Sniffer detector

naaman · 05-31-2009, 10:44 AM

Hello,

I'm looking for a nice tool to detect sniffers and it's very tough !
I've found several tools but many of theses projects seem to be down :
- sentinel (offical website seem to be down, no place to download the software)
- netped (not powerful enough),
- sniffdet (the project seem to be down),
- antisniff (works only for detecting windows sniffers ...),
Wherever I look for I get dead links and outdated softwares ....
Do you know a serious tool I could use to dectect sniffers ?

Thanks,

syg00 · 06-01-2009, 05:07 AM

This is (another) query that arises regularly.
Try the search button - but prepare to be disappointed.

naaman · 06-01-2009, 06:07 AM

Yes I tried that too and no success ...
I'm currently trying to make sniffdet compile, but it seems so outdated that I've got to fill my /usr/local with weird old stuff ...
If I arrive to make it works I say you how I did

syg00 · 06-01-2009, 06:10 AM

Good luck

JulianTosh · 06-01-2009, 06:28 AM

Sorry, no help for you in compiling source from me, but I'll tell you: you wont catch a sniffer who doesn't want to be caught. Choke cables disable the write pins so there's no evidence that the line is being sniffed.

naaman · 06-01-2009, 06:40 AM

Do not try to compile sniffdet from the sniffdet-0.9 tarball, because the code is buggy (gcc doesn't tolerate some part of the code source, or just the gcc version I've got : 4.3.2).
Use the SVN version, code is much cleaner :

Code:

svn co http://svn.ademar.org/sniffdet/trunk/

You have to install autotools and libtool if you do not have them yet.
You also have to install libnet-1.0.X, not the 1.2.X versions, it's hard to find the tarball then try to get it from gentoo mirros, for instance :

Code:

wget http://ftp.free.fr/mirrors/ftp.gentoo.org/distfiles/libnet-1.0.2a.tar.gz

You've got to run :

Code:

autoreconf -ifs

in the trunk directory.
If it occurs strange errors like those :

Code:

./configure: line 13445: libnet-config-1.0: command not found
./configure: line 13446: libnet-config-1.0: command not found
./configure: line 13447: libnet-config-1.0: command not found

Do not run "make", you'll get strange stuff.
You've got to make a very dirty thing before ... create a link :

Code:

ln -s /usr/local/bin/libnet-config-1.0 /usr/local/bin/libnet-config

When you did it run make commands, it should works.
(actualy -lnet must appears at the end of the configure process output.)

Voilà

In fact it was easier than I thought ... no real need to explain how install it, except for the final trick