Eclectic Security

About:
Nast is a packet sniffer and a LAN analyzer that can perform a broad range of advanced network analysis and security assessments. A very comprehensive syntax and a human readable output make the usage less cryptic. This isn’t a replacement for Tcpdump, it’s an addition!

DISCLAIMER:
This tools can cause harm to the normal operation of your network/servers if used improperly. Use this tool on your own networks/servers, or networks/servers for which you have been given permission to test. Before using this tools, please read the documentation available.

Main Features:

* Build LAN hosts list
* Follow a TCP-DATA stream
* Find LAN Internet gateways
* Discover promiscuous nodes
* Reset an established connection
* Perform a single half-open portscanner
* Perform a multi half-open portscanner
* Find link type (hub or switch)
* Catch daemon banner of LAN nodes
* Control ARP answers to discover possible ARP-spoofing
* Byte counting with an optional filter
* Write reports logging

Installation (ubuntu 10.4):
apt-get install nast

Examples:

*Map the LAN by performing a series of ARP request to sequential subnet IP addresses.

#nast -m

Nast V. 0.2.0

Mapping the Lan for 255.255.255.0 subnet … please wait

MAC address        Ip address (hostname)
===========================================================
00:18:F8:78:6E:35     192.168.1.1 (unknown) (*)
00:14:D7:02:4F:54     192.168.1.2 (192.168.1.2)
00:0C:29:EF:82:91     192.168.1.3 (192.168.1.3)
00:0C:29:3A:93:DC     192.168.1.4 (192.168.1.4)
00:0C:29:36:AE:D3     192.168.1.5 (192.168.1.5)
00:0C:29:68:D3:F8     192.168.1.6 (192.168.1.6)
00:0A:5E:53:65:C8     192.168.1.7 (192.168.1.7)
00:0C:29:36:FF:D4     192.168.1.8 (192.168.1.8)
00:1E:E5:84:C8:C3     192.168.1.9 (192.168.1.9)

(*) This is localhost

*Check other NIC on the LAN with the promiscuous flag set.

#nast -P all

Nast V. 0.2.0

This check can have false response, pay attention!
Probe for hosts…done

192.168.1.1 (unknown)   ———> Found!

*Try to find possible Internet-gateways.

#nast -g

Nast V. 0.2.0

Finding suitable hosts (excluding localhost) ->
Done

Trying 192.168.1.1 (00:18:E8:78:5E:35)-> Good

*