EC EHE - Sniffing Me?

 

      • Ping Method

To detect a sniffer on a network, identify the system on the network running in promiscuous mode. The ping method is useful in detecting a system that runs in promiscuous mode, which in turn helps to detect sniffers installed on the network.

Just send a ping request to the suspected machine with its IP address and incorrect MAC address. The Ethernet adapter will reject it because the MAC address does not match, whereas the suspect machine running the sniffer responds to it, as it does not reject packets with a different MAC address. Thus, this response will identify the sniffer in the network.

Figure 6.19: Promiscuous mode

Figure 6.20: Non-promiscuous mode

      • DNS Method

The reverse DNS lookup is the opposite of the DNS lookup method. Sniffers using reverse DNS lookup increase network traffic. This increase in network traffic can be an indication of the presence of a sniffer on the network. The computers on this network are in promiscuous mode.

Users can perform a reverse DNS lookup remotely or locally. Monitor the organization’s DNS server to identify incoming reverse DNS lookups. The method of sending ICMP requests to a non-existing IP address can also monitor reverse DNS lookups. The computer performing the reverse DNS lookup would respond to the ping, thus identifying it as hosting a sniffer.

For local reverse DNS lookups, configure the detector in promiscuous mode. Send an ICMP request to a non-existing IP address and view the response. If the system receives a response, the user can identify the responding machine as performing reverse DNS lookups on the local machine. A machine generating reverse DNS lookup traffic will most likely be running a sniffer.

Figure 6.21: Sniffing detection using the DNS method

      • ARP Method

This technique sends a non-broadcast ARP to all the nodes in the network. The node that runs in promiscuous mode on the network will cache the local ARP address. Then, it will broadcast a ping message on the network with the local IP address but a different MAC address. In this case, only the node that has the MAC address (cached earlier) will be able to respond to your broadcast ping request. A machine in promiscuous mode replies to the ping message, as it has the correct information about the host that is sending ping requests in its cache; the remaining machines will send an ARP probe to identify the source of the ping request. This will detect the node on which the sniffer is running.

Figure 6.22: Detecting sniffing via the ARP method

Comments

Post a Comment

Popular posts from this blog

Why Certifications Methods?

Hey there, Let’s take a step back and change our perspective: Approach certifications as a means to enrich your knowledge and skills, rather than merely a stepping stone to monetary gain or career advancement. Certifications should be about self-improvement and mastery , not just a checkbox on a resume. Embrace the journey of learning for its own sake, and watch how it transforms your personal and professional life in ways you never imagined. The Real Reason Behind Certifications The commercial marketing driving force of certifications is often centered around securing a new or better job. But I urge you to reconsider if this is your primary motivation . Take a moment to reflect on your personal development and your deepest interests within the realm of technology.  Is your passion in: Programming Crafting elegant code and solving complex problems? System Administration, Ensuring seamless operations and managing vast networks? Data Analytics Unraveling the stories hidden within data?
Read blog »

LPI E - ALL K.D.

Image
LPI Linux Essentials Outline All Knowledge Domains and Links to LPI One last check before test! Introduction to Linux >> 1.1 Linux Evolution and Popular Operating Systems >> 1.2 Major Open Source Applications >> 1.3 Open Source Software and Licensing >> 1.4 ICT Skills and Working in Linux Linux Evolution and Popular Operating Systems: This domain covers the history of Linux and its evolution, as well as an overview of popular Linux distributions. Major Open Source Applications: It focuses on introducing commonly used open source applications in the Linux ecosystem, such as LibreOffice, Firefox, and GIMP. Open Source Software and Licensing: This domain covers the concepts of open source software, different types of licenses, and their implications. ICT Skills and Working in Linux: It provides an overview of the basic information and communication technology (ICT) skills needed to work with Linux and explains the benefits of using Linux in variou
Read blog »

CCNP 03 - WANS

Image
WAN Problem Areas Certification Objectives Point-to-Point Protocols Switched Protocols      In this chapter, we will discuss troubleshooting point-to-point and switched protocols. It’s very important to understand the concepts and functionality of each protocol. We will discuss the HDLC and SDLC encapsulation methods, as well as both CHAP and PAP authentications via PPP. We will identify ISDN, Frame Relay, X.25, SMDS, and ATM transmissions and common problems associated with each of them. Point-to-Point Protocol      In the 1980s, the Internet really started to come to life due to its usage by the U.S. government, universities, and large corporations. These hosts were being supported by the Internet Protocol (IP) and connected via a series of LANs. The most common of these LANs was the Ethernet. Other hosts were connected through WANs, using technologies such as X.25. This eventually evolved into the need to transmit data via the original method used before networking was ever establis
Read blog »