Chapter 10. Serial Traffic Monitoring

Table of Contents

Cable Construction
Monitoring Session - Using Basic Linux Utility Programs
Monitoring Session - Using NST Utility Program: "monitor_serial"

The Network Security Toolkit can be used to monitor a physical serial connection attached to a NST Probe by use of a customized Serial Tap Cable diagrammed in Figure:1. Standard Linux utility programs are used to display the serial traffic being tapped. A NST utility script: "monitor_serial" is also described to automate the process of serial traffic monitoring.

The other day I was trying out various commands to control my Magellan Color GPS Receiver via the serial interface. I was using the terminal emulation utility program: "Minicom" and was not very successful. I believed I had setup Minicom (4800 baud, no parity, 8 data bits, and 1 stop bit - 4800N81) correctly but I could not get a response from the GPS when I issued a command to it. I needed a way to see what was occurring over the serial connection. After doing a Google Internet search, I then realized in the Open Source World that there are very few serial monitoring utility programs that can tap into a serial connection. The ones that I found typically required kernel modifications. Although these may be fine solutions for serial traffic monitoring, NST is built around a standard RedHat implementation and any Kernel modifications solutions are typically not used with NST.

Cable Construction

Based on my limited search results, I decided to take a hardware approach for my desired solution. I created a Serial Tap Cable which is shown in Figure:1. This is a rather simple design. Even though I am violating the RS-232 specifications by driving more than one RS-232 receiver (DTE or DCE plus a corresponding Tap) the short cable length of 8 inches should work in most instances. I am simply presenting the DTE's or DCE's transmit date line on a corresponding tap connection which can then be plugged into another serial port for monitoring. If your NST Probe only has one serial port, one can use a serial over USB device.

Figure 10.1. Serial tap monitor cable

Serial tap monitor cable