Printable View
Quick question:
is packet sniffing from a single node on a network possible? By single node, I mean, NOT a server? The reason I ask is becuase, if it's NOT possible, then the reason why packet sniffing would be a big deal is if a person gets access to a server? Right? then if thats the case, sniffing must not occur often?
Gotta get back to class
-Smartin
Packet sniffing can occur anywhere on your broadcast domain.
(I think thats the correct term. correct me if I'm wrong.)
If you are attached to a switch, you can only sniff traffic going to and from your single host.
If you are attached to hubs, you can sniff any traffic that passes by.
If you want to sniff traffic while using a switch... look into ettercap.
The reason for this is:
Hubs will pass any traffic going by. They have no idea where the destination host is... so it'll just send it everywhere.
Switches will only pass traffic destined to a certain MAC on the switch port. They are smarter than hubs.
To clarify a little better, switches (aka smart hubs) are a variation on routers. Hence they do not pass broadcast packets while hubs do. That means if you are sniffing on a switch, you will only pick up information meant for your machine. However, a tool like Ettercap changes things as it creates a "man-in-the-middle" concept and picks up packets meant for the switch by all hosts.
Check out the AO Newsletter #6. I did a small tut on Ettercap and give some of the details as to what it does. ;)
umm... MissMittens, I switch does infact pass broadcast packets. A broadcast packet will reach the entire subnet, regardless of what device is attached. Unless that device filters out such traffic.
Lan games usually perform a broadcast sweep of the lan to determin if there are any servers available. I actually have a udp broadcast forwarder that i use on my switched network all the time. This allows me to forward broadcasts from my desktop to my gateway where they are tunneled to a friend's house 20 miles away then to his network. This allows us to play lan games while only having the tunneled tcp ptp tunnel between us.
To clarify, A switch learns (very quickly) what ip's are associated to what MAC addresses on what ports of the hub, then as packets come in it analyses their destination and forwards them onto the correct ports.
A HUB is "dumb" it does no learning and just forwards every packet it receives to every port on the hub.
A broadcast packet is a packet that is specified to go to every ip in the subnet, a hub as it usually does will pass this to every port, a switch will pass a broadcast packet to every port on the switch with an ip that is within the subnet.
This is of course a very simplified explanation
Fabs: I thought switches operated at layer 2... thats MAC only. Correct me if I'm wrong.Quote:
To clarify, A switch learns (very quickly) what ip's are associated to what MAC addresses on what ports of the hub,
sorry, you're right, take out the learns ip part, they only learn MAC addresses. (unless it's a "smart" switch)
/me slaps forehead
Great article! I noticed in the article you said that you teach a class, Is this a graduate level class? What other classes do you teach?Quote:
Originally posted here by MsMittens
To clarify a little better, switches (aka smart hubs) are a variation on routers. Hence they do not pass broadcast packets while hubs do. That means if you are sniffing on a switch, you will only pick up information meant for your machine. However, a tool like Ettercap changes things as it creates a "man-in-the-middle" concept and picks up packets meant for the switch by all hosts.
Check out the AO Newsletter #6. I did a small tut on Ettercap and give some of the details as to what it does. ;)
I'm almost done with my B.S. in Information Systems and becuase I have no INFOSEC experience, I'm thinking 'bout getting a masters in INFOSEC. What are your thoughts? Maybe better just for the certs?
msmittens >> ettercap ownz :P
just in case http://ettercap.sourceforge.net
Let's see.. since there seems to be confusion....
3 types of Devices..
Repeaters, Bridges, and Routers
Repeaters operate at layer 1 of the OSI Model and do just what they're called they repeat the signal (Hubs are multi-port repeaters)
Bridges operate at layer 2 of the OSI model and make forwarding decisions based on MAC (Physical) Addresses.... and prevent switching loops using the Spanning Tree Protocol. (Switches are multi-port bridges)
Routers operate at layer 3 of the OSI model and make forwarding decisions based on IP (Logical) Addresses....
Repeaters can be used to extend a network using what is called a 5-4-3 rule.. You can have 5 segments, connected with 4 repeaters and 3 of the segments can be populated. The reason for this is because Ethernet waits a certain period of time to listen before trasmitting and that is as far as the signal could travel in the length of time it waits. If you go longer you get Collisions... This is where Bridges come in. They create collision domains.. so you can have the 5-4-3 rule in effect then a bridge and then another 5-4-3 rule. Routers create broadcast domains. This means that broadcasts dont' go beyond the router.
So
Repeaters - are just amplifiers
Bridges - Create Collision Domains
Routers - Create Broadcast Domains
Depends on the type of switch. I should have remembered to clarify this. Switches we see today are at layer 2 and layer 3. I've spent far too much time at the layer 3 and have doubts as to how many layer 2 switches truly exist. I think most manufacturers have gone to layer 3 with only the real cheapo switches being staying at layer 2.
My apologies for not clarifying this earlier.
<offtopic>
Smartin77 asked:I teach courses that are Introductary into security and advanced level courses. Certs can help (Security+ might be a good starting gate cert) but nothing beats experience. I can tell you right now, even if you get your masters you'll still need experience (although the Masters might appeal to some).Quote:
Is this a graduate level class? What other classes do you teach?
I'm almost done with my B.S. in Information Systems and becuase I have no INFOSEC experience, I'm thinking 'bout getting a masters in INFOSEC. What are your thoughts? Maybe better just for the certs?
I tend to say that security admins are like doctors. When doctors go to medical school they get their degree in medicine but then spend 10 years doing residence. It's the same concept with security admin. You get your degree in Comp Sec (or, hopefully by next year we'll be starting a bac in computer and network security) and then spend 10 years honing your skills. You have to do the grunt work first before you can be the star.
<ontopic>
Guys,
that's quite an interresting discussion overhere, let me just clarifying some ethernet basics from what I know.
(for information I am a System Engineer and my work is to design networking products including multilayer switch)
1)
I wrote a tut in AO few month ago ( http://www.antionline.com/showthread...hreadid=237836 ), to resume there is some techniques to overflow switch buffer in order to force them to behave like a hub.Quote:
phishphreek80 wrote:
If you are attached to a switch, you can only sniff traffic going to and from your single host.
For the history, there is 2 types of Layer 2 switch: 802.1d & 802.1q. All ethernet recent & decent switches implement both standard. The switch will create several virtual brigde group that restrict the broadcast domain to a sub-set of ports.
- CAM overfow attacks results in the ability to sniff the bridge group you belong to.
- VLAN hopping attacks results in a blind attack to send packet to a bridge group you don't belong to.
....
2)
I am surry to say that is not true. IEEE standard does not specify such capability as Layer 3 switching! But some chipset implement IP address into their CAM entries. I mean that a router will learn dynamicaly the layer 3 routes and may program the switch CAM table to shortcut the routing process. That's what is called L3P switching.Quote:
Fabs wrote:
To clarify, A switch learns (very quickly) what ip's are associated to what MAC addresses on what ports of the hub, then as packets come in it analyses their destination and forwards them onto the correct ports.
New chipset generation such as PRESTERA from MARVEL-GALLILEO allows to do either L3P and L4P switching or enhance QoS finctions and so on, but still the intelligence that takes decisions to route, classify,.. is not within the switch, it just provide registry entries to be progammed by external processes.
For instance CISCO Catalyst implement in a single box such functions.
3)
Repeaters are part from the past I do not think you will find widely use products doing only the repeater function any more.Quote:
HTRegz wrote:
3 types of Devices..
Repeaters, Bridges, and Routers
For me there is 3 type of devices for layer 2 switching:
Hubs: simple bus
802.1d switches: 1 broadcast domain with self MAC learning mechanisms
802.1q switches: n broadcast domains that can be porpagated to external switches to compose a VLAN (virtual LAN)
1 type of layer 3 processing : routers.
Layer 7 processing: aplicative proxies ...
4)
I think you didn't spend enough time to figure it out, madam the teacher! just for example Newbridge, Xylan, 3COM, Alcatel ...Quote:
MsMittens wrote:
I've spent far too much time at the layer 3 and have doubts as to how many layer 2 switches truly exist. I think most manufacturers have gone to layer 3 with only the real cheapo switches being staying at layer 2.
A multilayer switch is harder to administrate that a standard switch. In many case a corporation will use simply hub or standard switch to connect users and will use enhanced multilayer switch for centralized bridge. Multilayer switches aims to spare router CPU, when you locally flows data, routed data may not be huge enough to justify complex switches!
Thanks to the guy that read this from the beginning.