Question

Discussion Chapter # 4 - You can use a separate post for each discussion topic.

Sniffing is all about the art of capturing packets as they pass on the wire or airwaves to review this information. To sniff you must have the NIC in the correct state, what is the medium you are connected to and what tools you are running.

• Discuss what tools are available for active and passive sniffing and what techniques are used (MAC Flooding, ARP poisoning, etc.?
• Discuss what application layer protocols are susceptible to sniffing?
• Discuss some of the techniques used to prevent or limit sniffing occurring on a network?

Answer 1

Sniffing:

Sniffing is an activity on the network of monitoring the traffic continuously through getting into the network. This is the time when the information is passed in the network is being monitored or sniffed. There are many techniques and tools for sniffing which we will discuss later on. Here we go,

Techniques of Sniffing:

In Sniffing there are mainly two techniques they are:

1. Active Sniffing
   • MAC Flooding
   • DHCP Attacking
   • ARP Poisoning
   • Spoofing Network
   • DNS Poisoning
2. Passive Sniffing

Tools for Sniffing:

The tools that are available for sniffing a network are as follows:

• Wireshark
• Dsniff
• Ettercap
• BetterCAP
• WinDump
• Dsniff
• EtherApe
• MSN Sniffer

Hence, these are some of the famous tools which can be used for offering sniffing tools.

Protocols affected by Sniffing:

The application protocols that gets affected by sniffing are as follows:

• HTTP ( Hypertext Transfer Protocol)
• FTP (File Transfer Protocol)
• IMAP (Internet Message Access Protocol)
• Telnet
• SMTP (Simple Mail Transfer Protocol)
• NNTP (Network News Transfer Protocol)
• POP (Post Office Protocol)

Hence, these are some of the protocols which are being affected by sniffing.

Mitigating Sniffing:

There are some of the basic steps which one must do to be safe from sniffers. It is explained in detail below:

1. The first and foremost thing to keep in mind is to only connect with the trusted network and avoid all the third party networks because they can be doing the same for illegal purposes such as sniffing, etc.
2. Encrypting all of the traffic which is leaving the system and also coming back to the system must be done so that it ensures that the traffic is not being sniffed due to which the sniffer may not make sense of it. But, still, crypto attacks can be launched on the network.
3. The network scanning and monitoring must be done in order to manage the attempt towards the intrusion or any rogue devices that are capturing the traffic.

Hence, these are some of the ways in which we can keep the system from getting sniffed.