.NET Information center: Network

Showing posts with label Network. Show all posts

Monday, June 27, 2011

Fiddler and IPv6-only environments

I recently got a bug report from a user who was attempting to use Fiddler in a pure-IPv6 environment, where IPv4 is entirely disabled. On startup, he saw the following message:
The problem here is an obscure one, which makes it somewhat interesting. What’s happening is that Fiddler is trying to create an IPv4 listener socket listening on port 8888 locally. However, because this is a pure IPv6 environment, permission to create such a socket is denied.
By default, Fiddler will create an IPv4 listen socket unless the following three criteria are met:

    The computer supports IPv6 (Vista+ support it by default; various installs are required for XP)
    The Enable IPv6 option is ticked inside Tools > Fiddler Options > General
    The Allow remote computers to connect option is set inside Tools > Fiddler Options > Connections

Now, the first two requirements are somewhat self-explanatory, but the third bears some explanation. If only the first two requirements are met, Fiddler will be able to connect to IPv6 sites, but the browser will only be able to connect to Fiddler using IPv4.

The reason that the third requirement exists is that some clients (particularly IE6’s WinINET, and likely others) don’t support IPv6-literal proxy addresses, and hence attempting to poke [::1]:8888 into the system proxy settings would fail for such clients. So, Fiddler cannot safely bind to IPAddress.IPv6Loopback, and will bind to IPAddress.Loopback instead. However, if you enable the Allow remote computers to connect option, Fiddler will instead bind to IPAddress.IPv6Any which allows connecting on both IPv4 and IPv6 addresses on any adapter.

Read more: Fiddler Web Debugger

Posted via email from Jasper-Net

Wednesday, June 22, 2011

Net.TCP Port Sharing

Windows Communication Foundation (WCF) provides a new TCP-based network protocol (net.tcp://) for high-performance communication. WCF also introduces a new system component, the Net.TCP Port Sharing Service that enables net.tcp ports to be shared across multiple user processes.

Background and Motivation

When the TCP/IP protocol was first introduced, only a small number of application protocols made use of it. TCP/IP used port numbers to differentiate between applications by assigning a unique 16-bit port number to each application protocol. For example, HTTP traffic today is standardized to use TCP port 80, SMTP uses TCP port 25, and FTP uses TCP ports 20 and 21. Other applications using TCP as a transport can choose another available port number, either by convention or through formal standardization.

Using port numbers to distinguish between applications had security problems. Firewalls are generally configured to block TCP traffic on all ports except for a few well-known entry points, so deploying an application that uses a non-standard port is often complicated or even impossible due to the presence of corporate and personal firewalls. Applications that can communicate over standard, well-known ports that are already permitted, reduce the external attack surface. Many network applications make use of the HTTP protocol because most firewalls are configured by default to allow traffic on TCP port 80.

The HTTP.SYS model in which traffic for many different HTTP applications is multiplexed onto a single TCP port has become standard on the Windows platform. This provides a common point of control for firewall administrators while allowing application developers to minimize the deployment cost of building new applications that can make use of the network.

The ability to share ports across multiple HTTP applications has long been a feature of Internet Information Services (IIS). However, it was only with the introduction of HTTP.SYS (the kernel-mode HTTP protocol listener) with IIS 6.0 that this infrastructure was fully generalized. In effect, HTTP.SYS allows arbitrary user processes to share the TCP ports dedicated to HTTP traffic. This capability allows many HTTP applications to coexist on the same physical machine in separate, isolated processes while sharing the network infrastructure required to send and receive traffic over TCP port 80. The Net.TCP Port Sharing Service enables the same type of port sharing for net.tcp applications.

Thursday, June 16, 2011

Service Listening to TCP, HTTP and Named Pipe at the same time

Introduction

The example below implements a simple service that is able to receive requests via TCP, HTTP and Named Pipe. Therefore, the service can be available for clients using different communication. E.g. Windows Phone 7 environment supports only HTTP.

The example is based on the Eneter Messaging Framework 2.0 that provides components for various communication scenarios.

(Full, not limited and for non-commercial usage free version of the framework can be downloaded from http://www.eneter.net. The online help for developers can be found at http://www.eneter.net/OnlineHelp/EneterMessagingFramework/Index.html.)

Multiple Listening

To implement the multiple listener, we will use the Dispatcher component from the Eneter Messaging Framework.

The Dispatcher receives messages from all attached input channels and forwards them to all attached output channels.

In our scenario, the dispatcher will have three input channels (TCP, HTTP and Named Pipe) and only one output channel (local channel to the message receiver).

So, if a message is received e.g. via the TCP input channel, the dispatcher will forward it through the output channel to the typed message receiver. The typed message receiver then notifies the user code implementing the service.

Multiple Listening Service Application

The service is implemented as a simple console application. The most important part is using of the dispatcher component for the multiple listening (TCP, HTTP and Named Pipe).

Since the service listens also to HTTP, you must execute it under sufficient user rights. (I recommend administrator for the debug purposes.)

The whole implementation is very simple.

using System;

using Eneter.Messaging.EndPoints.TypedMessages;

using Eneter.Messaging.MessagingSystems.HttpMessagingSystem;

using Eneter.Messaging.MessagingSystems.MessagingSystemBase;

using Eneter.Messaging.MessagingSystems.NamedPipeMessagingSystem;

using Eneter.Messaging.MessagingSystems.SynchronousMessagingSystem;

using Eneter.Messaging.MessagingSystems.TcpMessagingSystem;

using Eneter.Messaging.Nodes.Dispatcher;

namespace MultiReceivingService

{

public class RequestData

{

public int Number1 { get; set; }

public int Number2 { get; set; }

}

class Program

{

// Receiver receiving 'RequestData' and responding 'int'.

// Note: Duplex typed message receiver can receive messages of specified type

// and send response messages of specified type.

private static IDuplexTypedMessageReceiver<int, RequestData> myReceiver;

static void Main(string[] args)

{

// Create local messaging connecting the dispatcher with the receiver.

IMessagingSystemFactory aLocalMessaging =

new SynchronousMessagingSystemFactory();

IDuplexInputChannel aLocalInputChannel =

aLocalMessaging.CreateDuplexInputChannel("MyLocalAddress");

IDuplexTypedMessagesFactory aTypedMessagesFactory =

new DuplexTypedMessagesFactory();

myReceiver = aTypedMessagesFactory.CreateDuplexTypedMessageReceiver

<int, RequestData>();

myReceiver.MessageReceived += OnMessageReceived;

Tuesday, June 14, 2011

What you should know about HTTP pipelining

This article will cover the following topics:

An overview of the basics of HTTP

What is HTTP pipelining?

What problems can appear with HTTP pipelining?

Why you should care about HTTP pipelining?

Which web servers support HTTP pipelining?

Which browsers support HTTP pipelining? (And how to enable it)

Which programming languages/libraries support HTTP pipelining?

An overview of the basics of HTTP

The HTTP protocol works by sending requests and getting responses back for those requests.

I will not get into the details of the HTTP protocol syntax. Details about headers, HTTP methods, paths, parameters, etc., as this post would be too long. Instead I'll just cover some basics and then dive right into explaining HTTP pipelining. But I will show a basic HTTP GET request and response.

A typical HTTP request looks something like this:

GET / HTTP/1.1

Host: www.brianbondy.com

User-Agent: Mozilla/5.0

Connection: keep-alive

A typical HTTP response looks something like this:

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Server: Google Frontend

Content-Length: 12100

...content...

Monday, June 13, 2011

Wifi Network Backup Manager Utility

After couple of years I was too lazy to do it, each time I format my computer or want to copy Wifi networks between my machine to another I faced a problem, there is easy way to copy network profiles so I’ve created a simple utility that allows you to Save and Load Wifi Network Profiles, using Native Wifi API through P/Invoke interop.

[DllImport("wlanapi.dll")]

public static extern int WlanGetProfile(

[In] IntPtr clientHandle,

[In, MarshalAs(UnmanagedType.LPStruct)] Guid interfaceGuid,

[In, MarshalAs(UnmanagedType.LPWStr)] string profileName,

[In] IntPtr pReserved,

[Out] out IntPtr profileXml,

[Out, Optional] out WlanProfileFlags flags,

[Out, Optional] out WlanAccess grantedAccess);

[DllImport("wlanapi.dll")]

public static extern int WlanGetProfileList(

[In] IntPtr clientHandle,

[In, MarshalAs(UnmanagedType.LPStruct)] Guid interfaceGuid,

[In] IntPtr pReserved,

[Out] out IntPtr profileList

);

Thursday, May 26, 2011

An IPv6 primer for humans: the Internet’s Next Big Thing

The IPv4 Crisis

The IPv4 address space is 32-bit. That means that 32 bits, four bytes, are available to store and denote an IP address. It’s written in something called dotted-quad notation, with values for each part ranging between 0-255. For example:

192.168.10.12 - VALID

192.168.10.456 - INVALID (last part outside 0-255 range)

Fairly simple stuff, really. The important part here is that we have four ‘parts’ of one byte each, for a total of 32 bits. The largest decimal number that can be represented with 32 binary bits (1 repeated 32 times) is 232 – a grand total of 4,294,967,296. Let’s just clarify that with some bold text. Bold text – like the humble fez – is cool.

Without sneaky workarounds, the Internet can only support just over four billion connected devices.

That’s a big number, but it’s not big enough. Firstly, due to protocol restrictions, certain addresses are reserved for special purposes, dropping that number. Also, the world’s population is just under seven billion. With the rate that the Internet is growing, we need at least one address per person. However, it’s not that simple – due to the way blocks of addresses have been allocated, and the way certain devices and applications work, we are very, very close to exhausting the entire address space right at this very moment.

This is a remarkably bad thing. But there’s a solution.

Enter IPv6

Specified in RFC 2460, IP version 6 was designed to address the address space shortcomings of IPv4 – but there’s more to it than that. IPv4 is quite a basic protocol, and IPv6 pulls a lot of features that live on top of IPv4 (like autoconfiguration and IP mobility) into the IP layer itself. This adds manageability and functionality without needing a user to install a whole lot of third-party software – everything sits in the operating system’s IPv6 stack.

Chances are that the operating system that you’re using right now has support for IPv6. Windows has had strong support since Windows XP, Linux has supported IPv6 for a very long time, and Mac OS X has had an excellent stack- the KAME stack from FreeBSD – since Tiger (10.4).

An IPv6 IP address looks very different to an IPv4 address. It is referred to as an AAAA record in DNS (in contrast to IPv4′s A record). Here’s Geekosaur’s -

2001:1b90:1001:208:b00b::2

What you see here is an abbreviated version of an IPv6 address. Any string of consecutive zeros can be represented by a double colon – but this can be done once and only once (otherwise, the expansion would be ambiguous). Also, leading zeros in a segment (as separated by colons) can be stripped, in the same way that if I were to write ’23′ and ’00000023′ they would be the same number. To give the full IPv6 address of this site -

2001:1b90:1001:0208:b00b:0000:0000:0002

Decimal notation, as used in IPv4, is shunned in favour of hexadecimal notation to keep addresses shorter. Each segment contains four hexadecimal digits between 0 and f (0, 1, 2, 3, 4, 5, 6, 7, 8, 9, a, b, c, d, e, f) and there are eight segments in a full address.

So how many addresses do we have to play with? Easy answer – 2128 before any losses to special use cases. That’s a lot of addresses. To be exact, it’s this many addresses -

340,282,366,920,938,463,463,374,607,431,768,211,456

Thursday, May 19, 2011

Использование Protocol Buffers на платформе .Net (Часть 1)

Предлагаю вашему вниманию введение в использование Protocol Buffers на платформе .Net в формате дискуссии. Я расскажу и покажу что это такое и зачем оно нужно .Net разработчику. Топик требует от читателя начального владения языком C# и системой контроля версий SVN. Так как объем материала превышает среднестатистический объем топиков на хабре, которые не вгоняют хаброюзеров в тоску и не заставляют их скроллить до комментариев, было принято решение разбить его на две части. В первой части мы познакомимся с основами и даже напишем (не)много кода!

Здравствуйте, а что такое Protocol Buffers?

Согласно определению на официальной странице, Protocol Buffers (protobuf) – это способ кодирования структурированных данных в эффективном и расширяемом формате, применяемый корпорацией Google почти во всех своих продуктах. Для большинства платформ, включая .Net, такой процесс называется сериализацией.

Я пользуюсь сервисами Google, но как protobuf поможет мне в разработке .Net приложений?

Да вы правы, Google не занимается написанием специализированных библиотек для .Net разработчиков. Однако существует проект protobuf-net (одна из нескольких реализаций protobuf для платформы), который позволяет использовать protobuf в .Net. Им руководит Marc Gravell — завсегдатай stackoverflow.com и участник множества других отличных проектов. Так что вы всегда можете задать ему вопрос, и он с радостью ответит на него (чем и злоупотреблял автор топика).

Почему мне стоит использовать эту библиотеку вместо встроенных средств?

Когда речь заходит о сериализации в .Net, все обычно вспоминают о существовании бинарного форматера и xml сериализатора. Следующее, что отмечают разработчики, то, что первый быстрый и имеет высокую степень сжатия, но работает только в пределах .Net платформы; а второй представляет данные в человеко-читабельном формате и служит основой для SOAP, который в свою очередь обеспечивает кросс-платформенность. Фактически утверждение, что вам всегда нужно делать выбор между скоростью и переносимостью, принимается за аксиому! Но protobuf позволяет решить обе проблемы сразу.

Wednesday, May 18, 2011

Windows 7 Network Awareness: How Windows knows it has an internet connection

Have you ever been connecting to a new wireless network and seen the following pop-up balloon?

Whenever I connect to a WiFi network which requires in-browser authentication, such as university networks and hotel access points, Windows somehow magically knows. Windows also knows when your internet connection isn’t working, and can differentiate between having local LAN access, no network access at all, or full internet access. But how?

This week’s question of the week is one I myself asked about this very topic. I guessed that there must be some online Microsoft site that Windows is checking to determine the state of the connection, but I wanted proof, not just speculation.

How does Windows know whether it has internet access or if a Wi-Fi connection requires in-browser authentication?

Tobias Plutat and Jeff Atwood both replied with information about the Network Connectivity Status Indicator (NCSI) service, first introduced in Windows Vista.

Wednesday, May 04, 2011

How To Network Boot (PXE) The Ubuntu LiveCD

With Ubuntu’s latest release out the door, we thought we’d celebrate by showing you how to make it centrally available on your network by using network boot (PXE).

Overview

We already showed you how to setup a PXE server in the “What Is Network Booting (PXE) and How Can You Use It?” guide, in this guide we will show you how to add the Ubuntu LiveCD to the boot options.

If you are not already using Ubuntu as your number one “go to” for troubleshooting, diagnostics and rescue procedures tool… it will probably replace all of the tools you are currently using. Also, once the machine has booted into the Ubuntu live session, it is possible to perform the OS setup like you normally would. The immediate up shut of using Ubuntu over the network, is that if your already using the CD version, you will never again be looking for the CDs you forgot in the CD drives.

Thursday, April 28, 2011

Scapy

What is Scapy

Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more. It can easily handle most classical tasks like scanning, tracerouting, probing, unit tests, attacks or network discovery (it can replace hping, 85% of nmap, arpspoof, arp-sk, arping, tcpdump, tethereal, p0f, etc.). It also performs very well at a lot of other specific tasks that most other tools can't handle, like sending invalid frames, injecting your own 802.11 frames, combining technics (VLAN hopping+ARP cache poisoning, VOIP decoding on WEP encrypted channel, ...), etc. See interactive tutorial and the quick demo: an interactive session (some examples may be outdated).

Mausezahn

What is Mausezahn?

Mausezahn is a free fast traffic generator written in C which allows you to send nearly every possible and impossible packet. It is mainly used to test VoIP or multicast networks but also for security audits to check whether your systems are hardened enough for specific attacks.

Mausezahn can be used for example:
As traffic generator (e. g. to stress multicast networks)
To precisely measure jitter (delay variations) between two hosts (e. g. for VoIP-SLA verification)
As didactical tool during a datacom lecture or for lab exercises
For penetration testing of firewalls and IDS
For DoS attacks on networks (for audit purposes of course)
To find bugs in network software or appliances
For reconnaissance attacks using ping sweeps and port scans
To test network behaviour under strange circumstances (stress test, malformed packets, ...)

...and more. Mausezahn is basically a versatile packet creation tool on the command line with a simple syntax and context help. It could also be used within (bash-) scripts to perform combination of tests. By the way, Mausezahn is quite fast; when started on my old PIII-Laptop (1.4 GHz, Gigabit Ethernet) I measured 755 Mbit/s using the interface packet counters of an HP ProCurve 5400 switch.

Monday, April 18, 2011

Android Proxy Configuration for Emulator[Solved]

Introduction

This is a post for all those working on Android and wanting to access the internet over Android.

Just follow these simple steps:

First of all, open cmd.
Move to tools directory of your Android folder. For example, in my case:

:cd E:/Downloads/software/android-sdk-windows/tools/

Run the Android (Do so by eclipse or using Android.bat).

Now when you have reached the menu screen of Android, then type adb shell in cmd.

Your prompt should change like #

Now type:
sqlite3 /data/data/com.android.providers.settings/ databases/settings.db

Now your command prompt will look like sqlite>
Enter this command where Proxy IP is the IP of your Proxy server and port is its port value.

INSERT INTO system VALUES(99,’http_proxy’,'Proxy IP:port’);

Check your entry by typing:

select * from system;

If you found your entry, then move over to your Android mobile.
Click the home button.
Click on menu button.
Click on settings.
Click on wireless control.
Click on mobile networks.
Click on access point name.

Sunday, April 17, 2011

WebSockets in 5 minutes

HTTP is by design an asymmetric protocol: clients can contact the server whenever they want (without the user having to issue a command, thanks to Ajax requests). The server instead cannot normally send updates at the client at the time of its choosing.

Connections are made as HTTP requests, GET or POST in nearly all web browsers, from the client to the server, and never the opposite. This mechanism simplifies the protocol in many ways, but raises issues whenever a real-time interaction is desiderable. How to implement a chat in a browser?

There are some work arounds but...

The simplest solution is polling the server continuously: every 5 seconds we send a request, and the server tells us which messages are arrived in the chat room. However this raises the load on the server, which must manage a huge number of new connections at the same time.

A slightly better model is long polling (and other similar techniques which collectively go under the name of Comet), where each connection made by the client is kept open until there are some data to return to the client. The connection may also have a timeout, but it's very simple to just restart one after a 60-second timeout has expired.

The problem with both styles is that they are not really scalable with the current HTTP servers. Apache dedicates one process to each connection - if you have to keep open a process for every user in a chat, the server will quickly halt. There are however different HTTP servers, like CouchDB and Node.js, which do not allocate multiple processes and are capable of handling this large number of simultaneous open connections.

WebSockets

Since we already have to change some server-side infrastructure to support the server pushing to the client on certain events, let's do it with a standard protocol. HTML 5 WebSockets promise a bidirectional full-duplex connection, which is not closed after the first data returned by the server along with headers, but remains open like any TCP connection.

Technically speaking in fact, WebSockets are a mechanism for tunneling a TCP connection over HTTP: you can send whatever you want in the communication channel, but the communication is wrapped into a text stream with HTTP headers such as Host and Origin.

NetworkView - A cool WPF control for diagraming network, graphs, flowcharts, etc

Introduction

This article examines the use and implementation of a WPF custom controlthat is used to display and edit networks, graphs and flow-charts. NetworkView, as I have called it, was inspired by and has many similarities to standard WPF controls such as ItemsControl and TreeView. The article and the sample code show how to use the control from XAML and from C# code.

This article is arranged in two main parts.

Part 1 examines NetworkView usage with walkthroughs of the two sample projects. This part and the reference section are enough if you just want to use NetworkView.

Part 2 goes into detail on the implementation. This will be useful if you want to make your own modifications to NetworkView or if you want to understand my approach to developing a complex WPF custom control.

At the end of the article is a reference section that describes the public properties, methods and commands exposed by NetworkView.

In previous articles I have covered a number of WPF techniques: use of adorners, zooming and panning,binding to UI element positions and most recently drag-selection of multiple items. NetworkView and the sample applications make use of all these techniques. I won't be covering these techniques in detail here. Instead, where appropriate, I'll refer back to previous articles.

NetworkView is intended to be backed with an application-specific view-model. It is possible, though I don't recommend it, to use NetworkView programmatically or in XAML without a view-model. This is similar to other WPF controls such as TreeView where you can also get by without a view-model. Using a view-model is the way it is intended to be used, so this is what we will be looking at. The simple sample uses a simple view-model while the advanced sample extends the view-model and adds new features. Josh Smith has a great article that shows how a view-model can improve your experience with the WPF TreeView.

Posted via email from Jasper-Net

Thursday, April 14, 2011

RawCap

RawCap is a free command line network sniffer for Windows that uses raw sockets.

Properties of RawCap:

Can sniff any interface that has got an IP address, including 127.0.0.1 (localhost/loopback)

RawCap.exe is just 17 kB

No external libraries or DLL's needed other than .NET Framework 2.0

No installation required, just download RawCap.exe and sniff

Can sniff most interface types, including WiFi and PPP interfaces

Minimal memory and CPU load

Reliable and simple to use

Usage

You will need to have administrator privileges to run RawCap.

F:\Tools>RawCap.exe --help

NETRESEC RawCap version 0.1.2.0

http://www.netresec.com

Usage: RawCap.exe <interface_nr> <target_pcap_file>

0. IP : 192.168.0.17

NIC Name : Local Area Connection

NIC Type : Ethernet

1. IP : 192.168.0.47

NIC Name : Wireless Network Connection

NIC Type : Wireless80211

2. IP : 90.130.211.54

NIC Name : 3G UMTS Internet

NIC Type : Ppp

3. IP : 192.168.111.1

NIC Name : VMware Network Adapter VMnet1

NIC Type : Ethernet

4. IP : 192.168.222.1

NIC Name : VMware Network Adapter VMnet2

NIC Type : Ethernet

5. IP : 127.0.0.1

NIC Name : Loopback Pseudo-Interface

NIC Type : Loopback

Example: RawCap.exe 0 dumpfile.pcap

Monday, April 11, 2011

Wpf Over Websockets (WoW) – How to Pump WPF windows & animations to browsers over HTML5 Websockets And Canvas

Over the weekend, I just put together a hack for pumping WPF windows over Websockets and rendering it using HTML5 canvas – also with basic mouse input support. For each user connecting to the server, a new window instance is created, and screen will be pumped over web sockets to the browser as base64 encoded images. These images are painted on an HTML5 canvas. The entire source code is here at codeplex – http://wow.codeplex.com

What does this mean?

Once HTML5 specification is final - it is almost certain that it’ll be the most widely adopted platform for delivering applications to end users. With Websockets in HTML5, we are going beyond the unidirectional, stateless http to a full duplex, high speed connection infrastructure between the server and the client. This will definitely bring up lot of interesting possibilities, including exciting and feature rich user experiences. WPF is already a widely adopted, feature rich desktop application development platform, and this hack is a quick POC to bring the WPF experience over the web to the end user using HTML5 web sockets and canvas.

You can see that I’m accessing my WPF application over multiple browsers in the below video. Just to clarify, it is rendered in the browser purely using HTML5 canvas – No Silverlight or Flash

Rendering the screen in the browser

HTML5 draft specification includes Websockets - http://dev.w3.org/html5/websockets/

WebSocket is a technology providing for bi-directional, full-duplex communications channels, over a single Transmission Control Protocol (TCP) socket. It is designed to be implemented in web browsers and web servers but it can be used by any client or server application. The WebSocket API is being standardized by the W3C and the WebSocket protocol is being standardized by the IETF.

Here is a pretty minimized implementation of the page that opens a web socket, retrieve the image data, and draws the same on a canvas

var socket = new WebSocket("ws://localhost:8181/main");

socket.onopen = function () {

}

socket.onmessage = function (msg) {

var canvas = document.getElementById("canvas");

var ctx = canvas.getContext("2d");

var img = new Image;

img.onload = function () {

ctx.clearRect(0, 0, canvas.width, canvas.height)

ctx.drawImage(img, 0, 0); // Or at whatever offset you like

};

img.src = "data:image/gif;base64," + msg.data; ;

}

Friday, April 08, 2011

MyRouter (Virtual WiFi Router)

Project Description

MyRouter is a virtual WiFi AP (Access Point)

it allows you to connect all your WiFi Enabled devices to the internet using your Windows 7 laptop or Desktop (WiFi card adapter / USB adapter required) it is still under development with major changes coming

Friday, March 04, 2011

Network Monitor

Project Description
Simple application with a vu-meter style display of recent incoming network traffic.
- Requires .NET 4,
- Requires WinPCap (http://www.winpcap.org/)
- Only tested to run under Windows 7

Read more: Codeplex

Posted via email from Jasper-Net

Tuesday, February 15, 2011

Fiddler and the IE9 Release Candidate

I’m delighted to announce that the now-available IE9 RC includes three significant enhancements for users of proxy-based debuggers like Fiddler.

These improvements are:

The default Connections-Per-Proxy limit has been raised from 6 to 12, improving performance and in some cases reducing Observer Effect.
Debugging of traffic sent to Localhost / 127.0.0.1 now “just works”—configuration changes are not required.
Internet Explorer now can be configured to emit information about why a given HTTP request was issued, which helps you understand your web traffic.

I’ll explain each of these three improvements in this post.

Connections-Per-Proxy Limit

Browsers are typically designed to limit the number of connections made to a single server in order to prevent overloading it or incurring other problems. Some browsers have a different limit depending on whether the server being contacted is a proxy server or a normal host (web server). Internet Explorer 6 and 7 apply the “web server” connection limit to proxies as well; the two connection limit those versions use can severely impact your debugging performance when using Fiddler. Users still using those outdated browsers can re-configure the connection limit to mitigate this problem. Internet Explorer 8 limits the connections per proxy to six, which was a welcome improvement, but still could cause performance problems when debugging sites that “shard” their requests to many different hosts. Internet Explorer 9 maintains the existing connections-per-host limit of six, but also includes an specific connections-per-proxy limit which is set to 12 by default. This increased limit should help reduce the impact of connection limits upon your debugging scenarios.
For comparison, Firefox’s default value for the network.http.max-persistent-connections-per-proxy setting is eight, but the FiddlerHook extension kicks this value up to twenty-four.

Proxying Localhost Traffic

The WinINET networking component that is used by Internet Explorer and many other applications will automatically bypass a fixed proxy (like Fiddler) for traffic bound for //localhost and //127.0.0.1 because these “loopback” addresses point to the local machine and traditional proxy servers will not be able to interpret such addresses properly. However, for a debugging proxy running on the local computer, these are perfectly understandable addresses, and when developers are debugging against a local server (like IIS Express or the Visual Studio Test Server Cassini) they often test against these loopback addresses. To proxy loopback traffic from IE8 and below, somewhat awkward workarounds are needed.

Read more: Fiddler Web Debugger

Posted via email from Jasper-Net

Mallory – Transparent TCP & UDP Proxy

Mallory is a transparent TCP and UDP proxy. It can be used to get at those hard to intercept network streams, assess those tricky mobile web applications, or maybe just pull a prank on your friend.
In more technical terms, Mallory is an extensible TCP/UDP man in the middle proxy that is designed to be run as a gateway.

The goal is to man in the middle traffic for testing purposes. The ideal setup for Mallory is to have a “LAN” or “Victim” network that Mallory acts as the gateway for. This can be configured within a virtal machine environment using host only network interfaces. The victim virtual machines then configures the Mallory machine as the gateway by manually setting its gateway. The gateway machine will have at least one WAN interface that grants Internet access. The victim network then uses the Mallory gateway to route traffic.

Folder Structure

ca – certificate authority files including Mallory’s private key
certs – MiTM certs that are created on the fly
db – directory where mallory stores all database files
mallory – empty directory
src – where the code lives
scripts – scripts used to configure mallory enviorment

Read more: Darknet.org.uk

Posted via email from Jasper-Net