Packet Sniffers...

[albolabris]

I?m not sure if here is where I should post this question but?

I suspect I have someone running packet sniffers mainly OPENXTRA Ethereal-XTRA?How can I detect this for sure and how can I stop it?

Our network is made up mostly of 3750?s with a few Vlans?

[rajinikanth]

Hi,

I think you need a antisniff software

Check out the link for more details about antisniff soft

http://www.securiteam.com/tools/2LUQLQ0RPO.html

Download the software from below link

http://packetstorm.troop218.org/sniffers/antisniff/

Hope this helps you.

Thanks

Raj

[scottmac]

Since you are on a switched network, anyone plugging in a "sniffer," or running a "sniffer" application on their desktop will only see broadcasts, multicasts, and the traffic destined for their host.

Unless they have admin privileges to set the switch up to "span" (mirror) a port / some ports there won't be much to be seen.

This also is a good example of why physical security (putting the network infrastructure devices behind closed & locked doors) is important. If someone can only get to a host connection, there's not much chance that they can connect to a server trunk and get any important information.

I've never heard of "anti-sniff" devices or software, but it sounds interesting.

FWIW

Scott

[miheg]

What's your problem with someone sniffing? In a switched network the won't see a lot. Try for yourself with ethereal.

You may wish to see if someone uses arp poisoning. Use a program called arpwatch to detect changes in MAC addresses.

If you think sensitive information might be sniffed put the people that use it in separate vlan's

Cheers,

Michel

[drhague]

In response to sniffing switched networks:

Sniffing a segment of a network (LAN/VLAN), is easily accomplished using Ettercap. Ettercap has numerous options, some of which are man in the middle arp poisoning, and mac-address discovery of the LAN. Once the mac address of the gateway is discovered, all traffic to/from that mac address can be captured, using Ethereal, or any other sniffer of choice.

I've tried it, and it works pretty slick. Exercise caution with Ettercap's option switches, as incorrect use can crash a LAN/VLAN (which makes it a layer2 DOS attack tool).