packeting sniffing on OS X

[j00d]

Hi,

I'm trying to demonstrate to my co-workers that ftp is a really bad idea, security-wise, for transferring files to our clients.

What packet sniffing software works well on OSX? I was able to show passwords in the clear before on hubs using snort, but the snort.org site only seems to offer RPM's and before i put in the effort to learn to compile something on OSX for the first time, I'd like to know if it's still a viable product on OSX.

If there are other apps other than snort, I'd love to hear about them also. Our office uses a Dell gigabit switch.

Thanks,

john

 

[munkery]

Cocoa Packet Analyzer has a lot of features and a cocoa GUI.

 

[iMouse]

CPA is okay, but if you want something a little more powerful, use Wireshark.

(Runs with X11)
http://www.wireshark.org/download.html

(Runs as a Mac-native binary without X11)
http://www.christian-hornung.de/

 

[dyn]

Or use what comes with OS X by default: tcpdump. It's a commandline utility though.

If you want to sniff on the switch things become a bit more complicated because you need to setup a monitoring port and hook the Mac up to that port. With a switch you can only see your own traffic, not that of your neighbours. Most switches have the option for a monitoring port. Simply put the switch will dump a copy of all the traffic at that port.