angst - an active sniffer
by Patroklos Argyroudis <argp@bsd.gr>

[ Introduction ]

Angst is an active sniffer, based on libpcap and libnet.  Dumps into a file 
the payload of all the TCP packets received on the specified ports.  It
implements two methods for active sniffing.  Angst is able to monitor ARP
requests, and after enabling IP forwarding on the local host, it sends ARP
replies mapping all IPs to the local MAC address.  Also, it can flood the
local network with random MAC addresses (like macof v1.1 by Ian Vitek),
causing switches to send packets to all ports.  Made just for testing
purposes and fun, thus it is still in an infancy state.  Only compiled and
tested on OpenBSD.  If you compile it on any other platform, please contact
me on the above email address.  As always, published under a BSD style license,
see the included LICENSE file.

[ Supported Platforms ]
	
Angst has only been tested on OpenBSD.  Specifically:

OpenBSD 2.8 (i386)
OpenBSD 2.7 (i386)
OpenBSD 2.6 (i386)

[ Compilation ]

You must first build and install libpcap and libnet.  BSD systems have
libpcap installed by default.  If you test it on any other platform except 
OpenBSD, please send me the diffs.  It should be portable since it is 
based on libpcap and libnet.

Standard compilation:	make

In order to compile with debug support edit the Makefile and remove the
comment from -DDEBUG.

[ Usage ]

By invoking angst with the -h switch you get the following help message:

                        [ angst - an active sniffer ]
                    [ Patroklos Argyroudis <argp@bsd.gr> ]

usage: angst [active sniffing method] [active sniffing options] [options]

active sniffing methods:
        [ -a    man-in-the-middle ARP method ]
        [ -f    flood random MAC addresses method ]

active sniffing options:
        [ -s    specify the seconds between each flooding for flood method,
                or the seconds between the injection of the fake ARP replies ]
        [ -c    specify the number of packets to flood, for flood method ]

options:
        [ -h    this help message ]
        [ -p    don't put the interface into promiscuous mode ]
        [ -r    resolve IP addresses ]
        [ -v    display the version number and exit ]
        [ -i    specify which interface to use ]
        [ -l    specify the log filename ]

Note that there are default values for all the command line arguments.  In
order to keep things cleaner, you cannot specify a filter expression as a
command line option.  In order to monitor other ports than the default ones
(21, 23, 110, 143) you have to change the default expression and recompile.
If you do that and you want to use the ARP man-in-the-middle active sniffing
method, be sure to specify that you want to capture ARP packets too.

[ Music ]

Hocico

[ Greets To ]

Joy for support, discussion, and ideas.
Brat3 for discussion.
Jackal for his libpcap based code, some years ago.
Scut for his cool mail about the man-in-the-middle method.

--
Patroklos Argyroudis
CS Student/Programmer
http://www.bsd.gr/~invisibl
