
			Poor-man's-sniffer.
			===================
		
Description:
	This is a net-sniffer password-grabber system V1.1.
	It is based on Linux (kernel 2.07) and uses a 2Mb Ramdisk.
	Everything fits onto 1 (yes ONE) floppy.

Files:
	Readme		:	You're reading it.
	floppy.raw	:	A floppy-disk image
	rawrite.exe	: 	DOS utility to make the floppy.

To Install:
	Put a formatted floppy in drive 'A' and run 'rawrite' 
	Enter disk Image source file name: <answer: floppy.raw>
	Enter target diskette drive: <answer: A:>

To Use:
	Boot your machine from DOS.
	But the floppy in the floppy-drive and chdir to it. (cd A:)
	write "loadlin vmlinuz"  [enter]
	When "Insert floppy disk for loading into RAMDISK" appears, 
	press Enter.
	Answer the questions about IP#, netmask etc ...
	Login as 'root' (no password)
	(There is also a 'root2' user that you can try)

The commands awailable (ls /bin):
	cat        getty      login      ps         sh         tcpdump
	chmod      halt       ls         reboot     showmount  telnet
	chown      hostname   rm         shutdown   umount     cp
        ifconfig   mkdir      route      sniffer    vi         df
        init       mount      rpcinfo    strobe     view       ftp
        kill       ping       sash       su

	Note: You can get strobe from ftp://suburbia.net:/pub/strobe.tgz
	      (To get the manual)
	      (strobe is a "Super optimized TCP port surveyor")
	Note2: Write 'sniffer' without arguments to get help.
	Note3: You can get tcpdump from ftp://ftp.ee.lbl.gov/tcpdump-*.tar.Z
	      (To get the manual)

Caveats:
	There are no man-pages and no other documentation than this.
	
Supported Networking cards:
	3com:
		501, 503, 505, 507, 509, 579, 592, 295, 597
	Western Digital/SMC cards:
		WD80*3, SMC Ultra, SMC 9194
	HP cards:
		HP PCLAN 27247B, 27252A

Bonuses:
	The floppy can be converted into a self-booting system by using 
	'rawrite' to write 'vmlinuz' onto the floppy (A:).

	There is a undocumented switch in tcpdump '-D' When applyed
	tcpdump will attempd to decode the data in TCP packets.
	
	Try: tcpdump -D -s100 port 110  
	(for POP traffic)

Tips:
	You can mount a clean floppy (mount -t msdos /dev/fd0 /mnt) and
	write data to it. (sniffer -f /mnt/sniffed.raw)

Where-to-get-it:
	http://www.rhi.hi.is/~rikardur/analyzer.zip

Comment: 
	If you have any suggestions on changes, new programs or just anything
	mail them to : "rikardur@skyrr.is". 
