I am planning on putting either the NST (http://www.networksecuritytoolkit.org/nst/index.html) on my Pi or just downloading a lot of similar tools and then using my Pi as a security device to monitor all the traffic on my network. Has anyone done anything like this and does anyone know if you can boot this version of Fedora onto the Pi?
Here's the cite from the
The toolkit was designed to provide easy access to best-of-breed Open Source Network Security Applications and should run on most x86/x86_64 platforms.
ARM CPU so it's not possible to directly use
NST on it. You would have to recompile everything and probably do some other changes in order to run this distribution.
Most of the tools should be available in Raspbian (or other RaspberryPi's distributions so that would be easier way to use the tools.
You can also take a look at PwnPi distribution which claims to have 200+ network security tools preinstalled.
The basis of monitoring a network is packet sniffing. As you may or may not be aware, all traffic on a network is inevitably received by all computers on that network -- the reason for this is kind of obvious WRT to wireless,1 but the same principle applies to wired systems. All messages are received by everybody, but normally an OS kernel ignores messages not addressed to it.
However, since all systems receive all packets,2 any system can examine any packet (this is why encryption is so important to security). By default, the linux kernel includes a userspace interface for doing so. The normal way to do this programmatically is with libpcap, which is the basis of tools like tcpdump and wireshark.
apt-cache search tcpdump on a pi running raspbian yields:
apt-cache search tcpdump argus-client - IP network transaction auditing tool argus-server - IP network transaction auditing tool bittwist - libpcap-based Ethernet packet generator dhcpdump - Parse DHCP packets from tcpdump hlbr - IPS that runs over layer 2 (no TCP/IP stack required) ipgrab - tcpdump-like utility that prints detailed header information libncap-dev - static library and header files for libncap libncap44 - network capture library libnet-pcap-perl - Perl binding to the LBL pcap packet capture library libpcapnav0 - wrapper to libpcap libpcapnav0-dev - development files for libpcapnav mitmproxy - SSL-capable man-in-the-middle HTTP proxy ncaptool - network capture tool net-acct - User-mode IP accounting daemon netsed - network packet-altering stream editor ngrep - grep for network traffic nstreams - network streams - a tcpdump output analyzer p0f - Passive OS fingerprinting tool picviz - Parallel coordinates plotter python-ncap - Python bindings for libncap ssldump - An SSLv3/TLS network protocol analyzer tcpdump - command-line network traffic analyzer tcpflow - TCP flow recorder tcpreplay - Tool to replay saved tcpdump files at arbitrary speeds tcpslice - extract pieces of and/or glue together tcpdump files tcpspy - Incoming and Outgoing TCP/IP connections logger tcpstat - network interface statistics reporting tool tcptrace - Tool for analyzing tcpdump output tcpxtract - extracts files from network traffic based on file signatures ulogd-pcap - pcap extension to ulogd
So, there is no shortage of packet sniffing tools. Wireshark is also available. Wireshark itself is a GUI but includes a CLI tool,
The wireshark tools in particular are very well documented.
1. Actually, although it may be easier to understand WRT wifi, sniffing on a wired network is easier because wired ethernet networks are seldom if ever completely encrypted (this is distinct from TLS/SSL encryption, which is applied to specific message contents, and not outer protocols used for addressing, etc). To so this on an encrypted wifi network you need to be able to observe all parties connect to the network, whereas with ethernet, you can do it at any point and process packets from anyone regardless of when they connected.
2. As bobstro points out in comments, uses of switches and bridges in the network can impact this. You will know if you are using something like this. The same applies to using routers to divide into subnets; the way I am using "network" here really refers to individual subnets.
You could also consider setting your device up to be monitored by a cloud security monitoring service like siemless (which operates a freemium model - so free for home users). They have an interesting blog piece on setting this up on a Raspberry Pi: https://siemless.com/blog/raspberry/ Their threat use cases appear quite basic at present, although their contextual rules look to be interesting.
The NST page mentions including many of the sectools.org tools, and many of those are available on Raspbian. I have installed many of those on RPis and used them during network configuration and security testing work. They work well, so long as you are cognizant of the limitations of the RPi in terms of network throughput.
You are not going to be able to sniff traffic on a busy network that saturates the RPi interface reliably, especially at 1 Gbps+ speeds. It really depends on how busy your home network is. If you're willing to live with possibly missing some traffic, it's probably more than adequate for such use.
It works very well for things like scanning (
nmap), limited traffic sniffing that doesn't saturate the interface (
tshark), firewall testing (
snort should work within bandwidth limits, although I haven't tried it yet on the RPi myself.