shared by Server Message Block protocol (SMB, Microsoft sometimes refers it as CIPE). Shared items are divided to three categories: stations, shared disks and shared printers. HView is designed especially to create lists of computers in the network (creates log) and to overall monitoring of computers and shared disks. It finds out IP address of each computer, working group that the computer belongs to, and its MAC address. In some cases, the MAC address detection may fail. In this case, the MAC address field contains ??:??:??:??:??:??. It happens especially when scanning SAMBA server, because usually it cannot conveniently handle MAC address request. Each shared directory may be opened by double clicking in the Microsoft Explorer.


Local connection

This table displays either all active local connections (only TCP indeed) or all opened sockets (TSCP and UDP) - both connected and listening only ports.


Local stats

Local statistics

Allows browsing of selected parts of a local MIB. You can browse it by selecting a category form left part of the window. In the right part, there are appropriate items from the local MIB. You can create a log from particular items, which will automatically emerge in the packet editor. You can also create a summary log from all obtained information.


Capture packets

Having selected an interface and pressed the start button, the interface is switched to promiscuity mode and begins to capture all packets, comming to it. These packets are then displayed in a form of a list, which contain packet serial number from capture begin, originating and destination MAC address, length and time of capture. Further for packets containing IP header originating and destination IP address and for packets containing TCP or UDP header shows originating and destination port and name of the application protocol belonging to these ports.

Complete content of a caught packet beginning with MAC header can be viewed by single clicking over the appropriate packet. Packet can be copied to packet editor by clicking the button Edit. Packet is captured starting form MAC header. Synchronisation preamble, which precede each packet, is not captured nor viewed, because it is only overhead of method to media access and has no relevant information. In case that you want to analyze synchronisation preambles, quiescent signal or damaged frames we recommend to use so-called hardware packet catcher with own software.

Selected packet can be deeply analyzed by double clicking it, or selecting it and pressing the Analyze button. Analysis is displayed in a newly opened window. Packet analysis contains information which interface captured it and time of capture. It contains further MAC header analysis, and next layer protocol recognition. Over the MAC layer it allows to analyze links layer frames analysis: IP frames, ARP frames and recognize and print of IPX/SPX frames, NetBIOS and others. MAC layer support of course Ethernet, Ethernet II and LCC. It detects from ARP frame, if it is request or response and then originating pair of MAC and IP addresses and destination pair of addresses.

IP analysis provides analysis only according to IPv4 and picks out all relevant information from and IP header. Over the IP can be TCP, UDP or ICMP. ICMP packets are decomposed and all relevant information from them is displayed, like ICMP message type and completive message parameters. TCP and UDP headers are decomposed to relevant information like originating and destination port, length etc. Further, the user data field is displayed followed by optional completive analysis. For POP3 protocol, there is emphasized part USER and PASS (password) for authentificartion packets. Packets for proxy server authentification, where system BASE64 is used to encode username and password, have these fields decoded. In the last part, there is name of the application layer protocol or some other information. The complete analysis can be copied to the packet editor for further manipulation - see Packet editor.

Software compatibility is characterized by compatibility with operating systems and hardware, in details with different hardware drivers in a specific operating system. Generally, the software can be run on systems Windows 95 OSR2, 98, ME. For run on systems Windows 95 and Windows 95 OSR1, you need to install the latest possible service pack. Software can be run on Windows NT 4.0 and Windows 2000. Its main designation is platform NT, so some functions (in the concrete SNMP) do not work on Windows family 9x/ME.
Hardware compatibility is substantive for modules Hnet Info Netware, which use a collection of libraries for direct hardware or NDIS access. These drivers are implemented less generally and are designed for commonly available hardware. Target resources are mainly Ethernet cards, which are supported in full scope i.e. Ethernet 10Mbps, 100Mbps and 1Gbps hardware. Another target resources are hardware modems. Hardware modems are supported so far, how compatible are their drivers with standard modem definition according to standards. Ideal are external modems, because they have given interface and producers have no room to forge extra enhancements. On the contrary there are software modems (co-called WinModems), which do not abide with standards and specifications and where modem contains only the part for conversion of analog signal to digital, but the modem itself is emulated by driver. There the compatility depends on drivers a lot. These modems may cause lot of problems. Software supports FDDI too, but only limited number of hardware.


Packet generator

Packet generator allows sending chosen number of packets to selected interface (choose Constant number and set number of packets), or unlimited number of packets (sends packets until user cancels). Set the content of the packet in main field in hexadecimal form using numbers and upper-case characters A-F. Other characters are ignored. Set complete packet including MAC header. You should therefore enter at least valid MAC header (see actual RFC, describing MAC header) Second field displays the entered values of the packet in ASCII and is designed as a reference only. Invalid entered MAC header could in combination with paranoiac switches or another active network parts configuration, cause failure of specific network segment or collision state at a specific segment, which could cause failure of station where has the collision occurred. We recommend to set the MAC header with correct destinating as well as originating MAC address, if you do not intend to change the identity. In case of willful entering of invalid MAC header, we recommend to check the active parts of the network in order not to disconnect the appropriate network segment after first packet with this spurios MAC header arrives, or do not stop its function completely in consequence to collision state detection.

If you click the start button, packets will begin to be sent to network interface. The speed of send depends especially on given hardware drivers, on processor speed and on loop timing setting of the operating system. Generally stands that it reaches the speed of singles or tens of percent of network interface speed (this concerns especially Ethernet or FDDI, but does not concern modems and similar interfaces with very low transmission speed). To simulate the network load, we recommend to use for this purpose designed packet generators, usually implemented for Unix-based OS, because the Windows platform is generally unsuitable for these activities. Exception are programs with own drivers for majority of commonly used network hardware and which enable direct access to the hardware and do not use NDIS, but these are commonly unstable and at least have problems with uncommon hardware compatibility. For testing the network transmissivity, we recommend trying libraries PCap.

The progress of sending packets is displayed in the upper part of the window, where you can see number of sent packets, and number of packets to be sent together with graphical representation of these values. In case you chose unlimited number of packets, only number of sent packets is relevant and graphical representation does not have any sense too.


HPing

This module creates list of computers, which are going to be pinged periodically. List is created by pressing the button Add. A dialog opens, prompting you for monitored computer address, ping period and other completive information for ping. After you enter the values and click OK, the record is added to the table of monitored computers. Monitoring is started by selecting appropriate record in the table and pressing Start. In the bottom part of the window, there will be appearing results of each ping. You can switch on graphical representation too. Graph displays always one ping as one graph peak and because graph scrolls to left, you can see response time of a monitored station in the past and optically compare it.


Finger

Provides possibility of making Finger request and display the reply. Finger can connect to a server (if there is fingerd running) and get information about currently connected users (only if server's address is entered), or it allows you to view relevant information about a particular user. (if both fields <user >@<server>, e.g. hacker@victim.mil, are entered). Contrariwise, most of administrators bar fingerd, because it allows to get too much "relevant" information, which might have certain value for hackers. In addition, fingerd is not very popular for many security incidents caused by buffer over-flow in the daemon causing its crash into shell as the root (this bug was fixed already in 1994 versions, but fingerd is not still considered as safe and furthermore necessary). For above-mentioned reasons, some administrators substitute fingerd with simple service, which only prints out message like "Welcome to server victim.mil, mail addresses of local users are <firstname>.<lastname>@victim.mil, for example john.hacker@victim.mil" because among others, users are used to checking e-mail addresses with Finger too.


WhoIs

This Internet service should theoretically maintain at several places relevant information about most of the servers in the Internet. Regarding to heftiness of this task is WhoIs service more or less unusable and usually has no information value. Most of the WhoIs servers have information about servers like altavista.com, but only hardly know anything about something less important.


Trace route

Trace route is a graphical implementation of this well-known tool, so there is no need to explain its function nor purpose. After setting of target, maximum number of hops and timeout of particular nodes, the route tracing can be run by pressing the start button. First, the target is pinged and if the response is within the timeout, the route starts to be traced. Single hops with times are displayed in the bottom part of the window. A graph is being created too, presenting time needed to reach particular gateways (routers). Notice that masquerading gates behave usually as two single hops.


DNS lookup

DNS lookup is a graphical version of well-known tool, so there is no need to explain its function or purpose. After entering the DNS server, queried domain and query type, the query is run by pressing the button Go and the result is displayed in the bottom part of the window.


Ports scanner

Ports scanner allows scan of particular TCP ports on selected stations (or IP addresses range). It is necessary to set the beginning and ending IP address of the range. In case of scanning one computer only, the same address is set to both fields. After that, it is necessary to setup port range and press Start. The scanned computer will be pinged at first, then it will be tested for presence of snmpd by tying to connect via SNMP protocol, and finally particular ports from selected range will be scanned. In the bottom part, there are only SNMP scan result and ports that are being listened or communicated. For ports being listened there is an initialization string sent by server after connection, which may suggest server's version and other information. Some ports , e.g. 80 (HTTP), contain some additional information in the field Further information. However, this information is collected by directly querying the server and in many cases the server is not set up to be willing and able to provide this information.

The tool may be used to detect ports opened unreasonably and which might help hackers to penetrate. Furthermore, it provides summary information about server's possibilities and security politics. Notice: OS Windows 9x, ME does not support SNMP and it is not possible to detect SNMP on remote computers from those OSs. This fact is indicated by appropriate message in the application. The only OSs with support for SNMP from Windows family are Windows NT 4.0 and Windows 2000.


Remote shutdown

Provides you with a possibility to restart a distant computer running Windows NT 4.0 or Windows 2000. However, in order to do the restart, you must have Windows NT 4.0 or Windows 2000 installed too, since the family of Windows 9x/ME does not support remote restart request sending as well as does not accept these requests. To provide remote restart, if you fulfil the above-mentioned OS requirements, just select a remote computer and choose if you would like to force it to restart or close all tasks before the restart, enter a message that will be displayed on the remote computer before restart and select the period the message will be displayed. After pressing the OK button, the remote system will be restarted. Restart of the remote machine may be canceled by pressing the Cancel button till certain progress.


BASE64 encoder/decoder

Makes possible to encode/decode parts of text using the system BASE64. All you need is to enter the text to the Source and press either the button for encoding or for decoding. The resulting text will be presented in the destination field. BASE64 is a system designed for transmission at channels with bandwidth 7 bits instead of 8 bits. It became popular because encoded strings are not readable for humans and it started to be used in cases where we do not need extra security but where is not suitable that encoded text could read anyone sniffing the network. It is used for example to make unreadable authorization for certain proxy servers. It is also included in the MIME standard.


Packet editor

Is a common text editor that is able to save files as a plain text, RTF or HTML (File->Save as...), print (File->Print) and forwarding the content via mail using SMTP protocol. To use this function you must have correctly setup SMTP server and sender's name in the Settings. Send itself (File->Send by E-mail) requires entered recipient's address and allows you to set the priority, subject and copies.


Useful links

http://www.iana.org (publishes up-to-date RFC and a lot of useful documents)
http://www.rsasecurity.com
http://www.pgpi.org
http://www.att.com
http://www.nsa.gov
http://www.berkeley.edu