I installed Etherpeek 2.05 onto one of my "stock" SE/30s (8 meg RAM, 40 Meg HD, Asante MacCon network card, system 7.5.5). I've used Etherpeek for Windows extensively and so I was somewhat familiar with the application's indiosyncracies. I connected the SE/30 to my test LAN which also hosts my Win2K workstation and a Win98 testbed machine. I fired up a packet capture app on my Win2k box (Commview) and opened up a chargen connection to the testbed. I compared the captures made by Commview on Win2K and Etherpeek on System 7.5.5. They were identical. Not one packet was dropped by the Mac. That is, until the Etherpeek buffer filled and had to be flushed. About a dozen packets were lost during that transition. Because I've got other traffic on the network, the TCP traffic rate on the test LAN reached about 1600 kbits/sec. At that rate, I can comfortably capture traffic on my cable or DSL connection. Since I'm not concerned with all traffic, the filtered traffic in which I am interested is reliably captured by the SE/30.

I can add memory to the SE/30s to increase the buffer size, or increase the HD sizes to enable Etherpeek to save large quantities of packets. However, I use these machines to record SYN packet attempts or I look for specific traffic patterns and I don't need huge resources to do that. For serious, high volume, high speed (100 Mbit/sec) packet capture I still use my 1.2 GHz, 512 Meg Intel box.

I've 2 SE/30's doing capture duty on my DSL and cable connections.
I've set audible alerts to announce the detection of new nodes and whether certain traffic thresholds have been exceeded. It all looks and sounds very cool. Two more SE/30s are being prepared for DSL traffic monitoring where I work.

I found that booting the Macs with no extensions - including no Mode32 - maximizes the RAM available for the capture buffer with no compromise to Etherpeek's performance. I'm experimenting with Applescript to see if I can get Etherpeek to start capturing automatically, thereby eliminating the need for a mouse. I've also tried, without success so far, to maintain a LocalTalk network connection to a capturing SE/30. Even though Etherpeek only works with Ethernet frames (!), LocalTalk still gets pooched when Etherpeek starts. Having a "backdoor" network connection would be very useful.

I am getting a huge amount of spam on one of my accounts, and my ISP is being fairly unhelpful in helping me trace the source. They say that my PC has a virus and is getting addresses from my address book (OutLook 2000), please download virus protection yadda yadda yadda

I won't go into the whole thing here, as I have spent more than enough time explaining the whole thing to my ISP.... but briefly:
1-none of the emails are being sent to addresses in my book - they are completely foriegn to me.
2-I have like ten email accounts and obviously only one set to default. I tried changing the default account - the theory being that if my OutLook was sending emails then it would start to do it from the new default account and I would start getting spam on that. Well, I'm not - it's still only affecting the one account.
3-none of the email (internet) headers show any information pertaining to the emails originating from my PC
4-neither Norton Antivirus or PCillin have found a virus on my system (and yes I did download the latest virus definitions)
5-I did a "Format C:\" and re-installed the OS and the only thing common to the old and new OS is the outlook.pst file with all my mail in it.

....so basically I do not think it's at my end, but I can't prove it yet. I think i have two options. One is to quarintine my PC (unplug it from my network) and use the Mac for email for a while to see if the spam stops (and probably using Netscape Messenger 4.7x instead of outlook) And the other is something that can watch my ports and let me know if Outlook is doing anything without telling me. Would Etherpeek do that for me?

cheers
Flash!

- - - - - - - - - - - - -
A little knowledge is a dangerous thing, but it sure beats a blank stare for starting a conversation.

quote:

---

....so basically I do not think it's at my end, but I can't prove it yet. I think i have two options. One is to quarintine my PC (unplug it from my network) and use the Mac for email for a while to see if the spam stops (and probably using Netscape Messenger 4.7x instead of outlook) And the other is something that can watch my ports and let me know if Outlook is doing anything without telling me. Would Etherpeek do that for me?

---

SE/30 and system 6.0.8 Now we're talking POWER!

1. Have you tried running with system 6.0.8? If so, does performance increase?

2. Have you tried NetBSD on the SE/30? If so, does performance increase?

I've read where BSD on a mac improve network performance over MacOS. I've never tested, but it would be interesting to know. Now I've got another project once I get a network card for my SE/30s

emaq123

I'm recieving spam ( up to ten 300k messages per day - which is hard on my dialup), but my ISP says that they are 'responses from emails that I or the virus have sent' But like I say, I can't find anything at my end. I've just set ZoneAlarm to not let OutLook send or recieve without me verifying it, and popping up a dialog if it tries. I think this will do the trick, however i'm still interestd in Etherpeek

- - - - - - - - - - - - -
A little knowledge is a dangerous thing, but it sure beats a blank stare for starting a conversation.

You say you're receiving a lot of spam. Why do you think this indicates that you're sending mail from your machine? If you complained to your ISP about the spam you're receiving and they, in turn, said a virus/Trojan/worm is the cause of you receiving so much spam, they should be put to death for criminal laziness.

A couple of other points. The prevalent worms that abound from MS systems use their own SMTP service to send mail. They don't rely on the client (Outlook, OE, Eudora, etc) to send the infection. Changing default accounts, modifying your address book and other "fixes" don't work.

Packet sniffing can be an overkill solution for some problems. In your case, installing a free personal firewall (KPF or ZA) would detect any use of your network resources. If, in fact, you do have a clandestine mail server, one of those personal firewalls will alert you to it. Etherpeek, or other sniffers would also detect such behaviour but it would require you to wade through logs to find the incriminating packets.

Regarding automatic start-up, have you tried putting an alias to Etherpeek in the "Startup Items" folder in the system folder? And, regarding a backdoor Localtalk connection to the SE/30, have you tried talking to the machines via Appletalk over ethernet? Maybe you could use file sharing to access a log file or something.

Thanks for teaching an old computer new tricks -- this is what the 68kMLA is all about.

G4From128k

quote:

---

1. Have you tried running with system 6.0.8? If so, does performance increase?

---

quote:

---

Excellent work, bargepole! A very fine new use for a very fine old computer. I wonder if my new/old Duo and DuoDock could be used for this purpose?

Regarding automatic start-up, have you tried putting an alias to Etherpeek in the "Startup Items" folder in the system folder? And, regarding a backdoor Localtalk connection to the SE/30, have you tried talking to the machines via Appletalk over ethernet? Maybe you could use file sharing to access a log file or something.

---

As I've mentioned in previous post, I did finally get LocalTalk networking to run while capturing. Appletalk over Ethernet won't work because Etherpeek dumps all protocols bound to the network card and instead uses its promiscuous mode driver. Since LocalTalk is non-Ethernet, it works just fine with Etherpeek.

quote:

---

No. I haven't tried any OS other than 7.5.5. I'm not sure whether Etherpeek will run in an OS lower than 7.x. If it did, I'd expect more capture buffer memory available (smaller system use), but the network features needed by the promiscuous mode captures are all self-contained within Etherpeek.

---

quote:

---

A Duo would be a dream machine in such an application. Faster, better display, lower power. But how does one connect Ethernet networking to it?

---

68k Macintosh Liberation Army Forums

© 2001-2003 68kMLA