Prev: how to inform pppd Session-Timeout value using radius
Next: Network traffic monitor - tip from expert
From: alexd on 21 Mar 2010 06:56 On 21/03/10 01:42, Karthik Balaguru wrote: > But, i wonder what is the advantage/use of running > wireshark on an interface that hasn't got any IP address. > In what kind of scnearios we might need to run wireshark > on an interface without IP address ? Any thoughts ? Let's say you're interested in traffic to/from Host A, but it has no packet capture mechanism. You have a switch that can do port mirroring [aka span port] and Host B with two network interfaces. You would mirror to the spare interface of Host B, and in that case, the spare interface you're mirroring to would not need an IP address. Actually, a less contrived scenario [because it was me doing it this past week] would be trying to work out the network address when the telco has installed and provisioned a circuit with ethernet presentation, but despite repeated requests, not given any network address or subnet mask details. I plugged my laptop into their edge router, ran 'tcpdump -n -i eth0' and within a couple of seconds I could see ARP requests for a range of IP addresses. I was thus able to guess the IP addresses in use on the circuit, and configured the customer's edge router accordingly. -- <http://ale.cx/> (AIM:troffasky) (UnSoEsNpEaTm(a)ale.cx) 10:43:20 up 45 days, 11:28, 4 users, load average: 0.03, 0.10, 0.09 It is better to have been wasted and then sober than to never have been wasted at all
From: Stephen on 21 Mar 2010 19:21 On Sat, 20 Mar 2010 18:42:18 -0700 (PDT), Karthik Balaguru <karthikbalaguru79(a)gmail.com> wrote: >On Mar 20, 3:28�pm, Stephane CHAZELAS <stephane_chaze...(a)yahoo.fr> >wrote: >> 2010-03-20, 01:59(-07), Karthik Balaguru: >> [...] >> >> > 1. Sentinel >> > Supports 3 methods of remote promiscuous >> > detection: The DNS test,Etherping test,ARP test. >> > -a arp test, -d dns test,-e icmp etherping test. >> > Need to check it out. Has anyone tried this >> > out ? >> >> All those methods assume the interface is configured with an IP >> address, or that the system supports IP. > >Okay . Yeah, I analyzed it and it appears just like >as you conveyed - Passive Sniffers in promiscuous >modes(Remote) can be detected only if they are on >an interface with a configured IP address ! > >> There's no need for >> implementing an IP stack to sniff ethernet packets. One can use >> wireshark on an interface that hasn't got any IP address >> configured or that has a firewall rule that prevents it from >> emmiting any packet. >> >> sudo iptables -I OUTPUT --out-interface eth0 -j DROP >> >> And that interface will not be detected. >> > >:-( >Interesting to know that wireshark or other sniffers >can be used on an interface that hasn't got any IP >address configured. > >But, i wonder what is the advantage/use of running >wireshark on an interface that hasn't got any IP address. >In what kind of scnearios we might need to run wireshark >on an interface without IP address ? Any thoughts ? at least 4. 1 - you do not pollute a general capture file with crud from the capture PC (this is generally true - eg on a "real" Sniffer). It makes figuring out what is going on from scratch easier. 2 - if you are connecting to say a customer network then you do not get issues with the capture PC trying to join the local M$oft AD domain, or catching a local propagating net virus. 3. If you run IP on the interface some firewall configs will try to block IP of various types to "improve" the PC security....... 4. you may not use IP on this network (much more rare recently, but used to be common) > >> Probably same with >> >> sudo ip addr flush dev eth0 >> > >:-( >It appears that there is NO method to detect passive sniffing >unless the sniffer does not take care of things like hiding >IP address / using a proper flawless OS. > >> > 2. neped.c >> >http://www.artofhacking.com/tucops/hack/unix/live/aoh_neped.htm >> > Network Promiscuous Ethernet Detector w.r.t Linux- >> > Specifically designed to detect the sniffers that >> > use the flaw in Linux TCP/IP Stack !!. I think this >> > will not be useful for the kernels in which the >> > flaw has been fixed such as kernel 2.2.10 as they >> > drop the incoming packets that are not destined >> > for this ethernet address. >> >> 2.2.9 was released in May 1999. I don't expect there be a lot of >> pre-2.2.10 Linux boxes around nowadays. >> > >True that there might not be much systems that use pre-2.2.10 >unless upgraded. So, it is difficult to determine the presence >of sniffer in networks in such a case. > >So, in brief - NO METHOD to detect Passive Sniffing :-( >That is, It seems that unless there is a flaw in the operating >system similar to that of TCP/IP in pre-2.2.10 linux kernel, it >is not possible to determine the presence of sniffers performing >passive sniffing in the network. You can detect the presence of a device where there is a lower layer protocol that the device has to actively use to run. wireless LAN with a sniffer that doesnt understand passive only wireless mode for example - no idea if that still includes wireshark..... note - at this point all you can tell is there is a device present - not what it is doing. > >Karthik Balaguru -- Regards stephen_hope(a)xyzworld.com - replace xyz with ntl
From: Lew Pitcher on 21 Mar 2010 21:03 Dan C <youmustbejoking(a)lan.invalid> trolled: Warning: Lew Pitcher, who posts to this newsgroup, is a domain thief. Read the full story at http://www.lewpitcher.ca > Bullshit. ?!? > The troll known as "rm" actually posted the above, and is You, of all people, are calling somebody else a "troll?" Sorry, little Dan, but you have zero credibility. You're not even entertaining and you are in so many killfiles that we are the only one likely to read you. Is chasing "rm" around all you can do with your time? Don't you have anything else to do?
From: Rick Jones on 22 Mar 2010 17:06 In comp.os.linux.networking Karthik Balaguru <karthikbalaguru79(a)gmail.com> wrote: > Okay . Yeah, I analyzed it and it appears just like as you conveyed > - Passive Sniffers in promiscuous modes(Remote) can be detected only > if they are on an interface with a configured IP address ! Or more generally be coerced into emitting some traffic. It does not have to be IP traffic. If there were a flaw that caused the sniffing system to respond to an 802.2 XID/Test frame that would be a non-IP-configured situation. > :-( Interesting to know that wireshark or other sniffers can be used > on an interface that hasn't got any IP address configured. There is more to networking than is dreamt-of in IP's universe :) > But, i wonder what is the advantage/use of running wireshark on an > interface that hasn't got any IP address. In what kind of scnearios > we might need to run wireshark on an interface without IP address ? > Any thoughts ? From time to time, to figure-out the MAC address of some new-to-me device I have connected it to an unused port on some other system, fired-up a sniffer on that port, and the fired-up the new-to-me device. Generally I'm looking for the DHCP request so I can get the MAC to edit my own DHCP server configurations to give the new-to-me device a specific IP address. rick jones -- No need to believe in either side, or any side. There is no cause. There's only yourself. The belief is in your own precision. - Joubert these opinions are mine, all mine; HP might not want them anyway... :) feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...
From: Jeff Liebermann on 22 Mar 2010 19:34
On Sat, 20 Mar 2010 23:59:41 -0700 (PDT), Karthik Balaguru <karthikbalaguru79(a)gmail.com> wrote: >Agreed, sniffer is totally passive ! On analyzing various >internet links and also discussions, i understand that >that unless the sniffer does not take care of things like >hiding IP address / there is a flaw in the operating system >similar to that of TCP/IP in pre-2.2.10 linux kernel, it is not >possible to determine the presence of sniffers performing >passive sniffing in the network. That doesn't really make sense. For sniffing, there is no need for the sniffer to obtain or fake an IP address. Sniffing is usually done at Layer 2 or the MAC address layer (although I've sniffed at the physical layer with an oscilloscope looking for waveform corruption). Since the passive sniffer is not interested in collecting its own traffic, there's no need to assign it an IP address. One can literally cut the transmit ethernet pair on the transceiver and still sniff. Assorted products (and methods): <http://www.netoptics.com> This works: <http://www.ethereal.com/lists/ethereal-dev/200012/msg00037.html> Just to make sure you understand, just creating an ethernet tap and sniffing with Ethereal or Wireshark is not going to give you access to all the network traffic. You're most likely going to have an ethernet switch between the internet or a server and your sniff point. You'll only see the traffic that either has YOUR destination MAC address, or is a broadcast. Traffic to and from some other workstation is going to be invisible. That's not quite true with wireless networks, where you can theoretically hear everyone. However, that's a bad assumption. If you want to sniff both sides of wireless traffic, you have to locate your wireless sniffer in a place where you can hear both radios at the end points of a link. For point to point links, that's not so easy as you would need to be along the line of sight. It will work for a hot spot, where all the radios involved are in an enclosed area, and your sniffer can hear all of them. >The option of using >IPSec for all intranet traffic appears to be the main solution >against passive sniffing. Nope. There's also SSL, dedicated encryption devices, and MAC layer encryption as found on some ethernet cards (i.e. 3COM 3CR990b). <http://www.3com.com/products/en_US/detail.jsp?pathtype=purchase&tab=features&sku=3CR990-TX-97> You can also do application layer encryption. If you really want to drive a sniffer nuts, try transport layer obfuscation, where the transceiver injects extra bits of garbage, and the receiving end removes the extra bits, using some kind of synchronized algorithm such as GPS clock sync, or a common lookup table. There are plenty of ways to turn data into garbage, but only a few that will turn garbage back into data. >Though some OS can restrict that only admins can install >certain type of sniffers, i think that is not enough as >sometimes it can be via admin too. In a locked down IT department monitored environment, that might make some sense. Anywhere else, most users are able to run as root or administrator with a minimum of effort. >I wonder, why don't the various OS support the detection >of Sniffers so that if a user is running it in the network, the >OS might intimate it to the admins ? Because approximately 0.00000001% of the computers on the planet need a sniffing function and NBC (NoBody Cares). A better question would be why Microsloth intentionally disabled access to the promiscuous and monitor modes in NDIS 5, while Linux allows it in every network driver. Hint: Think of a good conspiracy theory. >Just eager to know , >is it not possible for the OS to detect a sniffer running on it >and intimate it ? The OS can easily detect if it the ethernet card on the same machine is running in promiscuous mode. That's easy because the OS had direct access to the NIC registers and driver settings. That's not so easy from outside the computah, where such testing would be considered a hostile probe attempt. >I think, the various OS(TCP/IP) in network should be >configurable such that if there is a sniffer running on it, it >would be able to intimate to a set of users(admin) in the >network. Sorry, I don't understand that statement. TCP/IP is not an operating system. An application cannot imitate itself. I have no idea what you mean by "set of users(admin)". There is no root/admin access security on the network. Try again. >The OS here can be either Linux / Windows. >Are there any such tools already available ? Make my life easy. What are you trying to accomplish? There are plenty of tools, but you have not described what you are doing, and therefore recommending specific applications will probably not fit your unspecified goal. -- # Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060 # 831-336-2558 # http://802.11junk.com jeffl(a)cruzio.com # http://www.LearnByDestroying.com AE6KS |