angst -- an active sniffer

[ Introduction ]

Angst is an active sniffer, based on libpcap and libnet. Angst provides methods for aggressive sniffing on switched local area network environments. It dumps the payload of all the TCP packets received on the specified ports. Moreover, it implements methods for active sniffing. Angst currently provides two active sniffing methods. The first monitors ARP requests, and after enabling IP forwarding on the local host, sends ARP replies mapping all IPs to the local MAC address. The second method floods the local network with random MAC addresses (like macof v1.1 by Ian Vitek), causing switches to send packets to all ports. Made just for testing purposes and fun. If you compile it on any other platform except the ones listed below, please contact me. As always, angst is published under a BSD-style license, see the included LICENSE file.

[ Supported platforms ]

Angst has been thoroughly tested on the following platforms:

OpenBSD 2.8 (i386)
OpenBSD 2.7 (i386)
OpenBSD 2.6 (i386)

Also, angst is known to compile and run on:

FreeBSD 4.2-STABLE (i386)
NetBSD 1.4.2 (i386)
Slackware Linux 7.1, with 2.2.13 kernel (i386)

[ Compilation and installation ]

You must first build and install libpcap and libnet. BSD systems have libpcap installed by default. If you test it on any other platform except the ones mentioned, send me the diffs. It should be portable since it is based on libpcap and libnet.

If you run {Free,Net,Open}BSD simply type: make
If you run Linux type: make -f Makefile.linux

In order to compile with debug support, edit the Makefile that corresponds to your platform and remove the comment from -DDEBUG.

In order to install angst type: make install
This will install the angst binary to /usr/local/sbin and the angst manual page to /usr/local/man/man8.

To uninstall angst type: make uninstall

[ Usage ]

By invoking angst with the -h switch you get the following help message:

                        [ angst - an active sniffer ]
               [ Patroklos Argyroudis <argp at domain> ]

usage: angst [active sniffing method] [active sniffing options] [options]

active sniffing methods:
        [ -a    man-in-the-middle ARP method ]
        [ -f    flood random MAC addresses method ]

active sniffing options:
	[ -d    don't try to enable IP forwarding on the local host ]
        [ -s    specify the seconds between each flooding for flood method,
                or the seconds between the injection of the fake ARP replies ]
        [ -c    specify the number of packets to flood, for flood method ]

        [ -h    this help message ]
        [ -p    don't put the interface into promiscuous mode ]
        [ -r    resolve IP addresses ]
        [ -v    display the version number and exit ]
        [ -i    specify which interface to use ]
        [ -l    specify the log filename ]
        [ -e	specify the port numbers to build the filter expression ]

Note that there are default values for all the command line arguments. In order to keep things cleaner, you cannot specify a filter expression as a command line option. In order to monitor other ports than the default ones (21, 23, 110, 143) you have to specify them with the -e switch. The -e switch accepts comma separated numbers, and by using them it builds a correct filter expression. An example usage of the -e switch is:

# ./angst -a -e 23,25,113

warning: the filter expression is arp or (tcp and (dst port 23 or dst port 25 or dst port 113))

As you can see, angst always informs you about the filter expression when the -e switch is used. Moreover, in order for the man-in-the-middle ARP method to work, IP forwarding must be enabled on the local host. The -d switch is useful when you want to enable IP forwarding yourself, and not let angst to do it for you.

[ Documentation ]

Other documentation sources for angst: man page, README, TODO, ChangeLog.

[ Acquisition ]

The latest version of angst is 0.4b. Although this version is a lot more stable than the previous one, it is still considered to be a development version. You can download it here.

[ Author ]

My name is Patroklos Argyroudis and I am a Ph.D. student at the Networks and Telecommunications Research Group, Department of Computer Science, University of Dublin, Trinity College in Ireland. You can find my personal page here.