iLiad Sniffing the iDS connection - Page 2

deadite66 · 08-11-2006, 03:51 AM

<removed>

this looks the version information, i was hoping for a text file with the version and a download link

TadW · 08-11-2006, 04:41 AM

The eui64 is most probably a 64bit representation of the 6-byte MAC address of your iLiad's network interface. So it appears the MAC address is 00:16:7c:00:0x:xx.

Productid is probably there to identify that you have a iLiad ER-0100 device.

When you do a bit more with iDS, like a software upgrade, we'll have a lot more useful information.

deadite66 · 08-11-2006, 04:48 AM

guess we'll have to wait till the next update.

TadW · 08-11-2006, 04:50 AM

Yup

deadite66 · 08-12-2006, 08:38 AM

i do forsee a problem though, ettercap expect the victim ip to be up where the iliad only turns on ethernet when connecting to ids.
so timing will be important and i may miss the update.

TadW · 08-12-2006, 08:46 AM

Good point.

Does the iLiad automatically start the update process when it connects to iDS and finds an upgrade? Or does it first inform you?

If it doesn't "warn" you first, you may want to avoid connecting to iDS unless you are really sure that there is a new upgrade available (which you would quickly find out about from others here on board). At the end timing could be a bit tricky to make sure Ettercap captures everything from the beginning.

deadite66 · 08-12-2006, 08:49 AM

2.4 i'm sure it just started updating could be different for 2.5 though

TadW · 08-13-2006, 06:36 AM

To get around this timing issue, use Ettercap to sniff via your iLiad's MAC address instead. So if your MAC address is 00:16:7c:00:0e:5e and your gateway IP is 192.168.0.10, use the following command:

ettercap -Td -L /tmp/logfile.log -M arp:remote 00:16:7c:00:0e:5e// /192.168.0.10/

Only make sure you start the prior you connect to iDS with your iLiad.

arivero · 08-14-2006, 12:39 PM

Quote:

Originally Posted by deadite66

2.4 i'm sure it just started updating could be different for 2.5 though

2.4 will first advance to 2.4.10 via a flash at shutdown. Then 2.5, then packages for 2.5, then 2.6 ?

lhl · 08-15-2006, 01:26 AM

Has anyone successfully captured a 2.4 upgrade? Has anyone deconstructed the communication stream to see if it's susceptible to replay or what the handshaking is like? Is there anywhere else where discussion is happening on the results?

arivero · 08-15-2006, 07:21 AM

Quote:

Originally Posted by lhl

Has anyone successfully captured a 2.4 upgrade? Has anyone deconstructed the communication stream to see if it's susceptible to replay or what the handshaking is like? Is there anywhere else where discussion is happening on the results?

See my other thread. I captured os.gz but failed to capture fs.gz and then my filesystem were updated. I failed because I counted on renaming the files using /bin/mv, and the boot filesystem does not contain mv!

TadW · 08-15-2006, 01:00 PM

Has anyone already succeeded in sniffing the upgrade of 2.6?

08-11-2006, 03:51 AM	#16
deadite66 Groupie Posts: 197 Karma: 16 Join Date: Apr 2006 Device: irex iliad, uk Kindle gen3	<removed> this looks the version information, i was hoping for a text file with the version and a download link Last edited by deadite66; 10-05-2006 at 02:16 AM.

08-11-2006, 04:41 AM	#17
TadW Uebermensch Posts: 2,583 Karma: 1094606 Join Date: Jul 2003 Location: Italy Device: Kindle	The eui64 is most probably a 64bit representation of the 6-byte MAC address of your iLiad's network interface. So it appears the MAC address is 00:16:7c:00:0x:xx. Productid is probably there to identify that you have a iLiad ER-0100 device. When you do a bit more with iDS, like a software upgrade, we'll have a lot more useful information. Last edited by TadW; 10-05-2006 at 11:31 AM. Reason: MAC xx'ed out as wished by deadite

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
ids down ?	reaver121	iRex	0	01-16-2010 09:53 AM
Wireless internet connection frustrating IDS connection	Socrates	iRex	8	10-21-2009 12:46 PM
how to connect to ids?	foxql	iRex	10	04-01-2009 10:38 AM
Cannot Find an Answer IDS Connection	barney111	iRex	3	11-04-2008 07:13 AM
iLiad I want to connect to IDS. Please help me.	wklee	iRex Developer's Corner	3	07-17-2007 11:52 PM

08-11-2006, 04:48 AM	#18
deadite66 Groupie Posts: 197 Karma: 16 Join Date: Apr 2006 Device: irex iliad, uk Kindle gen3	guess we'll have to wait till the next update.

08-11-2006, 04:50 AM	#19
TadW Uebermensch Posts: 2,583 Karma: 1094606 Join Date: Jul 2003 Location: Italy Device: Kindle	Yup

08-12-2006, 08:38 AM	#20
deadite66 Groupie Posts: 197 Karma: 16 Join Date: Apr 2006 Device: irex iliad, uk Kindle gen3	i do forsee a problem though, ettercap expect the victim ip to be up where the iliad only turns on ethernet when connecting to ids. so timing will be important and i may miss the update.

08-12-2006, 08:46 AM	#21
TadW Uebermensch Posts: 2,583 Karma: 1094606 Join Date: Jul 2003 Location: Italy Device: Kindle	Good point. Does the iLiad automatically start the update process when it connects to iDS and finds an upgrade? Or does it first inform you? If it doesn't "warn" you first, you may want to avoid connecting to iDS unless you are really sure that there is a new upgrade available (which you would quickly find out about from others here on board). At the end timing could be a bit tricky to make sure Ettercap captures everything from the beginning.

08-12-2006, 08:49 AM	#22
deadite66 Groupie Posts: 197 Karma: 16 Join Date: Apr 2006 Device: irex iliad, uk Kindle gen3	2.4 i'm sure it just started updating could be different for 2.5 though

08-13-2006, 06:36 AM	#23
TadW Uebermensch Posts: 2,583 Karma: 1094606 Join Date: Jul 2003 Location: Italy Device: Kindle	To get around this timing issue, use Ettercap to sniff via your iLiad's MAC address instead. So if your MAC address is 00:16:7c:00:0e:5e and your gateway IP is 192.168.0.10, use the following command: ettercap -Td -L /tmp/logfile.log -M arp:remote 00:16:7c:00:0e:5e// /192.168.0.10/ Only make sure you start the prior you connect to iDS with your iLiad.

08-15-2006, 01:26 AM	#25
lhl Webmonkey Posts: 7 Karma: 10 Join Date: May 2006 Location: SF Bay Device: iLiad	Has anyone successfully captured a 2.4 upgrade? Has anyone deconstructed the communication stream to see if it's susceptible to replay or what the handshaking is like? Is there anywhere else where discussion is happening on the results?

08-15-2006, 01:00 PM	#27
TadW Uebermensch Posts: 2,583 Karma: 1094606 Join Date: Jul 2003 Location: Italy Device: Kindle	Has anyone already succeeded in sniffing the upgrade of 2.6?

Advert

Advert