Sniffer

Packet Sniffers
Prepared By: B.Veera narasimha Supervised By: Prof.K.Kailasarao NYIT New York Institute of Technology
Index
Definition Types of sniffers What is sniffers used for?? How does packet sniffers works What are the componets of packetsniffers How can I configure our local network to make sniffing harder How can I detect a packet sniffer How can I sniff a switched network Sniffer example
Definition
Host A Router A Router B Host B
A packet sniffer is a software application that uses a network adapter card in promiscuous mode to capture all network packets. The following are the packet sniffer features: Packet sniffers exploit information passed in clear text. Protocols that pass information in the clear include the following: Telnet FTP SNMP POP Packet sniffers must be on the same collision domain.
Types of sniffers
The first is a stand-alone product incorporated into a portable computer that consultants can carry to customer sites and plug into the network to gather diagnostic data. The second is part of a larger package of network-monitoring hardware and software for helping organizations keep tabs on their LANs, WANs and Web services.
What is sniffers used for??
Detection of clear-text passwords and usernames from the network Conversation of data into human redable fromat so that people can understand the traffic Performance analysis to discover network bottlenecks Network intrusion to detect in order to discover hackers
How does packet sniffers works

Ethernet h/w is built with a filter that ignores all traffic that doesnt belong to it.It does this by ignoring all frames whose mac address doesnt match its own MAC. A sniffing programs turns off this filter,putting the ethernet h/w into promiscuous mode
What are the componets of packetsniffers Hardware:Standard network adapters Capture Filter:It is used to captur the network from the wires,filters it for the particular network u want,then stores the data into the buffer Buffers:used to store the frames captured by the capture filter
Real-time analyzer:A module in the sniffer program used for the network analysis and to sift to the network intrusion detection Decoder:protocol analysis Packet editing/transmission:some products Contain features that allow you to edit our own network packets and transmit them to network
How can I configure our local network to make sniffing harder

Replacing the hub with a switch will provoide a simple,yet effective againest causal sniffing.
How can we detect a packet sniffer
Packet sniffing program can be detected by using foolowing methods Ping method ARP method DNS method Host method
How can I sniff a switched network
Switch Jamming ARP redirect ICMP redirect
Sniffer example
Available for a UNIX,WINDOWS Filter packets on many criteria Search for a packet using filters Colorize packet display based on filters
Specific Attack Types

All of the following can be used to compromise your system:
Packet sniffers IP weaknesses Password attacks DoS or DDoS Man-in-the-middle attacks Application layer attacks Trust exploitation Port redirection Virus Trojan horse Operator error Worms
Trends that Affect Security

Increase of network attacks Increased sophistication of attacks Increased dependence on the network Lack of trained personnel Lack of awareness Lack of security policies Wireless access Legislation Litigation
Network Threats Attack
Examples
There are four general categories of security threats to the network:

Unstructured threats Structured threats External threats Internal threats
Internet Dial-in exploitation Internal exploitation
Compromised host
Reconnaissance Attack Example

Sample IP address query
Sample domain name query
11. Protection against packet sniffers
SSL( "Secure Sockets Layer) VPNs (Virtual Private Networks) Replacing hub with a switch Using Adapters that do not support sniffing One-time password technology
Conclusion
Sniffers capture packet traffic across a network, usually an Ethernet Thus Sniffers capture packet traffic across a network, usually an Ethernet. These can be placed surreptitiously on your drives. A sniffer can catch all packet traffic on a particular network block (or segment). Prevention of compromise is a twofold process: encryption and compartmentalization

Sniffer

Uploaded by

Copyright:

Available Formats

Sniffer

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sniffer

Uploaded by

Copyright:

Available Formats

Packet Sniffers

What is sniffers used for??

How does packet sniffers works

How can I configure our local network to make sniffing harder

How can we detect a packet sniffer

How can I sniff a switched network

Switch Jamming ARP redirect ICMP redirect

Specific Attack Types

Trends that Affect Security

Network Threats Attack

There are four general categories of security threats to the network:

Reconnaissance Attack Example

Sample domain name query

11. Protection against packet sniffers

You might also like