Slides from the M-ETH presention at LaCon'09 More information at Wintercore Labs' blog: http://blog.wintercore.com

1. M-ETH
Man in the middle - ETHernet
M-ETH
Man in the middle - ETHernet
Gabriel González
García
LaCon 2009
Gabriel González
García
LaCon 2009

2.  High-level Functionality
 Demo – Live!
 Detailed Description

3.  Ethernet – PCI Card
 Custom Development
 Transparent for the user

4.  Analyzes the whole Host’s traffic (in/out)
 All the packets go through the MCU
 Allows to analyze/modify network traffic

5.  Information forwarding
 Content Filtering
 IPS/IDS
 Information Leaking Prevention
 On-the-Fly File Modification

6. LIVE!!

7.  Components
 M-ETH Architecture
 Firmware

8.  Chip (MAC + PHY) & PCI : DP 83816EX
 (MAC + PHY) & SPI: ENC28J60
 MCU (Embedded MAC): AVR32UC3A

9. MAC
PHY

10.  Ethernet Configuration

11.  4-wire Comunication

13.  FreeRTOS
 Driver Integrated MAC
 Ethernet Driver ENC28J60
 Custom Micro TCP/IP Stack

14.  Two task running in Parallel
◦ Ingress Traffic
◦ Outgress Traffic

15. 1. Packet Read
2. Perform Action?
3. If modified, regenerate checksums
4. Send packet if not blocking

16. HOYGAN!! ¿HALGUNA PREGUNTAH?