pitter patter on the keyboard

This is more of an anecdote than a tutorial since I threw it together with what was handy and wouldn’t endorse this kind of work on-site.

I love moving. Broken back, head-to-toe agony and thousands of dollars vaporized aside – it gives me an opportunity to put new holes in walls and try to make it look as though the rent is a little higher than it actually is.

So, when I saw this ugliness it had to go immediately.

I opened it up and was a little surprised to see….

I removed the box and found the wire connected to…

Am I balls-trippin’  or did I discover the first decorative phone jack ever? I could understand if it was used to store drugs, but being painted over this is unlikely.

I don’t even need cat5 and a phone line in that room but this whole thing started consuming all the idle cycles of my brain. What the hell was that phone jack doing there? Who put it there? Why? Just what were these savages trying to prove?!

Forunately (?) there was also an inexplicable empty hole in the wall near where the jack had been.

Note that a lot of these 8P8C wall-plate/surface box modules do not follow the colour code as though you were crimping a connector. Follow the guide provided on the module for the way the other end is wired.

Apparently it is politically correct to use T-568A these days but the industry (including manufacturers of prefab cables) still seems to prefer B. Personally, I have always wired for B on straight-throughs.

Cut the drywall such that the module will pass into it. I should note here that if you want to save on wire the phone line can be spliced into the blue or brown pairs, but it’s always nicer to run both cables if you can.

Ideally we would be using a dual-port faceplate instead but I had a surface-mount RJ11 jack handy and went for it. I used a filing bit on my drill to make a little gap for the phone wire to come out, otherwise the faceplate won’t rest flat against the wall and one risks blowing out the threads in the drywall (easily fixed and better done by tapping in anchors and re-screwing, mind you). It would also be a good idea to put a knot in the line inside the box; however with the faceplate and a dozen staples holding it snug I don’t see it being much of an issue.

Ta-da! All better. :)

Wireshark is a powerful and popular packet capture and analysis suite that runs on Windows and most flavours of UNIX. Often one finds one’s self in need of its GUI’s abilities on remote, headless servers without X windows (and who wants to install X on a server if they don’t have to?). One has three options: use a text/ncurses based packet capture system like ettercap to analyze the traffic on the server itself, save packet capture files and move them to your Wireshark host or pipe the output from tshark – Wireshark’s text interface – to your client in real-time. The last option suits me best; I don’t want to have to learn two packet capture suites if I can only use one and it is often useful to see the packets fly by as they come.

To compile Wireshark without the GUI, and therefore all of its X windows dependencies, on Gentoo:

# USE=”-gtk” emerge wireshark

Or disable the GTK use flag in your /etc/make.conf.

The next step is to establish passwordless root ssh access to the target machine. This should only be temporary as it is best practice to disallow any form of remote login for the root user. Please read my previous article, Passwordless or Single Password SSH with Key Exchange but be sure to use a blank passphrase for your key and disregard the part about restricting root access. Once this has been completed and you are able to log in to the target server by simply typing ssh hostname you are ready to begin your packet capture.

On the client which runs the GUI version of Wireshark, open up a shell as root and run the following:

wireshark -k -i < ( ssh -l root xxx.xxx.xxx.xxx /usr/bin/tshark -i eth0 -w - )

Be sure to change the path to tshark if this does not reflect your installation. Adjust the interface (-i flag) to match your target.