ECHOLOT(1)

NAME
echolot - network station monitor

SYNOPSIS
echolot [-a][-c][-D][-f] [-i interface] [-d database] [-I idendity][-s ./script.pl] [-h|-v]

DESCRIPTION
Here in detail. Before any IP connection is established, the computers will exchange their MAC addresses by the Address Resolution Protocoll (ARP). These ARP packets contain the MAC address of the sender, its IP address and some more information. They are broadcasted to any computer on the lan, even thru switches (but not thru gateways). echolot sniffers these packets on a given interface and tries to resolve a domain name (netbios, dns etc., see Scripting section below). This information is stored in a database which is compatible with "iptraf". Now you can detect already known hosts, like popular ftps on lan parties, you can detect foreign hosts on your network, possible intruders to your companies lan and you can prevent IP and MAC spoofing - or kick someones ass therefor. echolot announces, if faked ARP packets are sent and it announces if the IP address of a client changes. This gives you the capability to say host abc had IP xyz at some date. You can exactly see who used an IP at some time.

OPTIONS

-a, --add
    add new hosts to database

-c, --continuously
    announce continuously, only useful if you have nothing else to do;)

-D, --daemonize
    start as a daemon and write to the syslog

-f, --force
    force startup if pid file already exists

-i, --interface
    use given interface, default is "any"

-d, --database
    use given database, default is "/var/db/echolot.mac"

-I, --idendity
    set default description for new hosts

-s, --script
    use external resolver script, i.e. "echolot -s ./date.pl"

-h, --help
    print this short help

-v, --version
    print release and copyright information

EXAMPLES
* Detecting Intruders You will have to generate a database, including all of your trusted computers. Run therefor echolot
  echolot -a -i eth0 -I "my-computers" -d "~/trusted.mac"

echolot will watch on interface eth0 for all activities and will use "my-computers" as base-name. All data is stored to "~/trusted.mac". After some minutes, most of your computers should be in the database, now you can run echolot

  echolot -i eth0 -I "my-computers" -d "~/trusted.mac"

and all new hosts will be reported, but not stored. You will see, if there is activity from any new hosts on your network. It is also a good idea to run echolot as a daemon, see this below.

* Finding Servers Again

Just run echolot in collection mode (-a/--add)

  echolot -a -i eth0 -D "my-computers" -d "~/trusted.mac" (fixme)

It will report any computers on your lan and add new ones to your database. If a hosts looks fine, you just have to remember its name or modify the correspondending entry in the database.

SEE ALSO
tcpdump(1), libpcap(3), echolot howto and website http://echolot.sf.net/

COPYRIGHT
echolot may be used under the terms of the BSD License. See the LICENSE file in the source directory therefor.

AUTHORS
echolot was written in 2002 by Benjamin Schweizer <besh@gmx.net>
  http://www.redsheep.de/ a lot of help with the BSD port was given by Andreas Turtschan
  <darklordat@gmx.de> the code uses the libpcap, which is (c) by the tcpdump group.
  http://www.tcpdump.org/