Just under contruction, version 0.3, last update 2003/01/30

Contents

What is Sniffing?

Sniffing is a technique that allows to collect all data (or better a copy of it) on the wire where the network interface is connected to, although the data might not be adressed to this network interface. This is done by setting the network interface into promiscous mode. This mode indicates, that the MAC-Filter on the network interface is turned off, so accepting all data on the wire. Between network segments, nomally the IP-adress is used. But within one network segment, computers find their conterparts by using MAC-adresses. Also all packets that arrive via the router of your network segment, find ther recipient by his MAC-adress (after arp-requests of the router and hopefully replies). If you set the network interface of your computer into promiscous mode, this does not mean, that your computer responds to all requests going throught the wire. He only responds to requests directed to him.

What is sniffing good for?

The technique of network sniffing can be used in several ways:

1. Network sniffing is a useful tool for network administrators helping them to debug network services etc. Wellknown programs are tcpdump and ethereal.
2. Network Intrusion Detection Systems use sniffing to collect data on the wire for further analysis of known attack signatures (snort, shadow etc.).
3. Hackers can use this technique to find out passwords and usernames for services, that transmit these information in clear text, using tools like ngrep, ethereal, tcpdump etc.

How to sniff in a switched network

It has to be mentioned, that sniffing is only possible in non-switched networks, like in old fashioned ones with bnc cabling or hubs. In modern networks, switches are used, sending packets 1 to 1, and not 1 to n. But router, switches and so on are a good place for capturing data. Good switches offer monitor ports, where you can configure to copy all data to travelling through a network. One problem with these active network components is, that they are shipped with default passwords and unsecure services enabled. Administrators tend to let these unsecure services enabled. If they change passwords for these devices, weak passwords are common.

An other possibility to sniff in swiched networks is to use a program like arpspoof (formerly known as arpredirect). This only works within the same network segment. If a computer in the network tries to get the MAC-adress of the router, you can convince this computer, if you are faster responding than the router, that you are the router he is searching for. The other computer will then use you as the router/gateway. You will then intercept all network traffik from this computer. But you also have to forward all traffic to the real router. IDSs are able to detect such techniques. But who is using IDS?

MAC flooding is an other technique. A switch stores a table with MAC adresses for every port. The storage space for every port is limited. If a switch is told more MAC adresses for a port than he can store, he will not know all matchings between MAC and IP adresses. For IP adresses, where he has no MAC adress stored, he will send out packets for this destination over all ports, until he has learned the port, the destination computer is attached to. The sniffer dnsiff has a program called macof, that is able to do MAC flooding.

You can also try to alter routing tables. This can gurantee, that all traffic is traffeling through your computer. You can try to send false routing messages via RIP, defining your computer as the standard gateway. You then have to forward traffic to the real standard gateway. So all traffic is redirected through your computer. If you are not able to manipulate the routing table of the real standard gateway too, then you will not see the traffic coming back.

Another tool is dnsspoof. It spoofes the responses from DNS servers. If a computer wants to visit a website with a FQDM (Full Qualified Domain Name), then he asks a DNS server for the IP adress of the computer with this name. dnsspoof makes use of this request and tries to send an answer back to the asking computer faster than the DNS server. Fortunatly, he responds with an IP adress under his own control. And he will receive the traffic.

How to detect someone sniffing on the wire?

There are several ways to check out whether someone has set his network interface to promiscous mode. The simpliest way is to go to the computer that is supposed to sniff and check (e.g. a simple ifconfig can do the job). There are also other techniques, that require some kind of access (blinking hub lights, SNMP and high load etc.). But here I want to present some remote techniques.

Ping method:

1. The machine suspected of running the packet filter has an IP address 10.0.0.1, and an Ethernet address of 00-40-05-A4-32.
2. You are on the same Ethernet segment as the suspect.
3. You change the MAC address slightly (such as 00-40-05-A4-79-33).
4. You transmit an ICMP echo request (ping) with the IP address and his new MAC address.
5. Remeber that nobody should see this packet, because as the frame goes down the wire, each ethernet adapter matches the MAC addres with their own MAC address. If none matches, then they ignore the frame.
6. If you see the response, then the suspect wasn't runnning this MAC address filter on the card (the card must be in promiscous mode!), and is hence sniffing on the wire.
7. Because this technique is known, hackers might work with virtual MAC addresses, which is possible under windows, where MAC filtering is implemented in the drivers.
8. Note that this technique works also in switched networks (but there sniffing does not work, except on the monitor port of the switch).

The ping method can be enhanced in a number of ways:

1. Any protocol that generates a response can be used, such as a TCP connection request or a UDP protocol such as port 7 (echo).
2. Any protocol that might generate an error on the target machine might be used. For example, bad IP header values might be used to generate an ICMP error.
3. Sometimes a broadcast (255.255.255.255 or directed like 10.1.1.255) needs to be used in order to bypass software IP address filtering. This then encounters another problem in that many machines do not respond to broadcast requests.

ARP method:

1. If you sent an ARP-request to a non broadcast adress (ARP-request are normally sent via broadcasts), a machine, that answers to an ARP of its IP address must be in promiscous mode.
2. A variation of this technique takes advantage of the fasct, that machines cache ARPs. Each ARP contains the complete information of both the sender as well as the desired target information. In other words, when I send out a single ARP to the broadcast address, I include my own IP-to-Ehternet address mapping. Everyone else on the wire remembers this information for the next few minutes. Therefore, you could do something like sending out a non-broadcast ARP (Who is?), then a broadcast ping. Anybody who responds to your ping without ARPing you could have gotten the MAC address from a sniffed ARP frame. To make shure you should use a different source MAC address in the ping.

DNS method:

1. Some sniffing programs do a dns-lookup to resolve the IP address. You have to configure the detector in promiscous mode itself, and to send out IP datagrams to bad addresses (addresses that are known not to exist) and wait for dns lookups.

Source-route method:

1. You first have to create a ping packet and put a loose-source route to force it by an other machine on the same segment. This machine should have routing disabled, so that it will not in fact forward it to the target.
2. If you get a response, then it is likely the target sniffed the packet off the wire.
3. In the response, doublecheck the TTL field to find out if it came back due to sniffing, rather than beeing routed directly.

Decoy method:

1. Just send a plain text password for a service over the wire and wait whether someone uses it.

One tool that tries to implement some of these detection techniques is sentinel.

back to top