Added Support for the TCPDump Adapter to LiveWire Omnipeek - LiveWire - 25.1.0

LiveWire 25.1.0 New Features
ft:locale
en-US
Product name
LiveWire
Version
25.1.0

Support for the TCPDump Adapter has been added the LiveWire Omnipeek UI. The TCPDump Adapter is a plugin which allows the user to capture packets on a remote system, sending the packet data back to the LiveWire via an SSH connection.

Note: The target box must be running Linux.

Required SSH Configuration

Usage of this plugin will likely require changes to the LiveWire and the target box. Both endpoints must be able to agree on a ciphersuite which is also supported by Ubuntu’s libssh1.10.

LiveWire config:

  • Add the following lines to /root/.ssh/config

Target config:

  • Make the following changes to /etc/ssh/sshd_config
    • Delete the following lines if they exist:
  • Add the following line if it does not exist:

  • Add ssh-rsa to the list of HostKeyAlgorithms.

Be sure to restart sshd on both endpoints and omnid on the LiveWire. Currently, only RSA and DSS keys are supported.

The user also needs to modify the /etc/sudoers file on the target host to allow tcpdump to run with elevated privilege.

Workflow

Create a new adapter:

Insert Adapter

Enter address and credentials, then click Next:

TCPDump Adapter Wizard

Create a capture with the new adapter:

Create a capture Captures - Packets