How to stop sniffers ??

jad · 08-13-2002, 12:24 PM

my lan is full of people runin sniffers watching each other..
just wanted to ask how to stop them or just know who is running them..
:S
hope some one could give me a solution..
NOTE:most of the sniffin is sniffin on irc connections..

A-dummy · 08-13-2002, 01:00 PM

I am not sure about this(read sometime back) but if you
send a fake echo message to broadcast with a non-existing
MAC address then only those ip's will response to it which are
in promiscous mode.....how to do it is beyond me

....

unSpawn · 08-13-2002, 01:12 PM

using hunt or rain or nmap? btw, there's also neped.

jad · 08-13-2002, 02:58 PM

"While Neped cannot guarantee to discover the sniffer (a sniffer can be a non-Linux machine, a Linux running patched kernel that does not have this flaw or a Linux machine that has ARP disabled), it is useful addition to any security toolbox.??"
any way..
can u give me links ....

tyler_durden · 08-13-2002, 06:23 PM

there are a couple of ways to try to detect a sniffer. the couple i know of are:
1- send a ping with an non existant MAC but the ip of a host that you think is sniffing (or all the hosts). the sniffer host should reply
2 - (as mentioned) send a non existant MAC on a broadcast ip

there are a few more test, but i can remember.

unfortunaly, there is not guarentee that you can detect it. You can turn off icmp, which would prevent those. Or, you can have a cable that doesn't have the transmit cable hooked up.

the best solution (if you own the network) is to run a switched network. this is a lot safer then you can run something like arpwatch to detect arp spoofing and log bad MAC addresses to detect an mac table flood.

tied2 · 08-13-2002, 08:24 PM

I think the only way to stop sniffing is using a ssh connection or pgp or some encryption program. For e-mail I know yahoo supports this and I think hotmail does also. I think the next version of gaim is supposed to support encryption also. but the person you im must have the key.
Other than that don't do any thing you don't want sniffed. Or theres always dialup, they would have a hard time finding you.

___________________________________
Don't make me go back, I'd rather marry my ex-wife

jad · 08-14-2002, 06:16 AM

Switched lans can be sniffed using ettercap

unSpawn · 08-14-2002, 08:01 AM

Switched lans can be sniffed using ettercap

... THC also made a switched LAN sniffer (ages ago).

tyler_durden · 08-14-2002, 09:08 AM

Quote:

Switched lans can be sniffed using ettercap

the two ways to switch a switch are:
1- arp spoof as the gateway, then see all the traffic to the gateway
2- flood the MAC table in the switch which causes it to fail into open mode (like a hub)

the tools you mention use one of these two methods. these can be detected by looking for arp spoofing (arp watch) and looking for bad MACs on the network (ie your sniffer).

And as always, clear text protocols are BAD. But if you have to use irc, there isn't much else you can do.