Re: [inbox] Re: Counter detect Network Sniffer

From: Thomas Ptacek (tqbf_at_arbor.net)
Date: 03/01/04

  • Next message: Mike Frantzen: "Re: Counter detect Network Sniffer" 
    Date: Mon, 1 Mar 2004 17:25:41 -0500
To: "Rob Shein" <shoten@starpower.net>

    On Mar 1, 2004, at 2:19 PM, Rob Shein wrote:
    > to communicate with the sniffing system. Ultimately, if the person
    > sniffing
    > is somewhat clever (and/or paranoid), it'll be trivial for them to
    > evade

    So, a few years ago I got mixed up in an Epic Usenet Struggle over the
    feasibility of sniffer detection:

    http://groups.google.com/groups?
    threadm=slrn64ocuf.pj1.tqbf%40joshua.enteract.com

    It was a pretty good threat, with posts from Wietse Venema, Mark
    Hittinger,
    Tim Newsham, and Aleph One.

    As the flag-carrier for the "you can remotely detect sniffers" faction,
    I got
    hammered on over the fact that it is possible to obscure sniffers, no
    matter
    what you do to detect them. I agree with this assertion, but I don't
    think it
    has much practical meaning: the sniffers you should be worried about
    are the
    ones remote attackers install on general-purpose machines that are
    already
    on the network. It is not difficult to devise a sniffer detection
    mechanism for
    these that is very hard to defeat.

    Obviously, when you get to talking about attackers installing new
    physical
    devices, or disabling existing machines completely and dedicating them
    to
    sniffing, your job is much harder. I would just argue that when you're
    dealing
    with attackers that are this well-armed, "detecting the sniffer" is not
    really
    your big problem anymore. 

    ---
Thomas H. Ptacek // Product Manager, Arbor Networks
(734) 327-0000
---------------------------------------------------------------------------
Free 30-day trial: firewall with virus/spam protection, URL filtering, VPN,
wireless security
Protect your network against hackers, viruses, spam and other risks with Astaro
Security Linux, the comprehensive security solution that combines six
applications in one software solution for ease of use and lower total cost of
ownership.
Download your free trial at 
http://www.securityfocus.com/sponsor/Astaro_focus-ids_040301
---------------------------------------------------------------------------
  • Next message: Mike Frantzen: "Re: Counter detect Network Sniffer"

    Relevant Pages

    • Re: packet sniffing help needed.
      ... In order to sniff traffic between the two victims, ... the sniffer on the same physical network. ... can take between the two to reliably try sniffing. ...
      (Security-Basics)
    • RE: Detecting Network Sniffers ???
      ... I am a network security person but not yet an expert in this field so ... Can somebody guide me on detecting a sniffer on my network. ... to facilitate one-on-one interaction with one of our expert instructors. ...
      (Security-Basics)
    • Re: A Solution for sniffing
      ... I've only heard/read of ways to protect against attacks on switches ... If you're a sniffer, your machine should be as discreet as you want it to be ... >Subject: Re: A Solution for sniffing ... >causing more problems associated with flooding a network. ...
      (Security-Basics)
    • AW: How to stop Admins from sniffing ?
      ... I agree to and understand the arguments about security issues, ... Betreff: RE: How to stop Admins from sniffing? ... This would prevent network sniffing of web traffic only. ...
      (Security-Basics)
    • Re: A Solution for sniffing
      ... Not only DNS, but IMO a lot things should not be run on the sniffer machine ... Subject: A Solution for sniffing ... Don't know about your network, but I know I would not want to add the extra ...
      (Security-Basics)