Lecture 7. Sniffers


What is a sniffer?

A sniffer is any device, whether software or hardware, that grabs information traveling along a network. That network could be running any protocol: Ethernet, TCP/IP, IPX, or others (or any combination of these). The purpose of the sniffer is to place the Ethernet adapter into promiscuous mode and by doing so, to capture all network traffic.
NOTE: Promiscuous mode refers to that mode where workstations on a network listen to all traffic, not simply their own. In other words, Non-promiscuous mode is where a workstation only listens to traffic routed to its own address. In promiscuous mode, the workstation listens to all traffic, no matter what address this traffic was intended for. 
A sniffer can be a combination of both hardware and software. The software might be a general network analyzer enabled with heavy debugging options, or it might be a real sniffer.
A sniffer must be located within the same network block (or net of trust) as the network it is intended to sniff. With relatively few exceptions, that sniffer could be placed anywhere within that block.
 

Sniffers are a significant threat

However, sniffers can catch more than simply user IDs and passwords; they can capture sensitive financial data (credit-card numbers), confidential information (e-mail), and proprietary information. Depending on the resources available to the cracker, a sniffer is capable of capturing nearly all traffic on a network.
 

Where Do Sniffers Come From and Why Do They Exist?

Sniffers are designed as devices that can diagnose network problems and monitor network activities. Sniffers were designed by those aiding network engineers (and not for the purpose of compromising networks).


Sniffers

  1. Gobbler (Tirza van Rijn) for MS-DOS and Win 95

  2. snoop from Sun

  3. sniffit for UNIX

 

How Do I Detect a Sniffer on My Network?

To detect a sniffing device that only collects data and does not respond to any of the information, requires physically checking all your ethernet connections by walking around and checking the ethernet connections individually.

It is also impossible to remotely check by sending a packet or ping if a machine is sniffing.

Sniffers are largely passive applications and generate nothing. In other words, they leave no trace on the system.

One way to detect a sniffer is to search all current processes being run. This isn't entirely reliable, of course, but you can at least determine whether a process is being run from your machine.

Some utilities can identify whether your system has been thrown into promiscuous mode. These can at least detect whether a running sniffer would even work under your current configuration. Nitwit.c is one such utility.
For SunOs, NetBSD, and other possible BSD derived Unix systems, there is a command

     "ifconfig -a"
that will tell you information about all the interfaces and if they are in promiscuous mode.
 

What Can I Do to Foil a Sniffer?

  1. Encryption

    There are several packages out there that allow encryption between connections therefore an intruder could capture the data, but could not decypher it to make any use of it.

    A product called Secure Shell, or SSH is one of them. SSH is a protocol that provides secure communications in an application environment such as Telnet.

    One-time password such as S/Key might be used to protect passwords.

  2. Active hubs (or called switching hubs)

    Active hubs send to each system only packets intended for it rendering promiscuous sniffing useless. This is only effective for 10-Base T.

  3. Compartmentalization

    The generally accepted way to defeat sniffer attacks is to employ safe topology. Here are the rules: