Welcome the the first article in the new Unsniff Network Analyzer Tips section.

In this article we look at a common problem many network analysts face when dealing with SSL/TLS decryption.

• You got the server admin to enter the private key
• You were able to decrypt the traffic you wanted
• The server admin now leaves the room and takes the key with him

With Unsniff there are two options :

• Simple save the result. The USNF file format stores the decrypted result and you do not need the key anymore.
• If you want to use Wireshark, you need a libpcap format file. Unsniff allows you to copy the plain text TCP streams and paste them as libpcap files. You can then fire up Wireshark to examine the plaintext pcap file.

Let us look at how you can export the plain text into libpcap format.

This article explains how you can store SNMP traps as they arrive into a MySQL database using the Unbrowse SNMP Scripting Interface. We introduce a sample schema and a script which you can easily adapt to your requirements.

You can script the behavior of Unbrowse SNMP via  VBScript or Ruby. This is done by accessing various objects defined in the Unbrowse Scripting Reference.

In this article we will script the SNMP Trap Receiver to

1. Open a network adapter and listen to all SNMP Traps on it
2. Open a ODBC connection to a MySQL database
3. As each trap arrives insert a row into the database containing the trap details.
4. Close the trap receiver.
5. Close the ODBC connection.