April 19, 2009

Installing ngrep (network grep) with MacPorts on Mac OS X Leopard 10.5.6

The ngrep tool is a command-line network protocol analyzer written by Jordan Ritter and gives you the ability to apply regular expressions to filtering packets. The project can be found at http://ngrep.sourceforge.net/.

Here is the MacPorts' description of ngrep, also found at http://ngrep.darwinports.com/:

$ port cat ngrep
# $Id: Portfile 31998 2007-12-13 11:48:32Z ryandesign@macports.org $

PortSystem 1.0

name            ngrep
version         1.45
categories      net
maintainers     grace@flipt.com
description     Network grep
long_description        ngrep strives to provide most of GNU grep's common features, applying \
                        them to the network layer. \
                        ngrep a pcap-aware tool that will allow you to specify extended \
                        regular expressions to match against data payloads of packets. It \
                        currently recognizes TCP, UDP, and ICMP across Ethernet, PPP, SLIP, \
                        FDDI, Token Ring and null interfaces, and understands BPF filter \
                        logic in the same fashion as more common packet sniffing tools, \
                        like tcpdump and snoop.
homepage        http://ngrep.sourceforge.net
platforms       darwin
master_sites    sourceforge
checksums       md5 bc8150331601f3b869549c94866b4f1c \
                sha1 f26090a6ac607db66df99c6fa9aef74968f3330f \
                rmd160 d4b89dfa23f6a7c65d3ccefc846362054a46605f
use_bzip2               yes

depends_build port:libpcap
configure.args --with-pcap-includes=${prefix}/include \
--mandir=${prefix}/share/man

To install ngrep, use port with sudo:

$ sudo port install ngrep
Password:
---> Fetching libpcap
---> Attempting to fetch libpcap-1.0.0.tar.gz from http://distfiles.macports.org/libpcap
---> Verifying checksum(s) for libpcap
---> Extracting libpcap
---> Applying patches to libpcap
---> Configuring libpcap
---> Building libpcap
---> Staging libpcap into destroot
---> Installing libpcap @1.0.0_0
---> Activating libpcap @1.0.0_0
---> Cleaning libpcap
---> Fetching ngrep
---> Attempting to fetch ngrep-1.45.tar.bz2 from http://internap.dl.sourceforge.net/ngrep
---> Verifying checksum(s) for ngrep
---> Extracting ngrep
---> Configuring ngrep
---> Building ngrep
---> Staging ngrep into destroot
---> Installing ngrep @1.45_0
---> Activating ngrep @1.45_0
---> Cleaning ngrep

To get to the quick help run ngrep with the -h option:

$ ngrep -h
usage: ngrep <-hNXViwqpevxlDtTRM> <-IO pcap_dump> <-n num> <-d dev> <-A num>
             <-s snaplen> <-S limitlen> <-W normal|byline|single|none> <-c cols>
             <-P char> <-F file> <match expression> <bpf filter>
   -h is help/usage
   -V is version information
   -q is be quiet (don't print packet reception hash marks)
   -e is show empty packets
   -i is ignore case
   -v is invert match
   -R is don't do privilege revocation logic
   -x is print in alternate hexdump format
   -X is interpret match expression as hexadecimal
   -w is word-regex (expression must match as a word)
   -p is don't go into promiscuous mode
   -l is make stdout line buffered
   -D is replay pcap_dumps with their recorded time intervals
   -t is print timestamp every time a packet is matched
   -T is print delta timestamp every time a packet is matched
   -M is don't do multi-line match (do single-line match instead)
   -I is read packet stream from pcap format file pcap_dump
   -O is dump matched packets in pcap format to pcap_dump
   -n is look at only num packets
   -A is dump num packets after a match
   -s is set the bpf caplen
   -S is set the limitlen on matched packets
   -W is set the dump format (normal, byline, single, none)
   -c is force the column width to the specified size
   -P is set the non-printable display char to what is specified
   -F is read the bpf filter from the specified file
   -N is show sub protocol number
   -d is use specified device instead of the pcap default

April 13, 2009

Flip Video FlipShare software uses SQLite for its database engine

The Flip is a compact video camera from Pure Digital Technologies.

The FlipShare software for the Flip Video stores its information in a database. Using the file command reveals that the database format is SQLite, version 3.

$ cd ~/Movies/FlipShare\ Data/
$ file flipshare.db
flipshare.db: SQLite database (Version 3)

We can then display all the tables in the database using the sqlite3 command-line tool:

$ sqlite3 flipshare.db .tables
Contact                  ContactSetDetails        MediaElementSourceGraph
ContactInfo              ContactType              UserFolderMediaElements
ContactProvider          MediaElement             UserFolders
ContactProviderType      MediaElementHistory      Versions
ContactSet               MediaElementSource

The UserFolder table is rather simple:

$ sqlite3 flipshare.db '.schema UserFolders'
CREATE TABLE UserFolders (id integer primary key, folderName varchar(256) not null, parentId integer);

We can perform a schema dump of the UserFolder to see the contents:

$ sqlite3 flipshare.db '.dump UserFolders'
BEGIN TRANSACTION;
CREATE TABLE UserFolders (id integer primary key, folderName varchar(256) not null, parentId integer);
INSERT INTO "UserFolders" VALUES(1,'January 2009',8);
INSERT INTO "UserFolders" VALUES(2,'February 2009',8);
INSERT INTO "UserFolders" VALUES(3,'March 2009',8);
INSERT INTO "UserFolders" VALUES(4,'December 2008',8);
INSERT INTO "UserFolders" VALUES(5,'June 2008',8);
INSERT INTO "UserFolders" VALUES(6,'July 2008',8);
INSERT INTO "UserFolders" VALUES(7,'August 2008',8);
INSERT INTO "UserFolders" VALUES(8,'September 2008',8);
INSERT INTO "UserFolders" VALUES(9,'October 2008',8);
INSERT INTO "UserFolders" VALUES(10,'May 2008',8);
COMMIT;

The SQL dump of the UserFolders table matches the folders that we see within the FlipShare software:

The MediaElementSource table keeps track of the path to the video files:

$ sqlite3 flipshare.db '.schema MediaElementSource' | sed 's/[ ][ ]*/ /g'
CREATE TABLE MediaElementSource (id integer primary key, uri varchar(256) not null, mediaType int not null, dataAccessible int);

The MediaElement table stores metadata about the videos, such as the creation date and thumbnail:

$ sqlite3 flipshare.db '.schema MediaElement' | sed 's/[ ][ ]*/ /g'
CREATE TABLE MediaElement (id integer primary key, mediaType int not null, mediaOrigin int not null, mediaSourceId integer, name varchar(256) not null, CreationDate varchar(256), PreviewImagePath varchar(256), SizeInBytes integer not null, ParentFolder integer, StartTime double, EndTime double, category_id integer not null, album_id integer not null, hash_code varchar(32) not null, camcorder_serial varchar(48), width integer, height integer, duration double default 0);

April 13, 2009

Giving Twitter the NoScript love

NoScript (http://noscript.net/) can be used to block malicious JavaScript and shield against attacks such as the recent Twitter worm.

Forbid twitter.com:

Some features will break, such as accepting new follower requests.

You can even go as far as marking twitter.com Untrusted:

Fans of the original non-AJAX pagination rejoice! One of the side-effects of disabling JavaScript on Twitter is your home page reverts to old school pagination, one page at a time.