debian/0000755000000000000000000000000013371112231007160 5ustar debian/changelog0000644000000000000000000002014513371112231011034 0ustar sniffit (0.3.7.beta-17+deb8u1build0.14.04.1) trusty-security; urgency=medium * fake sync from Debian -- Mike Salvatore Thu, 08 Nov 2018 14:55:05 -0500 sniffit (0.3.7.beta-17+deb8u1) jessie; urgency=medium * Added a patch to fix CVE-2014-5439 (Root shell on Sniffit). -- Joao Eriberto Mota Filho Wed, 23 Nov 2016 16:57:34 -0200 sniffit (0.3.7.beta-17) unstable; urgency=low * Acknowledge NMU. + Thanks Aron Xu. * Added a patch to enable hardening options. (Closes: #649817). + Thanks Simon Ruderich. * Added a patch to fix spelling error on binary. * Fixed spelling error on debian/README.Debian. * Added "DM-Upload-Allowed: yes" at debian/control. -- William Vera Thu, 16 Aug 2012 17:40:22 -0500 sniffit (0.3.7.beta-16.1) unstable; urgency=low * Non-maintainer upload. * Various changes to install correct files. -- Aron Xu Mon, 26 Mar 2012 22:39:34 +0800 sniffit (0.3.7.beta-16) unstable; urgency=low * Acknowledge NMU. + Thanks HIGUCHI Daisuke. * Delete dpatch as Build Depend. * Switch to dpkg-source 3.0 (quilt) format. (Closes: #664401). * Added missing recommended target build-arch in debian/rules. * Updated Standards Version to 3.9.3. * Added flags to enable hardening options in debian/rules (Closes: #649817). + Thanks VDR dai. -- William Vera Tue, 06 Mar 2012 16:29:14 -0600 sniffit (0.3.7.beta-15.1) unstable; urgency=low * Non-maintainer upload. * debian/patches/05_fix_segfaults_on_amd64_bts644978.dpatch - fix segfaults on amd64, thanks Sebastian Harl (Closes: #644978). -- HIGUCHI Daisuke (VDR dai) Thu, 10 Nov 2011 14:14:23 +0900 sniffit (0.3.7.beta-15) unstable; urgency=low * Added a patch to add support for GNU/kFreeBSD (Closes: #535506). * Added README.source (dpatch). * Updated Standards Version to 3.8.3. -- William Vera Sat, 24 Oct 2009 22:21:47 -0500 sniffit (0.3.7.beta-14) unstable; urgency=low * Added a patch to defined prototyes correctly (Closes: #532581). + Thanks James Westby * Updated Standards Version to 3.8.1 * Added ${misc:Depends} at debian/control file. * Added Homepage field at debian/control file. * Added a patch with old changes in diff.gz. * Added a patch to fix manpages format. -- William Vera Wed, 10 Jun 2009 22:45:12 -0500 sniffit (0.3.7.beta-13) unstable; urgency=low * New maintainer. (Closes: #465931). * Some format corrections on the man pages (sniffit(5) sniffit(8)). * Don't include config.{sub,guess} in .diff.gz -- William Vera Sat, 07 Jun 2008 12:56:48 -0500 sniffit (0.3.7.beta-12) unstable; urgency=low * Use debhelper v7, rules file minimisation. * Makefile.in: don't strip binary Closes: #438032 * debian/control: Updated to Standards-Version: 3.7.3, no changes needed -- Edward Betts Wed, 30 Apr 2008 11:00:19 +0100 sniffit (0.3.7.beta-11) unstable; urgency=low * Acknowledge NMU * sn_structs.h: Sitting at Debcamp, fixing FTBFS bugs, and Alberto Gonzalez Iniesta sitting next to me points out there is one in this package. Thanks to Joshua Kwan for the patch to fix it. (closes: #195548) * config.{guess,sub}: updated * debian/control: Updated to Standards-Version: 3.6.0, no changes needed * sn_interface.c: sniffit was leaving echo turned off when exiting from the interactive mode in an xterm, added reset_shell_mode() to screen_exit() and it works. This should not be needed because endwin should be calling it. -- Edward Betts Mon, 14 Jul 2003 10:50:24 +0200 sniffit (0.3.7.beta-10.1) unstable; urgency=low * Non maintainer upload * Rebuilt with new libpcap to remove dependency on libpcap0, which I got removed from unstable by accident. Sorry about this... -- Torsten Landschoff Sat, 10 Aug 2002 11:37:33 +0200 sniffit (0.3.7.beta-10) unstable; urgency=low * README.FIRST: apply patch "James R. Van Zandt" to correct spelling and other mistakes in README.FIRST -- Edward Betts Thu, 13 Dec 2001 17:35:25 +0000 sniffit (0.3.7.beta-9) unstable; urgency=low * debian/control: Standards-Version: 3.5.5 * debian/rules: Support DEB_BUILD_OPTIONS * config.{guess,sub}: updated files to version from libtool package (Closes: Bug#103633) * sniffit.c: applied patch from Bug#103633 -- Edward Betts Thu, 5 Jul 2001 10:44:23 +0200 sniffit (0.3.7.beta-8) unstable; urgency=low * debian/control: Standards-Version: 3.5.2 * debian/rules: Changed to debhelper 3 * debian/rules: Removed dh_suidregister * debian/rules: Removed dh_testversion * debian/rules: Changed dh_installman to dh_installmanpages * debian/rules: Support DEB_BUILD_OPTIONS -- Edward Betts Sun, 25 Mar 2001 04:41:39 -0700 sniffit (0.3.7.beta-7) frozen unstable; urgency=high * debian/rules: do not install pcap.3 (closes: Bug#77769). * debian/control: updated Standards-Version to 3.2.1 * debian/control: added version to build-depends on debhelper for lintian: E: sniffit: package-uses-dh_testversion-but-lacks-versioned-build-depends * Package now lintian clean. -- Edward Betts Tue, 28 Nov 2000 07:00:24 -0700 sniffit (0.3.7.beta-6.1) frozen unstable; urgency=high * Non maintainer upload. * [security] sn_logfile.c: Replaced sprintfs by snprintfs fixing a buffer overflow (bugtraq). * [security] sn_analyse.c: Limit length of TCP packets to the buffer size (buffer overflow with MTU > 5000). -- Torsten Landschoff Fri, 26 May 2000 08:40:14 +0200 sniffit (0.3.7.beta-6) frozen unstable; urgency=low * Update config.{guess,sub} to versions from the automake package. Should now compile better on ARM (closes: Bug#56915). -- Edward Betts Thu, 3 Feb 2000 09:22:16 +0000 sniffit (0.3.7.beta-5) unstable; urgency=low * debian/control: updated Standards-Version to 3.1.1 * debian/control: added Build-Depends. * debian/rules: rewritten. -- Edward Betts Thu, 6 Jan 2000 23:12:32 +0000 sniffit (0.3.7.beta-4) unstable; urgency=low * Recompile to try and fix bug #49979 -- Edward Betts Fri, 12 Nov 1999 23:21:17 +0000 sniffit (0.3.7.beta-3) unstable; urgency=low * Changed to Debhelper 2.0 * Updated to Standards-Version: 3.0.1 * This package includes a copy of libpcap, ensured that it is not built * Moved config file /etc/sniffit.cfg to /usr/doc/sniffit/examples/sample_config_file * Lintain clean -- Edward Betts Fri, 12 Nov 1999 23:20:20 +0000 sniffit (0.3.7.beta-2) unstable; urgency=low * Updated /usr/doc/sniffit/copyright from README.FIRST (fixes #39765) * sniffit 0.3.7.beta is free software (BSD-like license) * Changed section to main/net * Added conffiles entry for /etc/sniffit.cfg -- Hamish Moffatt Fri, 25 Jun 1999 22:30:00 +1000 sniffit (0.3.7.beta-1) unstable; urgency=low * QA group upload * New upstream release (fixes #28510) * Fixed spelling error in description (fixes #26859) * Recompiled with ncurses 4.0 (fixes #37431) -- Hamish Moffatt Sun, 23 May 1999 01:03:00 +1000 sniffit (0.3.5-3) frozen unstable; urgency=low * After long waiting for new copyright i must move it to non-free (fixes bug #21832) -- Damjan Marion Thu, 28 May 1998 15:10:35 +0200 sniffit (0.3.5-2) frozen unstable; urgency=low * Moved to frozen (resurected from orphaned) * Updated to standards 2.4.1.0 -- Damjan Marion Tue, 15 Apr 1998 23:56:11 +0200 sniffit (0.3.5-1) unstable; urgency=low * New maintainer * New upstream release * Updated to standards 2.4.0.0 -- Damjan Marion Tue, 7 Apr 1998 22:57:01 +0200 sniffit (0.3.3-1) unstable; urgency=low * Initial Release. -- Patrick J. Edwards Mon, 17 Mar 1997 17:46:24 -0600 debian/compat0000644000000000000000000000000211734077573010402 0ustar 8 debian/rules0000755000000000000000000000246511734102343010253 0ustar #!/usr/bin/make -f # Uncomment this to turn on verbose mode. #export DH_VERBOSE=1 #export DH_OPTIONS=-v DPKG_EXPORT_BUILDFLAGS = 1 -include /usr/share/dpkg/default.mk %: dh $@ override_dh_auto_configure: automake --force-missing --add-missing --copy || true cd libpcap && automake --force-missing --add-missing --copy && cd .. || true dh_auto_configure # Use override_dh_* targets to customize this. # --------------------------------------------------- # Followings are the old debian/rules # # #!/usr/bin/make -f # # CFLAGS=$(shell dpkg-buildflags --get CFLAGS) # LDFLAGS=$(shell dpkg-buildflags --get LDFLAGS) # # build: build-arch build-indep # build-stamp: # dh build --before configure # cp /usr/share/misc/config.guess . # cp /usr/share/misc/config.sub . # ./configure --prefix=/usr --no-recursion # $(MAKE) OBJ_OPT="$(CFLAGS)" EXE_OPT="$(LDFLAGS) -lpcap" # dh build --after build # # build-arch: build-stamp # build-indep: build-stamp # # clean: # dh clean # rm -f config.sub config.guess # # install: build # dh install --before dh_auto_install # dh_install sniffit usr/sbin # dh_installman sniffit.5 sniffit.8 # dh_installchangelogs HISTORY # dh install --after dh_auto_install # # binary-arch: # dh binary-arch # # binary-indep: # dh binary-indep # # binary: binary-arch binary-indep # debian/patches/0000755000000000000000000000000013023535373010621 5ustar debian/patches/02_headers.patch0000644000000000000000000000515211732704633013563 0ustar Author: William Vera Description: Include more headers, so that prototyes are correctly defined, avoiding some chrashes by Karoly Segesdi --- a/sniffit.0.3.7.c +++ b/sniffit.0.3.7.c @@ -5,7 +5,9 @@ #include #include +#include #include +#include #include /* #include */ #include --- a/sn_interface.c +++ b/sn_interface.c @@ -6,7 +6,9 @@ #ifdef INCLUDE_INTERFACE #include #include +#include #include +#include #include #include #include "sn_curses.h" --- a/sn_logfile.c +++ b/sn_logfile.c @@ -3,7 +3,9 @@ #include "sn_config.h" +#include #include +#include #include #include #include "sn_defines.h" --- a/Makefile.in +++ b/Makefile.in @@ -10,9 +10,9 @@ LIBS = @LIBS@ DEFS = @DEFS@ OS_OPT = @OS_OPT@ -OBJ_FLAG = -w -O2 -c +OBJ_FLAG = -O2 -c OBJ_OPT = -I./libpcap -L./libpcap -EXE_FLAG = -w -O2 -o sniffit +EXE_FLAG = -O2 -o sniffit EXE_OPT = -I./libpcap -L./libpcap -lpcap EXE_OBJ = sn_packets.o sn_generation.o sn_interface.o sn_cfgfile.o \ sn_logfile.o sn_resolv.o --- a/sn_cfgfile.c +++ b/sn_cfgfile.c @@ -2,7 +2,9 @@ /* - by : Brecht Claerhout */ /* - improvements: Shudoh Kazuyuki */ +#include #include +#include #include /* for getservbyname() */ #include "sn_config.h" @@ -10,6 +12,7 @@ #include "sn_structs.h" #include "sn_cfgfile.h" #include "sn_resolv.h" +#include "sniffit.h" /* #include "sn_generation.h" */ extern struct cfg_file_contense *select_from_list; /* pointers for cfg lists */ --- a/sn_generation.c +++ b/sn_generation.c @@ -5,7 +5,9 @@ #include "sn_config.h" #ifdef INCLUDE_INTERFACE #ifdef GENERATION +#include #include +#include #include #include #include "sn_curses.h" --- a/sn_packets.c +++ b/sn_packets.c @@ -4,6 +4,7 @@ #include "sn_config.h" #include "sn_defines.h" #include "sn_structs.h" +#include #include extern int PROTO_HEAD; --- a/sniffit.h +++ b/sniffit.h @@ -3,6 +3,8 @@ #ifndef _SNIFFIT_H_ #define _SNIFFIT_H_ +#include "pcap.h" + /**** Sniffit functions *****************************************************/ int check_packet(_32_bit, const struct packetheader *, debian/patches/fixspelling.patch0000644000000000000000000000112312013274744014163 0ustar Author: William Vera Description: Fix a spelling error on binary. --- a/sn_defines.h 1998-07-16 11:17:10.000000000 -0500 +++ b/sn_defines.h 2012-08-16 17:51:43.851085057 -0500 @@ -134,7 +134,7 @@ #define ICMP_TYPE_15 "Information request" #define ICMP_TYPE_16 "Information reply" #define ICMP_TYPE_17 "Address mask request" -#define ICMP_TYPE_18 "Adress mask reply" +#define ICMP_TYPE_18 "Address mask reply" /*** Services (standardised) *******************************************/ #define FTP_DATA_1 20 debian/patches/series0000644000000000000000000000027513023535373012042 0ustar 01_diffpatch.patch 02_headers.patch 03_fixmanpages.patch 04_sniffit+kbsd.patch 05_fix_segfaults_on_amd64_bts644978.patch use-dpkg-buildflags.patch fixspelling.patch fix-CVE-2014-5439.patch debian/patches/03_fixmanpages.patch0000644000000000000000000001035411732704635014455 0ustar Author: William Vera Description: Format corrections on the man pages. --- a/sniffit.5 +++ b/sniffit.5 @@ -13,7 +13,7 @@ be processed by .B sniffit. This file also controls (or will control) some functions for the -continuous logging ('-L' option). +continuous logging ('\-L' option). .LP A .B sniffit @@ -22,7 +22,7 @@ .nf # Sniffit Sample Config file -- Brecht Claerhout -logfile /var/adm/sniffit.today.log +logfile /var/log/sniffit.today.log # First select all packets! select both mhosts 1 --- a/sniffit.8 +++ b/sniffit.8 @@ -76,16 +76,16 @@ .IP "-t Target-IP" Only process packets TO Target-IP. If Target-IP is in dot-nr notation, -\'x' is allowed as wildcard. (e.g. '-t 157.193.x', '-t x', ...) +\'x' is allowed as wildcard. (e.g. '\-t 157.193.x', '\-t x', ...) .I "(NOT compatible with: '-s' '-i' '-I' '-c' '-v' '-L')" .IP "-s Source-IP" -Similar to '-t', only process packets FROM Source-IP. +Similar to '\-t', only process packets FROM Source-IP. .I "(NOT compatible with: '-t' '-i' '-I' '-c' '-v' '-L')" .IP -b -\'both' mode, together with '-s' or '-t', only process FROM/TO the IP -specified by '-s' or '-t' +\'both' mode, together with '\-s' or '\-t', only process FROM/TO the IP +specified by '\-s' or '\-t' .I "(NOT compatible with: '-t' '-i' '-I' '-c' '-v' '-L')" .IP "-c config-file" @@ -104,18 +104,18 @@ and .B README.FIRST ) -(one of the options '-t' '-s' '-i' '-I' '-c' is required) +(one of the options '\-t' '\-s' '\-i' '\-I' '\-c' is required) .I "(NOT compatible with: '-t' '-s' '-c' '-v' '-L')" .IP -I -Same as '-i', but gives you more information. -(one of the options '-t' '-s' '-i' '-I' '-c' is required) +Same as '\-i', but gives you more information. +(one of the options '\-t' '\-s' '\-i' '\-I' '\-c' is required) .I "(NOT compatible with: '-t' '-s' '-c' '-v' '-L')" .IP "-R " Record all traffic in .I -This file can then be fed to Sniffit with the '-r' option. +This file can then be fed to Sniffit with the '\-r' option. .I "(Needs a selection parameter like '-c' '-t' '-s')" .I "(NOT compatible with '-i' '-I' '-v' '-L' '-r')" @@ -123,11 +123,11 @@ This option feeds the recorded .I to .B sniffit. -It requires the '-F' option with the correct device. Suppose you log a file +It requires the '\-F' option with the correct device. Suppose you log a file on a machine with 'eth0'. When feeding the logged file to .B sniffit -, you will need to add '-F eth0' or '-F eth' to the command line. It doesn't -need much explanation that using '-i' or '-I' in combination with '-r' makes +, you will need to add '\-F eth0' or '\-F eth' to the command line. It doesn't +need much explanation that using '\-i' or '\-I' in combination with '\-r' makes no sense (at this moment). .I "(requires '-F', NOT compatible with '-R' '-i' '-I')" @@ -154,9 +154,9 @@ .I "(NOT compatible with: '-i' 'I' '-v' '-L')" .IP -a -\'dump mode', same of '-d' but outputs ASCII. Non printable chars are +\'dump mode', same of '\-d' but outputs ASCII. Non printable chars are replaced by '.'. -('-d' and '-a' mix without any problem) +('\-d' and '\-a' mix without any problem) .I "(NOT compatible with: '-i' '-I' '-v' '-L')" .IP "-P proto" @@ -169,7 +169,7 @@ .I "(NOT compatible with: '-i' '-I' '-v' '-L')" .IP "-A char" -When in 'normal mode' (not '-d','-a','-i','-I','-L'), all non-printable chars +When in 'normal mode' (not '\-d','\-a','\-i','\-I','\-L'), all non-printable chars will be replaced by .I char .I "(NOT compatible with: '-a' '-d' '-i' '-I' '-v' '-L')" @@ -271,7 +271,7 @@ Same as F5 or '5', but with program 'sniffit_key8' .IP "ENTER" a window will pop up and log the connection, or the connection output -will be send at a chosen device if you used the '-D' option. +will be send at a chosen device if you used the '\-D' option. .IP "'q'" When in logging mode, stop logging. Otherwise, quit. .IP "'n'" @@ -319,7 +319,7 @@ .SH "IP ICMP UDP LOGGING" Information on these packets is dumped to stdout. Packet Filtering options only refer to TCP and UDP packets. -The contents of UDP packets is only shown when enabling '-a' or '-d'. +The contents of UDP packets is only shown when enabling '\-a' or '\-d'. .SH AUTHOR Brecht Claerhout debian/patches/01_diffpatch.patch0000644000000000000000000005671311732704630014105 0ustar Author: William Vera Description: New patch generated from sniffit 0.3.7.beta-13 diff.gz --- a/sn_interface.c +++ b/sn_interface.c @@ -5,6 +5,7 @@ #ifdef INCLUDE_INTERFACE #include +#include #include #include #include @@ -513,8 +514,11 @@ void screen_exit (void) { -clear(); endwin(); +/* next line added by Edward Betts , should not be needed + * because endwin should be calling it, without this the console has no echo + * after exiting in an xterm */ +reset_shell_mode(); }; void mem_exit (void) --- a/Makefile.in +++ b/Makefile.in @@ -26,9 +26,8 @@ @echo "Succesfull compilation..." sniffit: $(SNIFFIT) $(DEP_FILES) - cd libpcap; make; cd .. +# cd libpcap; make; cd .. $(CC) $(EXE_FLAG) $(SNIFFIT) $(EXE_OBJ) $(EXE_OPT) $(LIBS) $(DEFS) $(OS_OPT) - strip sniffit sn_cfgfile.o: sn_cfgfile.h sn_cfgfile.c sn_defines.h sn_structs.h sn_config.h $(CC) $(OBJ_FLAG) sn_cfgfile.c $(OBJ_OPT) $(DEFS) @@ -52,12 +51,12 @@ #Clean up everthing... clean: - cd libpcap; make clean; rm -f config.cache; cd .. +# cd libpcap; make clean; rm -f config.cache; cd .. rm -f Makefile rm -f config.cache rm -f config.status rm -f config.log - rm -f ./libpcap/config.cache - rm -f ./libpcap/config.status - rm -f ./libpcap/config.log +# rm -f ./libpcap/config.cache +# rm -f ./libpcap/config.status +# rm -f ./libpcap/config.log rm -f *.o sniffit --- a/sniffit.8 +++ b/sniffit.8 @@ -39,7 +39,7 @@ is a packet sniffer for TCP/UDP/ICMP packets. .B sniffit is able to give you very detailed technical info on these -packets (SEQ, ACK, TTL, Window, ...) but also packet contence in +packets (SEQ, ACK, TTL, Window, ...) but also packet contents in different formats (hex or plain text, ...). .LP .B sniffit @@ -76,7 +76,7 @@ .IP "-t Target-IP" Only process packets TO Target-IP. If Target-IP is in dot-nr notation, -'x' is allowed as wildcard. (e.g. '-t 157.193.x', '-t x', ...) +\'x' is allowed as wildcard. (e.g. '-t 157.193.x', '-t x', ...) .I "(NOT compatible with: '-s' '-i' '-I' '-c' '-v' '-L')" .IP "-s Source-IP" @@ -84,7 +84,7 @@ .I "(NOT compatible with: '-t' '-i' '-I' '-c' '-v' '-L')" .IP -b -'both' mode, together with '-s' or '-t', only process FROM/TO the IP +\'both' mode, together with '-s' or '-t', only process FROM/TO the IP specified by '-s' or '-t' .I "(NOT compatible with: '-t' '-i' '-I' '-c' '-v' '-L')" @@ -115,7 +115,7 @@ .IP "-R " Record all traffic in .I -.This file can then be fed to Sniffit with the '-r' option. +This file can then be fed to Sniffit with the '-r' option. .I "(Needs a selection parameter like '-c' '-t' '-s')" .I "(NOT compatible with '-i' '-I' '-v' '-L' '-r')" @@ -149,12 +149,12 @@ .I "(NOT compatible with: '-i' 'I' '-v')" .IP -d -'dump mode', shows the packets on the screen (stdout) instead of logging +\'dump mode', shows the packets on the screen (stdout) instead of logging into files (default). Data is printed in bytes (hex). .I "(NOT compatible with: '-i' 'I' '-v' '-L')" .IP -a -'dump mode', same of '-d' but outputs ASCII. Non printable chars are +\'dump mode', same of '-d' but outputs ASCII. Non printable chars are replaced by '.'. ('-d' and '-a' mix without any problem) .I "(NOT compatible with: '-i' '-I' '-v' '-L')" @@ -193,8 +193,7 @@ can be found with .I ifconfig (see -.BR ifconfig (8) -). +.BR ifconfig (8)). .B sniffit supports ethernet and PPP by default. Read .B README.FIRST @@ -210,7 +209,7 @@ .B Plugin , for a list on all plugins compiled in your version, just type ' .B sniffit -'. Read all about Plugins in the PLUGIN-HOWTO (READ IT!) +\'. Read all about Plugins in the PLUGIN-HOWTO (READ IT!) .I "(NOT compatible with: '-i' '-I' '-v')" .IP "-L logparam" @@ -235,7 +234,7 @@ receiving host (port 'o'). .SH "DUMP MODE ('-d' and/or '-a')" -Output is dumped to stdout, the packet contence is shown in it's +Output is dumped to stdout, the packet contents is shown in it's unwrapped form (the complete IP packet). .SH "INTERACTIVE MODE ('-i' or '-I')" @@ -320,7 +319,7 @@ .SH "IP ICMP UDP LOGGING" Information on these packets is dumped to stdout. Packet Filtering options only refer to TCP and UDP packets. -The contence of UDP packets is only shown when enabling '-a' or '-d'. +The contents of UDP packets is only shown when enabling '-a' or '-d'. .SH AUTHOR Brecht Claerhout --- a/sn_logfile.c +++ b/sn_logfile.c @@ -44,42 +44,42 @@ void print_ftp_user (char *conn, char *user) { char line[250]; -sprintf(line,"%s: USER [%s]",conn,user); +snprintf(line,sizeof(line),"%s: USER [%s]",conn,user); print_logline (line); } void print_ftp_pass(char *conn, char *pass) { char line[250]; -sprintf(line,"%s: PASS [%s]",conn,pass); +snprintf(line,sizeof(line),"%s: PASS [%s]",conn,pass); print_logline (line); } void print_login (char *conn, char *login) { char line[250]; -sprintf(line,"%s: login [%s]",conn,login); +snprintf(line,sizeof(line),"%s: login [%s]",conn,login); print_logline (line); } void print_mail (char *conn, char *msg) { char line[250]; -sprintf(line,"%s: mail [%s]",conn,msg); +snprintf(line,sizeof(line),"%s: mail [%s]",conn,msg); print_logline (line); } void print_pwd (char *conn, char *pwd) { char line[250]; -sprintf(line,"%s: password [%s]",conn,pwd); +snprintf(line,sizeof(line),"%s: password [%s]",conn,pwd); print_logline (line); } void print_conn (char *conn, char *msg) { char line[250]; -sprintf(line,"%s: %s",conn,msg); +snprintf(line,sizeof(line),"%s: %s",conn,msg); print_logline (line); } --- a/sniffit.5 +++ b/sniffit.5 @@ -122,7 +122,6 @@ a) Send by hosts '100.100.12.*' b) Send from/to 100.100.12.2 (useless line) c) deselecting all WWW packets on the subnet -.ni .SH AUTHOR Brecht Claerhout --- a/README.FIRST +++ b/README.FIRST @@ -6,7 +6,7 @@ * No illegal activities are encouraged! * # Please read the LICENSE file # * * -# Sniffit grew a little upon it's original intentions and is now # +# Sniffit grew a little upon its original intentions and is now # * extended for network debugging (UDP, ICMP, netload, etc.) * #*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*# * Libpcap library * @@ -45,19 +45,19 @@ I hope you enjoy this beta version. Like always, I removed some bugs. There is a new 'logging' feature. It is now possible to record traffic with -Sniffit and process it later! (it is completely different from te logging +Sniffit and process it later! (it is completely different from the logging done in the 0.3.6 version, that is known to some hardcore Sniffit users) Please take a minute to skim through the text and read the passages marked with a '*', these are the new features. (Please read BETA-TESTING) -I use the libpcap library developped at Berkeley Laboratory, for easy +I use the libpcap library developed at Berkeley Laboratory, for easy porting (Read the licence). 0.1 Credits and contact ----------------------- -Credits go to (in order of apperance on the Sniffit scene): +Credits go to (in order of appearance on the Sniffit scene): Wim Vandeputte , best friend and UNIX guru, for support, testing and providing me with a WWW site. @@ -71,17 +71,17 @@ Qing Long, for the bash/zsh libpcap/configure script. Guy Gustavson, for giving me a FreeBSD account. Woju , for the ncurses SunOS/FreeBSD fixing, - and for his other effords. + and for his other efforts. Amlan Saha , for adding Packet Generation to Sniffit, and adding other features (not implemented yet). I'm sure that in the near future you will see more of his work in Sniffit. Shudoh Kazuyuki, for changing getaddrbyname() and improving the config-file interpreting. - Fyodor , for pointing out the hidious small + Fyodor , for pointing out the hideous small fragments problem. David O'Brien , for netbsd information. - everybody, who ever mailed me with sugestions help, etc... + everybody, who ever mailed me with suggestions help, etc... Also a big thanks to my Beta testers (alphabetically, I hope)... Charles G Stuart IRIX / RedHat LINUX @@ -91,7 +91,7 @@ And many others who wish to be anonymous.... -Sugestions and comments can be sent to: +Suggestions and comments can be sent to: coder@reptile.rug.ac.be Brecht Claerhout @@ -99,10 +99,10 @@ 8700 Tielt Belgium -The original distribution program can be optained from (my site): +The original distribution program can be obtained from (my site): http://sniffit.rug.ac.be/sniffit/sniffit.html -MIND YOU: this program is ran as root, and thus could easily contain +MIND YOU: this program is run as root, and thus could easily contain dangerous trojans. If you get it from the above site you can safely compile and use it. (no trojan versions are discovered yet.. it's just a warning) @@ -178,7 +178,7 @@ -v Show version and exit (just added because it's such a wide spread option) -t tells the sniffer to check out packets GOING TO - -s tells the sniffer to check out packets COMMING FROM + -s tells the sniffer to check out packets COMING FROM You can use the '@' wildcard (only IP NUMBERS of course). e.g. -t 199.145.@ -t 199.14@ @@ -197,15 +197,15 @@ Parameters for all modes: -F force sniffit to use a network device (READ 3.2 ON THIS SUBJECT, IMPORTANT) - -n Turn of IP checksum checking. This can show you + -n Turn off IP checksum checking. This can show you bogus packets. (mind you ARP, RARP, other non-IP packets will show up bogus too) (compatible with ALL options) - -N Disables all functions that Sniffit has build in, usefull + -N Disables all functions that Sniffit has build in, useful for wanting to run ONLY a plugin Parameters for not running in -i: - -b does both -t and -s, doesn't mather what function you used + -b does both -t and -s, doesn't matter what function you used (-t or -s) -d Dump mode, shows the packets on the screen in bytes (not like tcpdump). For test purposes. (numbers are hex) @@ -231,7 +231,7 @@ They can be combined. -p Logs connections on port , 0 means all ports, default is 0 (all), look out with that on loaded nets! - -l Ammount of information to log (default 300 bytes). + -l Amount of information to log (default 300 bytes). Length 0 logs everything. (look out with diskspace when logging everything!) -M Activate Plugin nr. , for a list on all plugins @@ -260,7 +260,7 @@ Some examples: Imagine the following setup: 2 hosts on a subnet, one is running the - sniffer (sniffit.com), the otherone is 66.66.66.7 (target.com). + sniffer (sniffit.com), the other one is 66.66.66.7 (target.com). 1. You want to test if the sniffer is working: sniffit:~/# sniffit -d -p 7 -t 66.66.66.7 and in another window: @@ -272,7 +272,7 @@ 3. Root of target.com tells me he gets strange ftp connections and wants to find out the commands typed: sniffit:~/# sniffit -p 21 -l 0 -t 66.66.66.7 - 4. You want to read all incomming and outgoing mail on target.com: + 4. You want to read all incoming and outgoing mail on target.com: sniffit:~/# sniffit -p 25 -l 0 -b -t 66.66.66.7 & or sniffit:~/# sniffit -p 25 -l 0 -b -s 66.66.66.7 & @@ -314,9 +314,9 @@ F5 or '5' : Start a program 'sniffit_key5' with arguments If the program doesn't exist, nothing is done. Sniffit should - be in the same path as sniffit was STARTED FROM (not necessarely + be in the same path as sniffit was STARTED FROM (not necessarily the path sniffit is stored in) - This is usefull for interactive connection killing or extra + This is useful for interactive connection killing or extra monitoring. A little shell script can always transform the arguments given and pass them on to other programs. F6 or '6' : Same as F5 or '5', but with program 'sniffit_key6' @@ -330,12 +330,12 @@ the config.h file to change this (could be needed if y'r computer is slow). 'g' : Generate Packets! - Sniffit is now able to generate some trafic load. Currently - this is a 'underdevelloped' feature with very few options, + Sniffit is now able to generate some traffic load. Currently + this is a 'underdeveloped' feature with very few options, but it will be expanded a lot... Currently only UDP packets are generated. When pressing 'G' - you will be asked the source/dest IP/port and how much packets - are needed to be transmitted. + you will be asked the source/dest IP/port and how many packets + are to be transmitted. Packets contain the line: "This Packet was fired with Sniffit!" 'r' : Reset.. clears all current connections from memory and restarts. @@ -348,14 +348,14 @@ When forcing network devices, sniffit tries to find out what device it is. If sniffit recognises the name, everything is okay. -If it does not recognise the name it will set the variable -FORCED_HEAD_LENGHTH to the ethernet headlength. The ethernet headlength -is the length in bytes of an ethernet packet hearder. -So if you have to force a non-ethernet device, that is not recognised by +If it does not recognise the name it will set the ethernet headlength +according to the compiled-in value FORCED_HEAD_LENGTH. The ethernet +headlength is the length in bytes of an ethernet packet header. +So if you have to force a non-ethernet device that is not recognised by sniffit, make sure you change that headlength correctly in the 'sn_config.h' file. -The -F option was added, because I noticed devicenames can differ from +The -F option was added, because I noticed device names can differ from system to system, and because some ppl have multiple devices present. When having problems with this option, please think twice before you mail me. @@ -370,7 +370,7 @@ The configfile should have lines with the following format: [] -(seperators are spaces (any number of), NO TABS!!!) +(separators are spaces (any number of), NO TABS!!!) Lines that don't match this pattern are discarded, so standard unix comments '#' can be used in this file... (this also means that if you @@ -399,10 +399,10 @@ host : The (de)selection criteria involves a hostname. port : similar, ... a portnumber mhosts : The (de)selection criteria involves multiple-hosts, like - with the wildcars in 0.3.0, but without the 'x' + with the wildcards in 0.3.0, but without the 'x' can be: -* either a hostname, a portnumber, a service name or a numbet-dot partial +* either a hostname, a portnumber, a service name or a number-dot partial * notation indicating multiple hosts depending on * (service names like 'ftp' are resolved as the services available * present on the host that runs Sniffit, and translated into a port nr) @@ -411,7 +411,7 @@ a portnumber or service name, if was 'host' or 'mhosts' - Maybe it would have been wise to mention explicitely, that the config-file + Maybe it would have been wise to mention explicitly, that the config-file currently only works with TCP packets. examples: @@ -425,7 +425,7 @@ a) Send by host 100.100.12.2 b) Send by host 100.100.12.3 from port 1400 c) Send to coder.sniffit.com - d) All packets on our subnet going to or comming from a telnet port. + d) All packets on our subnet going to or coming from a telnet port. 2. another example: select both mhosts 100.100.12. @@ -436,7 +436,7 @@ b) EXCEPT the WWW packets c) BUT showing the WWW packets concerning enemy.sniffit.com - The config file in interpreted SEQUENTIAL, so mixing up those lines + The config file is interpreted SEQUENTIALLY, so mixing up those lines could have unwanted results e.g.: select both mhosts 100.100.12. select both host enemy.sniffit.org @@ -455,7 +455,7 @@ select both mhosts 2 deselect both mhosts 1 80 deselect both mhosts 2 80 - This would show you all subnet trafic excluding WWW trafic + This would show you all subnet traffic excluding WWW traffic (concerning port 80.) 4. example: @@ -476,12 +476,12 @@ * you will like it more this way. * * Loglevels are now activated by '-L '. -* The folowing 's are valid (concatenation is alowed): +* The following 's are valid (concatenation is allowed): * * 'raw': * Log all SYN, FIN, RST packets. This will give you an overview of -* all network (TCP) trafic in a 'RAW' way (a connection starting could -* gives you at least 2 SYN packets, etc...). +* all network (TCP) traffic in a 'RAW' way (a connection starting could +* give you at least 2 SYN packets, etc...). * This is a great way to waste diskspace... * Messages are: * Connection initiated. (SYN) @@ -507,7 +507,7 @@ * A '~' in the login and passwords fields can be a nonprintable * character (if in the beginning of a field, probably due to an early * start of registration) or a '~'. -* This all makes it sound a little messy, but I 'testdrived' a lot and +* This all makes it sound a little messy, but I 'test-drove' a lot and * was pleased with the results after adding some funky shit (if y'r * interested have a look at in function 'packethandler' in * sniffit.*.c) @@ -521,7 +521,7 @@ * * 'mail': * Interested in who writes mail to who? Well you get all senders and -* recepients nicely logged with this feature (port 25 mail). +* recipients nicely logged with this feature (port 25 mail). 4. The output @@ -563,7 +563,7 @@ connections, you will need to use 'joe' or something else that can support control chars (look for '-A ' below). Telnet 'negotiates' (binary) in the beginning of every connection, and - 'catting' a output file, will most of the time show nothing (due to + 'catting' an output file, will most of the time show nothing (due to control chars). Of course when logging mail, there are no problems. The new '-A ' takes care of the control characters, that way you @@ -612,14 +612,14 @@ - UDP Packets (not logged, displayed) - You get the package id. When using -d, -a you get the contence of the + You get the package id. When using -d, -a you get the contents of the package. (pretty basic) 4.2 Logfile ----------- -If you use a configfile (-c) and enable the Logging option a logfile is +If you use a configfile (-c) and enable the Logging option, a logfile is created. Unless you set 'logfile' in the config file, that file will be named 'sniffit.log'. It will contain lines with the following FIXED format: @@ -635,7 +635,7 @@ 3) Lines containing other data (future versions), will NOT begin with '[' and will have also easily interpretable formats. - Other data is e.g. packet contence + Other data is e.g. packet contents I do this because I can imagine (when this is more expanded) that people will use their own parsers for these logfiles. Well, if you respect those 3 @@ -651,13 +651,13 @@ Some other notes: - Sniffers can only be run by ROOT - - Sniffers can only log packets that 'travel' on THEIR ethernetcable. + - Sniffers can only log packets that 'travel' on THEIR ethernet cable. So there has to be some host on your subnet involved (either as sender or receiver). - - Working with '-d' or '-a' give you raw packets, they are still - packed in IP, when logging to files, only send data is logged, + - Working with '-d' or '-a' gives you raw packets, they are still + packed in IP, when logging to files, only sent data is logged, the packets are 'unwrapped'. - - Sniffers can NORMALY not be detected by outsiders (or outsiders + - Sniffers can NORMALLY not be detected by outsiders (or outsiders SHOULD not be able to...). Unfortunately some systems contain bugs that will allow outsiders to probe your network device for PROMISC mode (which is a good indication --- a/sniffit.0.3.7.c +++ b/sniffit.0.3.7.c @@ -48,15 +48,15 @@ { printf ( "usage: %s [-xdabvnN] [-P proto] [-A char] [-p port] [(-r|-R) recordfile]\n" - " [-l sniflen] [-L logparam] [-F snifdevice] [-M plugin]\n" + " [-l sniflen] [-L logparam] [-F snifdevice] [-M plugin]\n", + prog_name); #ifdef INCLUDE_INTERFACE - " [-D tty]" + printf ( " [-D tty]" " (-t | -s)" - " | (-i|-I) | -c]\n", + " | (-i|-I) | -c]\n"); #else - " (-t | -s) | -c]\n", + printf ( " (-t | -s) | -c]\n"); #endif - prog_name); printf ("Plugins Available:\n"); #ifdef PLUGIN0_NAME printf (" 0 -- %s\n", PLUGIN0_NAME); --- a/sn_analyse.c +++ b/sn_analyse.c @@ -151,16 +151,18 @@ { char workbuf1[MTU]; char *wb_dummy; + char *p; + size_t len = info.DATA_len <= MTU-1 ? info.DATA_len : MTU-1; - strncpy(workbuf1,data,info.DATA_len); - workbuf1[info.DATA_len]=0; + strncpy(workbuf1,data,len); + workbuf1[len]=0; strlower(workbuf1); - if(strstr(workbuf1,"mail from")!=NULL) + if((p=strstr(workbuf1,"mail from"))!=NULL) { char workbuf2[MTU]; - strcpy(workbuf2, strstr(workbuf1,"mail from")); + strcpy(workbuf2, p); if(strchr(workbuf2,13)!=NULL) /* remove trailing enter */ {wb_dummy=strchr(workbuf2,13); *wb_dummy=0;} if(strchr(workbuf2,10)!=NULL) @@ -168,11 +170,11 @@ print_mail(filename,workbuf2); } - if(strstr(workbuf1,"rcpt to")!=NULL) + if((p=strstr(workbuf1,"rcpt to"))!=NULL) { char workbuf2[MTU]; - strcpy(workbuf2, strstr(workbuf1,"rcpt to")); + strcpy(workbuf2, p); if(strchr(workbuf2,13)!=NULL) /* remove trailing enter */ {wb_dummy=strchr(workbuf2,13); *wb_dummy=0;} if(strchr(workbuf2,10)!=NULL) --- a/sn_structs.h +++ b/sn_structs.h @@ -67,7 +67,7 @@ struct snif_mask /* struct for mask */ { _32_bit source_ip, destination_ip; - _32_bit short source_port, destination_port; + _16_bit source_port, destination_port; }; /* (packet generation) */ debian/patches/use-dpkg-buildflags.patch0000644000000000000000000000230212013273232015457 0ustar Description: Use build flags from environment (dpkg-buildflags). Necessary for hardening flags. Author: Simon Ruderich Last-Update: 2012-05-04 Index: sniffit-0.3.7.beta/Makefile.in =================================================================== --- sniffit-0.3.7.beta.orig/Makefile.in 2012-05-04 12:10:08.632049736 +0200 +++ sniffit-0.3.7.beta/Makefile.in 2012-05-04 12:16:27.172051409 +0200 @@ -10,9 +10,9 @@ LIBS = @LIBS@ DEFS = @DEFS@ OS_OPT = @OS_OPT@ -OBJ_FLAG = -O2 -c +OBJ_FLAG = -O2 -c @CPPFLAGS@ @CFLAGS@ OBJ_OPT = -I./libpcap -L./libpcap -EXE_FLAG = -O2 -o sniffit +EXE_FLAG = -O2 @CFLAGS@ @LDFLAGS@ -o sniffit EXE_OPT = -I./libpcap -L./libpcap -lpcap EXE_OBJ = sn_packets.o sn_generation.o sn_interface.o sn_cfgfile.o \ sn_logfile.o sn_resolv.o @@ -27,7 +27,7 @@ sniffit: $(SNIFFIT) $(DEP_FILES) # cd libpcap; make; cd .. - $(CC) $(EXE_FLAG) $(SNIFFIT) $(EXE_OBJ) $(EXE_OPT) $(LIBS) $(DEFS) $(OS_OPT) + $(CC) @CPPFLAGS@ $(EXE_FLAG) $(SNIFFIT) $(EXE_OBJ) $(EXE_OPT) $(LIBS) $(DEFS) $(OS_OPT) sn_cfgfile.o: sn_cfgfile.h sn_cfgfile.c sn_defines.h sn_structs.h sn_config.h $(CC) $(OBJ_FLAG) sn_cfgfile.c $(OBJ_OPT) $(DEFS) debian/patches/05_fix_segfaults_on_amd64_bts644978.patch0000644000000000000000000000042611732704642020062 0ustar Author: Description: Fix segfaults on amd64 (Closes: #644978) --- a/sn_logfile.c +++ b/sn_logfile.c @@ -8,6 +8,7 @@ #include #include #include +#include #include "sn_defines.h" #include "sn_structs.h" #include "sn_logfile.h" debian/patches/fix-CVE-2014-5439.patch0000644000000000000000000000160213023535373014030 0ustar Description: fix CVE-2014-5439 - Root shell on Sniffit. Author: Hector Marco < hmarco@hmarco.or> Ismael Ripoll Last-Update: 2014-07-?? Origin: http://hmarco.org/bugs/CVE-2014-5439-sniffit_0.3.7-stack-buffer-overflow.html Index: sniffit-0.3.7.beta/sn_cfgfile.c =================================================================== --- sniffit-0.3.7.beta.orig/sn_cfgfile.c +++ sniffit-0.3.7.beta/sn_cfgfile.c @@ -119,6 +119,11 @@ char *clean_string (char *string) char help[20]; int i, j; +if(strlen(string) >= 20){ + fprintf(stderr, "Error: String too long [%s]\n", string); + exit(-1); +} + j=0; for(i=0;i= 20){ + fprintf(stderr, "Error: String too long [%s]\n", string); + exit(-1); +} + j=0; for(i=0;i Description: add support for GNU/kFreeBSD --- a/configure.in +++ b/configure.in @@ -90,7 +90,7 @@ OS_OPT= AC_SUBST(OS_OPT) ;; -freebsd*) +freebsd*|kfreebsd*) AC_DEFINE(FREEBSD) OS_OPT= AC_SUBST(OS_OPT) --- a/configure +++ b/configure @@ -1366,7 +1366,7 @@ OS_OPT= ;; -freebsd*) +freebsd*|kfreebsd*) cat >> confdefs.h <<\EOF #define FREEBSD 1 EOF debian/control0000644000000000000000000000115512025653136010576 0ustar Source: sniffit Section: net Priority: optional Maintainer: William Vera Standards-Version: 3.9.3 Build-Depends: debhelper (>= 8), libpcap-dev, libncurses5-dev, autotools-dev, automake Homepage: http://reptile.rug.ac.be/~coder/sniffit/ Package: sniffit Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends} Description: packet sniffer and monitoring tool sniffit is a packet sniffer for TCP/UDP/ICMP packets. sniffit is able to give you very detailed technical info on these packets (SEC, ACK, TTL, Window, ...) but also packet contents in different formats (hex or plain text, etc. ). debian/sniffit.examples0000644000000000000000000000006511725462427012403 0ustar sample_config_file dns_plugin.plug dummy_plugin.plug debian/source/0000755000000000000000000000000011725507671010501 5ustar debian/source/format0000644000000000000000000000001411732704625011703 0ustar 3.0 (quilt) debian/README.Debian0000644000000000000000000000415512013275376011242 0ustar sniffit for Debian ---------------------- What follows are one of the previous maintainers, Patrick J. Edwards , thoughts on this package, and its security implications. Notes on Security ----------------- This program is highly dangerous, with this program hackers no longer need qcrack or crack for your system. Instead, they can just wait till a user logs in and *BAM* they have a new password. So the point is, this program should be promptly removed in any of the following situations: 1. You are in doubt of the security of your system. Granted that some one who has already creatively acquired (meaning hacked) root can install this program his/her self there is no point in pre-installing this program for them. 2. You have a tendency to act unethically and snoop on you users for no apparent reason. "Good" system admins won't do this. 3. You don't actively search for security holes in your system. If your not doing this and you box is on the Internet 24/7 perhaps you should. Notes on Usage -------------- 1. Don't use this program unless you have to, and once you're done with it uninstall it. 2. Don't scan all ports and all addresses in the hoping of catching a hacker cause you won't, you'll just have vast quantities of logs to search through and very little disk space. Instead wait till you recognize that you have a program user/hacker and then find out what the person is doing (how the hacker is trying to penetrate the system) then start using sniffit to collect your evidence against the offender. [I know this is flying in the face of traditional anti-system-terrorism policies but it leads into my next point] 3. If you persist in using sniffit as a security net for your system DON'T. Plain and simple. Instead of trying to catch the hacker who has already hacked into your system spend your efforts security proofing your system (up to date versions on cron, sendmail, libraries, etc -- almost anything that runs as root or sudo). The overall point is: "Practice preventive medicine not reactive." -- Edward Betts Sun, 12 Sep 1999 11:04:08 +0100 debian/copyright0000644000000000000000000000352211725462427011135 0ustar This package was debianized by Damjan Marion on Tue, 7 Apr 1998 22:57:01 +0200. It was taken over by Edward Betts on Fri, 12 Nov 1999 23:20:20 +0000 It was downloaded from http://reptile.rug.ac.be/~coder/sniffit/files/sniffit.0.3.7.beta.tar.gz Upstream Author: Brecht Claerhout Copyright: Sniffit 0.3.7 Copyright (c) 1996-1998 Brecht Claerhout All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. The name of the author may not be used to endorse or promote products derived from this software without specific prior written permission. 4. Redistribution of source code must be conform with the 'libpcap' copyright conditions, if that library is included. THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. debian/sniffit.manpages0000644000000000000000000000001211734077247012352 0ustar sniffit.5 debian/sniffit.docs0000644000000000000000000000007311734077323011511 0ustar BETA-TESTING PLUGIN-HOWTO README.FIRST sniffit-FAQ HISTORY debian/sniffit.install0000644000000000000000000000002211734077167012227 0ustar sniffit usr/sbin/ debian/watch0000644000000000000000000000013711725462427010232 0ustar version=3 http://reptile.rug.ac.be /~coder/sniffit/files/ sniffit.(.*)\.tar\.gz debian uupdate