howtoforge.com — This article shows how you can test your Linux firewall with a tool called FTester (Firewall Tester). With FTester you can check your firewall's filtering policies. The tool consists of two perl scripts, a packet injector (ftest) and the listening sniffer (ftestd). Furthermore, FTester also provides Intrusion Detection System (IDS) capabilities.
May 9, 2006 View in Crawl 4
mancatMay 10, 2006
Wow. What an insane amount of work and complexity to get only a tenth of the information that nmap gives you in half the time.
mack1082May 10, 2006
Looks like the wheel has been re-invented. I think I'll stick with Nmap.
keithwintMay 10, 2006
If you actually read the docs you'll see that this has *nothing* to do with testing firewalls ala nmap/firewalk. It's a competely different tool that produces real traffic (including stateful one) and you can *actually* check and *spoof* the packets (and connections) and see what's happening on theother side. It's a completely different testing method which is complementary to nmap approach.Ideally you should use both, so please don't try to compare two completely different methods.
jimmyblakeMay 10, 2006
On Enterprise firewalls terminating point-to-point VPN connections from over 280 remote sites globally, some of which you don't trust because they have just been taken over in an acquisition, running bespoke applications on funky ports - you could easily get that many rules. I've worked on firewalls for managed services arms of telcos with tens of thousands of rules.That is why I don't say 'just use Nessus and nmap - it's all you need'.James
jimmyblakeMay 10, 2006
I agree, this has more akin to Tomahawk (mentioned above). People are just trying to flex their muscle by proving they know about one-or-two tools. I use quite a few tools in my job including Tomahawk, Spike, THC-AMAP, Etherape, dsniff, TCP traceroute, aircrack/airsnort/airereplay/kismet (for wireless), ettercap, ethereal, fping, nemesis, driftnet, vomit, john the ripper, hydra, nikto, ngrep, ntop, arpwatch, dsniff, fragroute, nmap, nessus, nessus inline, cheops, metasploit (rarely), honeyd, firewalk, lids, tripwire, aide, stunnel, tcpdump/tcpreplay, bile, paketto, ISS scanner, eEye Retina, nCircle 360, SkyBox and more.James
jimmyblakeMay 10, 2006
Two words, inaccurate and sucky on its own. All nessus scans need manual confirmation.