From: Eric Wong <normalperson@...>
Date: 2010-04-03T16:27:31+09:00
Subject: Re: socket programming...lsof?

Derek Smith <derekbellnersmith@yahoo.com> wrote:
> > env ruby -w
> > require 'socket'
> > host = 'localhost'
> > port = 22
> > #
> > s = TCPSocket.open(host, port)
> > 
> > while line = s.gets   # Read lines from the socket
> >   puts line.chop      # And print with platform line terminator
> > end
> > s.close               # Close the socket when done
> > 
> > 
> > derek@vaio-ubuntu:~$ sudo ruby port_tst.rb
> > SSH-2.0-OpenSSH_5.1p1 Debian-5ubuntu1
> 
> What if I want to see any data passing over that port, 113 or any other
> port? Any adjustments in this code?

You should actually use something like tcpdump or some other sniffer.
See http://en.wikipedia.org/wiki/Tcpdump for more info.

Since tcpdump uses libpcap, and there are libpcap bindings for Ruby, so
you could probably do this via the Ruby bindings without much
difficulty (I've never tried this).

> SSH port 22 seems to work, well sort of.  When connections come in,
> shouldn't I see some type of encryption strings?

No, not at all.

Your current code is opening a new and private connection to a TCP
server (sshd).  This is just as if you're normally opening a new ssh
client connection to your server (without actually going through the
handshake.

TCP connections are generally private (unicast).  That is when a client
connects to a server, that connection is a bidirectional bytestream
only intended for the client and server to consume.

You need special OS-level tracing tools like libpcap (or knowledge
of obscure syscalls which libpcap uses) to listen into the private
server<->client channel as a 3rd party.

-- 
Eric Wong