Contents

• Introduction
• How do they ‘sniff’?
• A LAN sniff
• A Protocol sniff
• An ARP sniff
• TCP session stealing
• Application level sniffing
• Web password sniffing
• Detecting sniffers
• Protection from sniffers
• Protecting FOSS systems

Description

This is a wide hacking approach called network sniffing, which is very commonly used by prying hackers.We will look at a few tools typically used as sniffers and also figure out how to protect IT infrastructure from such attacks.
Sniffing involves capturing, decoding, inspecting and interpreting the information inside a network packet on a TCP/IP network.The purpose is to steal information, usually user IDs, passwords, network details, credit card numbers, etc.Sniffing is generally referred to as a ‘passive’ type of attack, wherein the attackers can be silent/invisible on the network.This makes it difficult to detect, and hence it is a dangerous type of attack.
The TCP/IP packet contains vital information required for two network interfaces to communicate with each other.It contains fields such as source and destination IP addresses, ports, sequence numbers and the protocol type.Each of these fields is crucial for various network layers to function, and especially for the layer 7 application that makes use of the received data.By its very nature , the TCP/IP protocol is only meant for ensuring that a packet is constructed, mounted on an Ethernet packet frame, and reliably delivered from the sender to the receiver across networks.However, it does not by default have mechanisms to ensure data security.Thus, it becomes the responsibility of the upper network layers to ensure that information in the packet is not tampered with.
To understand why hackers sniff, we need to know what they get from the network.Figure 1 shows the OSI layers and the information a hacker can steal at each layer by successfully sniffing a network.
The sniffing process is used by hackers either to get information directly or to map the technical details of the network in order to create a further attack.Hackers are always in favour of sniffing, because it can be done for a longer time without getting caught.