https://github.com/spiderlabs/cerealbox
Arduino-based network monitor
https://github.com/spiderlabs/cerealbox
Last synced: over 1 year ago
JSON representation
Arduino-based network monitor
- Host: GitHub
- URL: https://github.com/spiderlabs/cerealbox
- Owner: SpiderLabs
- License: gpl-3.0
- Created: 2011-08-18T01:21:22.000Z (almost 15 years ago)
- Default Branch: master
- Last Pushed: 2011-09-19T17:59:42.000Z (almost 15 years ago)
- Last Synced: 2025-04-07T10:35:50.060Z (over 1 year ago)
- Language: Java
- Homepage:
- Size: 2.21 MB
- Stars: 24
- Watchers: 6
- Forks: 8
- Open Issues: 0
-
Metadata Files:
- Readme: README.txt
- License: LICENSE.txt
Awesome Lists containing this project
README
cerealbox
Steve Ocepek
http://www.spiderlabs.com
INTRODUCTION
============
cerealbox is an Arduino-based network monitor.
REQUIREMENTS
============
This code should run on any Arduino board with 2k SRAM equipped with
Colors Shield, or the all-in-one Colorduino board. Both Colorduino and
Colors Shield are available from iTead Studio. Colorduino does not include
a USB port, so novices (like me) should use the Colors Shield + Arduino Uno.
http://iteadstudio.com/
Test/Dev system is: Ardunio Uno, Colors Shield, 8x8 round LED matrix (iTead)
The Colorduino library by Lincomatic is required and can be found here:
http://blog.lincomatic.com/?p=148
Also included is cb.pl, a sniffer that provides network session data
to the Arduino over USB. Perl requirements for cb.pl include:
Net::Pcap
NetPacket (Ethernet,IP,TCP,UDP)
Geo::IP
Device::SerialPort
USAGE
=====
Arduino
-------
Load cerealbox.pde or meter.pde onto Arduino using the Arduino IDE.
cerealbox.pde displays a dot for each open session, color-coded to the
Country Code of the remote host.
meter.pde shows types of sessions being established in an "equalizer"
type view.
RED - Web (80,443,8080)
BLUE - DNS
GREEN - Remote protocols (SSH,Telnet,RDP)
YELLOW - Mail protocols (POP3,SMTP,IMAP,LDAP)
PURPLE - File protocols (FTP,SMB,AFP,LPR)
ORANGE - Other ports, under 10000
CYAN - Other ports, over or equal to 10000
WHITE - Local hosts
Perl
----
This program requires root privileges to sniff packets.
cb.pl (net_device) (src_ipaddr) (serial_device) [dns]
net_device is the network device to listen on, ex. eth0
- Running cb.pl without args will show all available interfaces
src_ipaddr is the source IP address of the host to be monitored.
- In normal cases, this will be the host's own IP address
- Could be used to sniff another host's traffic in cases where
traffic is visible (i.e. MITM, ethernet tap, wireless)
serial_device is the USB serial device that the Arduino is using, ex:
- /dev/ttyUSB0 on Linux
Or whichever was assigned to Arduino, use dmesg to find out
- /dev/tty.usbmodem262312 on Mac OS X
Use ls /dev/tty.usbmodem* to find this
Untested on Windows, not sure whether Device::SerialPort can handle
COM: ports
dns specifies that DNS sessions should be tracked and displayed
- Useful for meter mode, but this traffic tends to fill up session mode
(cerealbox.pde) very quickly
COPYRIGHT
=========
cerealbox - Arduino-based network monitor
Created by Steve Ocepek
Copyright (C) 2011 Trustwave Holdings, Inc.
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see