snot.exe - annotated network sniffing.

Description:

snot.exe is a small console utility that sends UDP discard packets with a user specified message as their payload. This is used to insert 'notes' into ongoing network sniffs as generated by such programs as Ethereal or tcpdump. (Hence... a sniffing notetaker... yeah, yeah, I just wanted to make a booger joke in the first place)

What this is useful for if you are trying to debug some specific network behavior. I have personally spent hours running a system that was having mysterious network issues through its paces, keeping a journal entry of timestamps and actions-performed-by-user in order to correlate the two later. Later, when correlating the two, you find out that your timestamps don't quite match, so it becomes difficult to isolate border-case traffic. If you use snot, however, your journal entries can be inserted directly into the sniffing data itself:

For instance...

c:\snot 192.168.2.2 logging in on pc #3

c:\snot 192.168.2.2 logging in on pc #4

c:\snot 192.168.2.2 sending message from user on #3 to user on #4

... and so on and so forth.

The ideal 'dummy host' for you to aim this utility at would be a living ip address on your current subnet. This will do two things. One, it being on your subnet will make sure that you aren't routing wonky discard packets to other parts of the network and generally pissing people off. Two, it being alive will make sure that windows sends the packet out... I believe that if it is a locally routable address and there is no arp entry for that IP address, the message will never be sent out or seen in the sniff.

Platform:

Language:

License:

Usage:

Usage: snot.exe <dummy ip> <message>

Example Output:

Download:

snot-with-src.zip - snot.exe, zipped up with source code as per GPL
snot.exe - snot.exe, all by itself
snot.zip - snot.exe, zipped up for those of you that can't download .exe's