search

rflynn / lanmap2

builds database/visualizations of LAN structure from passively sifted information
147 stars 41 forks source link

Capture 'hangs' after random amount of time... #2

Open thegeeknme opened 14 years ago

thegeeknme commented 14 years ago

It will run for anywhere from 10 seconds to maybe 45seconds.

Last few lines that show... " linktype=1 parsed 802.3 len=383 bytes=14 parsed LLC len=369 bytes=8 cdp.c test_llc 0x2000 vs. pid=0x2000 do_parse_addrs 240 as->cnt=1 cdp.c do_parse (len=77) bytes=17 contents=\x02\x00\x11\x00\x01\x00\x00\x00\x01\x01\xcc\x04\x00YF(f cdp.c do_parse (len=43) bytes=8 contents=\x04\x00\x08\x00\x00\x00\x00\x00 parsed CDP len=361 bytes=361 Logical id=93 type=1 bytes=383 when=0 802.3 src=00:21:a0:d5:f3:82 dst=01:00:0c:cc:cc:cc len=369 LLC dsap(ig=0 addr=0xaa) ssap(cr=0 addr=0xaa) cmd=0x03 org=0x00000c pid=0x2000 CDP ver=2 ttl=180 chksum=0x21d7 DevID="B1_F2_2.3" SoftVer="Cisco IOS Software, C1130 Software (C1130-K9W8-M), Version 12.3(7)JX4, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2006 by Cisco Systems, Inc. Compiled Wed 31-May-06 11:33 by evmiller"rep_hint HintUpd SQLITE_DONE rep_hint 0.060 secs " Not sure if there are log files or what to look for.

Love the idea and I'm interested to see where it goes form here.

Running Ubuntu 9.04 GNOME 2.26.1 lspci -v | grep Ethernet -A 1 00:19.0 Ethernet controller: Intel Corporation 82566DM-2 Gigabit Network Connection (rev 02) Subsystem: Dell Device 0211

rflynn commented 14 years ago

Is there a pattern? Is a Cisco CDP message always the last thing before it crashes? It may be a parsing bug. If CDP is always last, can you get a .pcap dump of the packet that crashes it? It will help debug.