Peep: The Network Auralizer 169
Manuka writes "I have just returned from LISA 2000 in New Orleans (it was a blast), where Michael Gilfix of Tufts University presented a best-of-LISA paper on his creation, called Peep. This has got to be one of the coolest networking tools I've seen - it generates sound events based on network traffic. Really neat stuff like a bird chirping when mail comes in, or an owl hooting when your web server dishes up a page (you can actually use any sound for any event). Neat little way to generate background noise, and you can see (hear) what the network is up to and if it's doing anything weird - if the owl sounds like it's on speed, you're being slashdotted, or if the birds sound a little too hitchcockian, you're being spammed. " But what is the sound of one cracker scanning?
Re:Site Slashdotted! (Score:3)
http://www.eecs.tufts.edu/peep/download.html [tufts.edu]
Re:Here at Tufts - (Score:1)
network zen (Score:1)
Re:Better traffic sounds than birds - VEHICLES! (Score:1)
Or you could just uninstall NT.
Re:Sound of one script kiddie scanning... (Score:1)
old school version of this (Score:2)
It works better if you have an FM radio nearby and tune it to an unused frequency range. Did that on my TI-994/A a lot.
Re:More crack-addict moderation (Score:1)
--
Audible pings to trace network faults (Score:3)
Am I the only one who remembers the sysadmin who hooked the output of ping(1) into a text-to-speech program, turned his speakers up to full, and started pinging a machine at the other end of the building?
"PING... PING... PING..." on each successfully returned packet.
He then started wandering the halls, tweaking cables. When he bumped a cable and the noise stopped coming from his office, he knew he had found the fault. :-)
Cliplay (Score:2)
Re:Sound of one script kiddie scanning... (Score:2)
I doubt it. It's pretty centric to his network, meaning that it's got a lot of sensitive info in it (not just ip addresses but comments like # ok, this next line indicates someone sniffing at the db server, telling you what IP the db server is running on) and that porting it to a generic network would be a bitch.
But basically all you need is a perl script that reads from stdin, filters those lines (regexps), and has a sort of function table or callback mechanism (e.g. if /someMatch/ then somefunc() ). Redirecting the output from ipmon to the script isn't hard (direct pipe in the case of running ipmon from the shell without the -d daemonize flag, the -f flag (iirc) that specifies log file combined with a named pipe pointing at the script, that sort of thing). I don't know about linux firewalls (iptable, ipchains, ipfwadm, whatever) and logging methods, so that may require a different solution.
The callback funcs are where the action is (i.e. pass the line on to syslog(open a filehandle to syslog on LOG then "print LOG $line;"), drop it on the floor, do something else; sort of a syslog firewall ;-) ). The command to play the mp3 was something like
system("/usr/local/bin/mpg123","/path/to/thunk.mp3 "). (using the split arg form of system is more secure b/c IIRC that way you aren't subject to shell interpretation)
The mp3 itself is a pretty trivial matter. Buy a cantaloupe (I think that's what he used) and let it get more than overripe but not enough to be gross. Put mic next to cantaloupe, recording to a wav, then hit cantaloupe with board. Convert wav to mp3 using any number of tools. Viola. :-) If you didn't mind the extra disk space you could leave it a wav and use some other tool (or maybe still mpg123, I've never tried to play a wav with it so it might support that (much simpler) format). Of course if you don't want to DIY I'm sure there are plenty of funny wav files out on the internet to use (movie quotes, tv clips (beavis and butthead anyone?), random sounds, etc).
--
Larry Wall also uses audio for montioring (Score:1)
Amoung other things he described how it emitted submarine-like acoustic "pings" for proximity sensors on his lawn and very detailed Caller ID identification of incoming phone calls. It had different sounds or music for common people (e.g., Tom Christiansen, or Randal Schwartz), the city or state of unrecognised calls where spoken.
MP3 attack! (Score:1)
Needless to say, once I recovered from my heart-attack and general scare and confusion (what? where am i? whose breaking into my apartment!?), I proceeded to remove him from the group with the access to the audio device.
Re:old school version of this (Score:1)
You can do that now, if your hardware is crappy enough. I get static through my earphones on my Compaq at work whenever there's CPU activity. It's bizarre.
--
BACKNEXTFINISHCANCEL
IRIX Snoop (Score:1)
All I want now are packets that sound like "Mein Leben" for re-sends after collisions.
--
Re:The Sound... (Score:1)
Uhm, (Score:1)
Aren't you a bit young to be starting your second childhood, Taco?
--
Aaahhh! (Score:2)
Sorry.
Re:The Sound... (Score:1)
Computer speech == useful! (Score:3)
We were in desperate need of re-writing our network/database/communications monitoring software, so I figured...why not add voice to it? So I added a soundcard and speakers to the new system, and used some text-to-speed software. Result? Pissed off operators!
Printer alert! Printer 1 is jammed!
Communications alert! Dialer 2 is hung!
Printer alert! Printer 2 is out of paper!
Oh well...at least the printer's don't sit around jammed for more than 1 minute now =)
But what is the sound of one cracker scanning? (Score:1)
I imagine it sounds much like the microsoft "Jungle" sound theme - Full of sound and fury, and signifying hacking.
ObDisclaimer: I know the difference between Cracker and Hacker. Thankyouverymuch.
Re:The end of alphanumeric paging... (Score:1)
Re:How about using sounds as FEEDBACK instead (Score:3)
Okay, maybe it's slightly more useful than that -- but it's usually not necessary or even helpful. If you are scrolling, the really useful feedback is the fact the window is scrolling. Or the button is depressed, or whatever. I haven't found that sound adds anything useful to that.
The nice thing about a sense that's entirely seperated from vision, is that it can be used for something entirely unrelated to what you are looking at. The sound I hear when walking down the street doesn't effect my understanding of what I see very much -- I can see the street and the other people just fine. But I can hear things going on outside my field of vision and my field of attention, and that can be very useful (for instance, if I hear someone walking up behind me).
Sound seems to be particularly appropriate for background events. People are very good at filtering it out -- I can be on a train and listen to one person over the sound of the train and other people's conversation. But if someone else says my name -- even though I'm actively listening to something else -- I will notice that. That's really pretty damned impressive when you think about it, and yet a nearly universal skill.
Beware of speech (Score:1)
In the middle of stepping through a fiddly subroutine, the computer behind me said 'Hi, I'm in Masschusetts'. I hope whover it was enjoyed the sight of me levitating 2 feet in shock.
Tangible Media group at MIT Media Lab (Score:1)
--
What I really want to know is ? (Score:1)
Sounds of a password being found (Score:2)
How about using sounds as FEEDBACK instead (Score:5)
For instance, whenever you're scrolling, there is a "scrolling" sound. Very soft and subtle -- but continuous for as long as you're holding down the mouse button. There is a "window dragging" sound. Again, soft and subtle. But it strongly reinforces what you're doing. Grab the scroll-thumb and drag it rapidly, and the sound changes to match.
Using sounds to notify you of very frequent, non-user initiated, events, such as web server hits (or on some systems, frequent events, such as blue screens), seems to be potentially annoying.
Re:About time (Score:2)
AM Radios next to old computers (Score:2)
Themes (Score:2)
Re:network zen (Score:1)
Katzu!
(whacks Nater over the head with a large clue-stick)
Great (Score:3)
Network Sounds (Score:1)
Ethernet weather (Score:1)
When the network was being lightly used, the string would twitch lazily in the corner of the office. Typically, it would whirl in a nice spiral. When the network was being hit hard, it would sing so loudly you could hear it across the hall.
I've wanted a "dangling string ethernet monitor" ever since.
Question (Score:1)
Chernobyl found that audible alarms are bad (Score:4)
The emphasis is on 'non-critical'. I recall that an investigation into the Chernobly nuclear disaster pointed to audible alarms as one of the contributing factors. Basically, when the reactor started malfunctioning, so many alarms were going off that the techs were unable to identify which was the most important alarm and hence they didn't respond appropriately to the situation.
why? (Score:2)
Not entirely original (Score:2)
It's fun if you have sounds for a small set of events that happen infrequently enough to be worthwhile. It's noise otherwise.
Re:Themes (Score:1)
can't stand computer noises (Score:2)
Somebody in our office has it set up where it says "You have email, Master". Across the room it sounds like "You have email, Bastard".
The sound of a Troll with a slow modem... (Score:1)
Maybe that's why he did it... (Score:2)
"Titanic was 3hr and 17min long. They could have lost 3hr and 17min from that."
What time is it? (Score:1)
Re:About time (Score:2)
I agree this would be helpful. Another study (don't have the reference, sorry) dealt with the absence of sound. Kittens could be conditioned to expect food when sounds (in this case a clicking noise) stopped.
(Of course that doesn't mean it's going to be aesthetically pleasing to humans. NASA also researched the high-visibility color scheme for VDTs that was later adopted by Amiga -- black, white, dull blue, garish orange. Ugh!)
how about this kernel printer error: (Score:2)
Put that one in text to speech and tell us what the reaction is!
"Titanic was 3hr and 17min long. They could have lost 3hr and 17min from that."
Re: those long time readers (Score:1)
Re:Jungle Sounds (Score:1)
"Now, I hope and pray that I will, but, today I am still just a bill"
Audible Nukes (Score:1)
Audible, and visual warnings are remarkably effective when they are well implemented. The problem is that bad things rarely happen individually, and a queue is often used to store multiple alarms. So if you have a ding-ding-bong-ding-bong-ding sequence, where dings are not as severe as bongs, you tend to get confused. It's a lot like playing Simon, where eventually the sequence overwhelms you.
What needs to be done is some kind of prioritization of the alarms, so the more critical ones could be accessed more simply - but the powers that be tend not to trust automated systems, and prefer to have a confused human making decisions.
The REAL jabber has the /. user id: 13196
Shhh! Not so loud... (Score:1)
The REAL jabber has the /. user id: 13196
No! (Score:2)
The PHB (technically clueless) decided it would be a good idea for us to remotely manage customer sites via Managewise (over a single ISDN line - natch!). He got hold of some 3rd party speech software for Managewise, and installed it on the managewise console which incidentally was next to my desk. Why me - I had nothing to do with the Netware side of things. Both the soundcard (an el-cheapo 8-bit jobbie from 1990) and speakers (very low quality - bundled with another card) were mine - I had brought them in for some other project and they were still hanging around.
Whenever a user logged in or out I'd here some speech indicating what had happened, or some other noises. No-one was actually monitoring the machine (too much effort), and I'd get thoroughly annoyed by this thing blasting out noises and messages all day.
Eventually I trashed the speakers by disconnecting the cables inside - peace at last!
The PHB left shortly afterwards - Managewise was a disaster over ISDN.
New dog, OLD trick... (Score:1)
I used to work for a newspaper where part of my job was maintaining 16 PDP-11's ... LOTS of blinkity lights which could, at a glance, give the experienced tech a good idea what the systems were up to: I miss that.
I am one of those folks who dislikes working on MACs partly because they don't have hard disk activity lights (at least the ones I've used)... I'm a feedback junkie.
Sound feedback (so long as the sounds are subtle) is an excellent way for one to not have to keep constant vigilence on something, but still be able to INSTANTLY know if something out-of-the-ordinary id going on. As long as I get to chose what sound plays and can tell the system which events I am interested in, I think something like this would be worth looking into.
+++++++++++++++++++++
Re:Backup peep site (Score:2)
---
Re:Better traffic sounds than birds - VEHICLES! (Score:1)
--
You think being a MIB is all voodoo mind control? You should see the paperwork!
Now all we need... (Score:1)
C: "woof woof WOOF woof WOOF WOOF WOOF!"
SA: "What's that, Lassie?"
C: "woof woof WOOF WOOF woof WOOF WOOF woof!"
SA: "It's timmyh? And he's portscanning from the WELL?"
Re:The Carpenter Ants (Score:1)
That's awfully harsh, considering it was entirely due to the story that I was inspired to write the parody (or even think of the song, as I rarely think of it).
Guess /. moderation (and maybe meta-moderation) isn't working as well as everyone seems to think it is.
Medical Field has known this too (Score:1)
I can take care of other people and divert my attention to other things as opposed to staring at a screen. Very useful for multitasking.
Re:Better traffic sounds than birds - VEHICLES! (Score:1)
Re:How about using sounds as FEEDBACK instead (Score:1)
This effect applies to all system sounds, so you can tell where your cursor is.
Re:Sound of one script kiddie scanning... (Score:1)
hisservername has rejected packet from 123.456.789.123 inbound to 987.654.321.98. /.ed :-)
(IPs faked so that he doesn't get
It's really rather cool, and takes almost zero CPU power except when it's actually speaking.
--GrouchoMarx
My other account is CmdrTaco
--GrouchoMarx
Re:Audible pings to trace network faults (Score:3)
-Andy
Sounds Cool (Score:1)
Now all I have to do is go out and buy SB live cards for all of my servers....Then that will justify when people say "It's a jungle in there".
One cracker scanning... (Score:1)
Re:FRiST POST ASSHOLES (Score:1)
Re:why not nature sounds? (Score:1)
Re:Reminds me of Netscape (Score:2)
Here:
Wednesday, 12 October 1994, midnight [jwz.org] -- at the base of the entire web document.
Re:Yes, but.. (Score:2)
--
Going with the bird theme... (Score:2)
Re:Snoop (Score:2)
You can tell it to concentrate on one or two machines etc. But the coolest feature is activated
using the -a option. This causes snoop to output a
click on the speaker for each packet.Different
packet lengths are given different modulation.
It's been said that you can get used to the different sounds and actually tune the network
"by ear".
Cookies (Score:3)
Sound of one script kiddie scanning... (Score:3)
I posted about this (or at least it was a tangent in a post about something else) a few days ago. A friend of mine wrote a perl script to moniter the ipmon-generated output of his OpenBSD firewall. When teh script recognized common script kiddie scans, it would play an mp3 of a ripe melon hitting a board (or a board hitting a ripe melon, either way a rather satisfying, moist thunk), represent a kiddie fruitlessly hitting his/her head against the firewall.
(Common scans like the port 135-140 range of MSFT shit, that sort of thing.)
--
It's been done before (Score:2)
Re:About time (Score:3)
ObPlug: Tufts University is looking to fill positions for sysadmins with developer tendencies to work on this and similar bleeding-edge projects. We presented two papers at LISA this year. Please email me for details.
Re:How about using sounds as FEEDBACK instead (Score:2)
Re:why? (Score:2)
Been there, done that. (Score:2)
Particularly, Sensorium [sensorium.org] highlighted this back in '96: NetSound [sensorium.org]
Damn it! (Score:2)
The next step. (Score:2)
A pleasure to diagnose... (Score:5)
MG: "Yeah, there's a problem with system XYZ..."
Me: "How so?"
MG: "Well, usually is goes 'ree-ree-tinktinktinktink', you know? But right now it's going 'ree-ree-tinktink-bong-bong-tink'!"
Me: "Is that 'bong' like a doorbell chime, or more like a big chinese gong?"
MG: "In between but more like a gong, I think."
Me: "Well, shit."
cheers,
mike
Tangible Media (Score:2)
Here's a cool link to the Tangible Media Lab [mit.edu].
This stuff is really interesting in this age of info overload. Being able to convey more information to the user immediately and effectively will become even more useful.
--
Sounds I might include (Score:2)
For port scans, I'd use basic tones, the pitch corresponding to the port being scanned -- your ear might detect something better than your firewall. Of course, the obvious thing that would follow, once it's known that someone uses tones to listen for port scans, would be to scan the ports in such a fashion as to generate music.
cb
Yes, but.. (Score:4)
--
cool (Score:2)
The Sound... (Score:3)
--
Site Slashdotted! (Score:5)
---
Oh boy. (Score:2)
Makes me wish I was a Sytems Administrator
at one of them "adult" web-hosting companies.
My server room never sounded so good!
Would you like to pet my Penguin? The Linux Pimp [thelinuxpimp.com]
Re:Cookies (Score:2)
The neat part is that it can play sounds when it sets or rejects cookies. It has these wonderful farting sounds for rejected cookies....
Better traffic sounds than birds - VEHICLES! (Score:2)
Why not go all the way and use the sounds of vehicular traffic to represent the various kinds of net traffic? Imagine mapping these vehicles to common web traffic:
If your network is quiet, it will sound like a country road. If your network is busy, it will sound like a major highway in a major city. If you're getting a lot of script kiddies doing port scans, it will sound a bit like a Hell's Angels convention. And if you're hearing a lot of police sirens, you'd better go to the server room and get ready to hit the Big Red Switch!
--
Mirror (Score:2)
Re:About time (Score:2)
Re:About time (Score:3)
About time (Score:5)
Snoop (Score:4)
-a Listen to packets on
I've heard of someone nearly strangling their officemate though after they left it running on their system while they were out of the office all day. Talk about driving you nuts. Definitely NOT birds chirping or owls hooting.. more like screeching.
Sounds of silence. (Score:2)
Reminds me of Netscape (Score:3)
UBSB (Score:2)
"UBSB
-Traceroute (ash) LP SFR 21.-
Great collaboration between Ulf Bilting, Edwin van der Heide, Zbigniew Karkowski and Atau Tanaka. The concept : "Data harvested from the internet in early 1999, from a research center in Scandinavia. This data is rendered to analog to protect the original data from being reverse engineered or reconstructed. We created a Unix software agent that sat along a high bandwidth backbone pipe, essentially eavesdropping, gathering data, writing out a soundfile of everything it saw. Ethernet datapackets were consecutively written out to a file with no timestamp. Later the file header was hacked to open it in an audio editor." A succession of digital noises and loops manipulated to create a hypnotical and intense work. Really good in the field of digital noise. Recommended."
It's pretty good.
Re:Chernobyl found that audible alarms are bad (Score:2)
What actually happened was that the engineers were given orders to turn off all cooling on the reactor for a small period of time to check how quickly the reactor heated up. It turned out that the reactor heated up so quickly that they didn't have time to react and turn the cooling back on. For more info, see this site [chernobyl.co.uk]; Click on Causes Of The Chernobyl Accident.
Methinks you've seen Red October one too many times.
-- DigDug, who was within a 100km radius when it happened.
--
NetMeter (Score:2)
WildPackets (previously known as the AG Group) NetMeter product has been able to do this (and much much more) for years now. It is nice to see someone taking someone else's idea and getting credit for it. Not.
http://www.wildpackets.com/products/netmeter
Re:Chernobyl found that audible alarms are bad (Score:4)
The following is funny, but I am not making this up. The military had some think tanks working on the Betty system, and determined that (predominantly male) pilots react quickest to a female voice. Not a sultry female voice, just a female voice. Thus, it's not "Bitchin' Billy". It also happens that they determined that, the stronger the language, the faster the response.
They chose not to use that last bit of information in the Betty system. This was mostly because said think tankers didn't want to explain to Congress why they were spending millions of dollars of taxpayer money to have the plane shout "Pull up, you $(&*@#!"
Re:A pleasure to diagnose... (Score:2)
--------------------------------------------
Backup peep site (Score:5)
http://www.eecs.tufts.edu/peep/download.html [tufts.edu]