Agreed, sniffer is totally passive ! On analyzing various
internet links and also discussions, i understand that
that unless the sniffer does not take care of things like
hiding IP address / there is a flaw in the operating system
similar to that of TCP/IP in pre-2.2.10 linux kernel, it is not
possible to determine the presence of sniffers performing
passive sniffing in the network.
That doesn't really make sense. For sniffing, there is no need for
the sniffer to obtain or fake an IP address. Sniffing is usually done
at Layer 2 or the MAC address layer (although I've sniffed at the
physical layer with an oscilloscope looking for waveform corruption).
Since the passive sniffer is not interested in collecting its own
traffic, there's no need to assign it an IP address. One can
literally cut the transmit ethernet pair on the transceiver and still
sniff. Assorted products (and methods):
<
http://www.netoptics.com>
This works:
<
http://www.ethereal.com/lists/ethereal-dev/200012/msg00037.html>
Just to make sure you understand, just creating an ethernet tap and
sniffing with Ethereal or Wireshark is not going to give you access to
all the network traffic. You're most likely going to have an ethernet
switch between the internet or a server and your sniff point. You'll
only see the traffic that either has YOUR destination MAC address, or
is a broadcast. Traffic to and from some other workstation is going
to be invisible.
That's not quite true with wireless networks, where you can
theoretically hear everyone. However, that's a bad assumption. If
you want to sniff both sides of wireless traffic, you have to locate
your wireless sniffer in a place where you can hear both radios at the
end points of a link. For point to point links, that's not so easy as
you would need to be along the line of sight. It will work for a hot
spot, where all the radios involved are in an enclosed area, and your
sniffer can hear all of them.
The option of using
IPSec for all intranet traffic appears to be the main solution
against passive sniffing.
Nope. There's also SSL, dedicated encryption devices, and MAC layer
encryption as found on some ethernet cards (i.e. 3COM 3CR990b).
<
http://www.3com.com/products/en_US/detail.jsp?pathtype=purchase&tab=features&sku=3CR990-TX-97>
You can also do application layer encryption. If you really want to
drive a sniffer nuts, try transport layer obfuscation, where the
transceiver injects extra bits of garbage, and the receiving end
removes the extra bits, using some kind of synchronized algorithm such
as GPS clock sync, or a common lookup table. There are plenty of ways
to turn data into garbage, but only a few that will turn garbage back
into data.
Though some OS can restrict that only admins can install
certain type of sniffers, i think that is not enough as
sometimes it can be via admin too.
In a locked down IT department monitored environment, that might make
some sense. Anywhere else, most users are able to run as root or
administrator with a minimum of effort.
I wonder, why don't the various OS support the detection
of Sniffers so that if a user is running it in the network, the
OS might intimate it to the admins ?
Because approximately 0.00000001% of the computers on the planet need
a sniffing function and NBC (NoBody Cares). A better question would
be why Microsloth intentionally disabled access to the promiscuous and
monitor modes in NDIS 5, while Linux allows it in every network
driver. Hint: Think of a good conspiracy theory.
Just eager to know ,
is it not possible for the OS to detect a sniffer running on it
and intimate it ?
The OS can easily detect if it the ethernet card on the same machine
is running in promiscuous mode. That's easy because the OS had direct
access to the NIC registers and driver settings. That's not so easy
from outside the computah, where such testing would be considered a
hostile probe attempt.
I think, the various OS(TCP/IP) in network should be
configurable such that if there is a sniffer running on it, it
would be able to intimate to a set of users(admin) in the
network.
Sorry, I don't understand that statement. TCP/IP is not an operating
system. An application cannot imitate itself. I have no idea what
you mean by "set of users(admin)". There is no root/admin access
security on the network. Try again.
The OS here can be either Linux / Windows.
Are there any such tools already available ?
Make my life easy. What are you trying to accomplish? There are
plenty of tools, but you have not described what you are doing, and
therefore recommending specific applications will probably not fit
your unspecified goal.
