Snnifers...Possible to read the data

Hi,

I have often heard people using sniffers to get info abt the packets travelling over the network..

I tried once with a Packet sniifer..... But when it started capturing packets.... there was not much i could make out of it....

I did get info abt packet ids and how they are generated.. But again I dont know how it can help the potential hacker.....

But does sniffers give out the information abt the data travelling ???

Does this have anything to do with Session Hacking.. Could be hack a session by knowing info abt packer travelling on the network....

Shall appreciate your comments for the same.....

Regards

kalp

The reason you couldnt make out anything from the packets is that they probably didnt contain plain text so you could have been looking at any type of data.

Sniffers can help a hacker find out usernames and passwords travelling across the network if he can recognize it in the packet. They can also help with session hijacking (wont go into that)

From what i know the only info a packet sniffer can give you about the packets it recieves deals with the packets and not the data within.

Hope this helped a bit

I'll just add a comment to Darksnake post:
Sniffer are very useful to decode protocols behaviour. Even for high layer such as FTP, HTTP, ...
I ind sniffer very useful for:
- watching an attack in real time & keep traces
- understand how a protocol works as a helper to papers such as RFC that are smtimes unreadable.

Thanx darksnake,

yeah I also noticed the same fact that you get all lot of host info abt the packets and its destination....

But I was curious to know how a potential hacker could use the packet info to launch any destructive attack using the above info......

Regards

Kalp

Hi networker..

Is it that we can know from where are the packets been generated at the time of attack,,, but the same information can also be traced by my firewall.... then why do we need to use packet sniffers....

One reason i found was during initial implementation of firewall.. where u run packet sniffer to study the traffic and determine which ports / services needs to activated and vice versa


Regards

Kalp

Quote:

---

Originally posted here by anjali

Hi networker..

Is it that we can know from where are the packets been generated at the time of attack,,, but the same information can also be traced by my firewall.... then why do we need to use packet sniffers....

---

For a very simple reason: The firewall is rule based and will log only drp traffic it has been config for!!!
But what about flows passing through the firewall...

Firewalls are not the magic box vendors want to convince us. frw does not guaranty security, it's just a tool that plays its role into security policy.

Networker in that case... where should you place ur snnifer.....

I understand that it can only monitor the segment where it is place..... Now in corporate with many VLANS... would u need to have multiple sniffers on individual LAN segment ???

Can it be a part of ur router.... where all incoming requestes are sniffed....

Does sniffer have any impact on network (eg . Nwork congestion etc.)

Many thanks networker for sharing above info.... I always wanted to know abt real use of sniffers.... This is clearing some of my doubts....

Regards

Kalp

anjali: Here's a real example of how I use a packet sniffer on an almost daliy basis. In this case I have a user running Outlook who tells me that she can't get her POP3 mail and Outlook keeps erroring out saying "cannot contact POP3 server XXX.XXX.XXX.XXX" Once the normal troubleshooting process has been gone through and the error remains I pull out the old Ethereal, (packet sniffer) and tell it to sniff packets from her machine to anywhere that are destined for port 110, (POP3) and ask her to initiate a mail send/receive.

The things i will learn from this are:-

1. Her machine is generating packets/or not
2. her packets are being routed correctly to this network
3. those packets are destined for the right server and port
4. is the server responding appropriately
(since POP3 transmissions are in plain text)
5. is her mailbox name properly spelled
6. is her password properly spelled
7. what the unseen error message is that the server sends if any, (in this case "unknown user")

Odd because the user has an account, she is spelling it correctly and the password is also correct. However, I know from experience that my mailserver does this from time to time and the account needs to be deleted and recreated. I do that having copied any outstanding amail aside and replacing it after the recreation and Bingo.... she's back in business....

Packet sniffers are great tools and if you spend the time to learn TCP/IP flows etc and baseline some of the traffic on your network so you know what a good traffic flow for a protocol is then it can really help you see what is going on if things are not right.

tiger shark....

Thanks dear indeed that was an excellent piece of info.......

I didn't knew u could use sniffers for such purpose... Agreed you need to know and understand TCP very well to make any meaningful judgement from a Sniffer....

I feel it is also essential to know Networking thoroughly...becasue the palcement of firewall is very imp. I tried one sniffer software.. it was hardly able to grab 14 packets in one hour....

Could u tell why only few packets were captured... I had installed the same on my Work PC.... which is connected to the switch....

I thought i would be able to monitor the complete vlan.. but i feel i was only able to hear few on packets generated from my pc only....

Thanx

anjali, one reason there might be that you are connected to a switch and not a hub.
I asume you weren't doing anything at the time as even for one PC 14 packets in an hour sounds a little low.

With a hub any packets that it recieves it broadcasts to all the computers connected to it. So with a sniffer you can see everything being sent to everyone on your bit of the network.

With a switch, when a packet is recieved it is only sent to host identified and not just broadcast, I think this is done by using the MAC (hardware) address of the destination network card. So if the sniffer is running on your PC and you are connected to a switch you will see only the packets desitined for your PC or those sent from your PC.

ps <quote>I had installed the same on my Work PC</quote> are you the admin as this will likely upset them.

exactly waverebel....

I did mention that I connect to a switch...

In that case how can i still sniff the packets as mentioned by tigershark in his previous post.....

Yeah I was amazed at such low packets been caught.. But i was doing lot of activities.. but lot of packets were lost.. maybe it was my first try at sniffers.. so i thought i must have missed some settings....

Regards

kalp

Tiger shark was describing sniffing a session between, your computer and a server. Since in all comunications your computer will be either the source or the destination of the packets in question they will pass through your network card and you will be able to sniff them even if you are attached to a switch.

If you were attached to hub you would be able to sniff everyone elses packets as well as your own (although this may need some extra configuraiton?). Doing this would likely upset the network admins.

It sounds like you may need to play with the sniffer setting a bit.

Waverebel: Close, but no cigar...... ;)

The scenario I described can be done with any communication that is directed to my segment of the network. In this case the segment contains my workstation, a hub so I can see all traffic on the segment, an internal router and my firewall to the world and id the last segment before the traffic goes out into the big wide world. Thus, any traffic entering or leaving my network can be sniffed by my workstation. Therefore, any traffic to and from publicly available servers such as mail, HTTP etc. can be seen and sniffed by my machine.

Anjali: As noted by others the switch would be a big issue. Also, did you apply any filters? You would know if you did because all the traffic you did capture would have something in common like the source IP or a port number. You really need to be on an appropriately placed hub for a sniffer to be of much use.

anjali:
Here comes the solution to sniff main flows with a single sniffer (or evntually NIDS) in a switched environment.

Most switches offer port mirroring (CISCO calls taht spans I learn it from yesterday...).

Plugging a sniffer to a mirroring port allows you to sniff all frames forwarded on the mirrored one.

-If the mirrored port is owned by a single user u'll be able to monitor only its current sessions.

- If the mirrored port is owned by a router u'll be able to monitor all inter vlan flows(but not intra vlan excepted for multicast and broadcast frames). I assume that ur network have a dedicated VLAN for servers (DMZ, Server clusters, server farms, ...), in that case intra VLAN flows are very few, and the sniffer will monitor most network activities.

If you want to learn about session hijacking, I elaborated quite a bit on the subject, and the tutorial is still relevant now.
http://www.antionline.com/showthread...hreadid=232029

Well...i am new ini this conversation and i need to know that how to put a sniffer in premecious mode...like all i can do is running the sniffer on ma pc.....would it be workin...or i need to make it listen o any typical ports n if yes..how sou;d i do that ..i hope that i llget ma problem solved
thanx
Ommy

ohhhh... So one thing clear......

Sniffers are very effective in a Hub scenario....

But places where u have switches.. it is a good option to go for some free IDS (like SNORT)...

But again Can i configure SNORT on win2k without using perl... incase yes.... I read that u need to update the signature files individually.... How true is that...

Also how to configure the Sniffer in promiscus mode.... I understand asigning it 0.0 but how....

..Do we have any free sniffers who work fine in win environment.....

Regards

Kalp

Hi anjali, i have the following for you

1. See my tutorial on analyzing traffic with tcpdump/windump. In next tutorial i will explain
the whole lot.

2. Mean while If you wish to have fun try the follwing

(a) If you are using windows try smbrelay, It views the netbios connections.....hmm etc
etc
(b) Try hunt and juggernaut in linux

3. Find the listed gems in www.packetstormsecurity.nl
See ya

Well...I asked something ..did somebody listened...

ommy: A packet sniffer either comes with it's own system for putting the NIC in promiscuous mode or, (like most seem to do), the require libpcap for *nix boxes and winpcap for Windows boxes. You install this first and the sniffer will call it when it is initiated.

Once in promiscuous mode the NIC does not drop all packets not directed at it's MAC address which is it's normal behaviour but rather collects them all and passes them back to your sniffer for processing. The sniffer will process all packets for all ports for all IP addresses that transmit and can be seen by the sniffing machine. You can tell the sniffer to filter the traffic if you like. So you may chose to only capture all traffic from your home net that is destined for SMTP servers for example. This makes reading and interpreting the output a whole lot easier......

If your sniffer is on a switched network you have two choices, span the ports on the switch to send all traffic to your sniffer boxes port or put a hub in place somewhere where all the traffic you want to capture can be seen. In order to properly monitor a subnet in an environment that contains any switches you need to have an intimate knowledge of the architecture to be able to properly place your sniffer and for it to be most effective. There are tools out there that will what's called ARP flood a switch. If this is done successfully the switched "routing table" is corrupted with multiple IP addresses for the same MAC address. Most switched will recognize this and fail into "hub" mode thuis all the traffic passing through it can be seen by all the machines attached to it.

WARNING: If you are not authorized by the system admin and you begin sniffing his traffic expect him to have a big problem with you. If you are not authorized by the system admin to ARP flood his switch(es) he will probably tear you limb from limb.... I would!!!!

NOTE: Sniffing the traffic on a network is really rather easy. Determining what it is telling you is a tad more difficult. You need to understand well, tcp/ip etc. to be able to make much sense of it. Read a good TCP/IP primer.... Google will help you find it.

GEE....Thanx Tiger Shark...I ll be obliged

tiger shark..thanks buddy.. Now it is pretty clear...

To summarize..

1) Sniffers work best with Hub type of technology where are packets are broadcasted into the network...

2) Incase of a switched Netqwork .. the placement of Sniffer is very important...

3) Sniffers would reply on winpcaps or libpcap.. to enable them to behave on promiscus mode....

4) You need a sound knowledge of TCP to be able to make some sense of the packets trapped by your sniffer....

5) If a person is able to sniff the network for long.. he/she can be able to trap passwords that travel as simple text...

6) It tells you the how ur network traffic is made of.... (TCP, UDP, ICMP etc.)

If you feel I have missed anything pls... mention that....

Regards

Kalp

I am a AntiOnline Newbie..
If you have a switched network like tiger said , u can put the port in which ur system has connected to switch as analyser port ( SPAN in CISCO )
http://www.cacr.caltech.edu/~jrmorri...isco/span.html
when u put like that all the packets going out from all the users in ur network will come to ur
port also (copies of the packets) whatevet the types of the packets ... (broadcast,multicast, unicat)
And u can use sniffer like Ethereal.. coz it is free and really easy to use.
But if u encrypt ur outgoing msgs then getting ur password by sniffing is little harder.

Now my question....
1. Can i monitor all the users of the network and can i plot the graph for individual users for how much bandwidth they are using and howlong. ( Even if i can plot just for HTTP or FTP that is enough for me )
I tried using many softwares like ( solarwinds,network probe,trafficmax ) ... But i am satisfied with anything.
plz suggest me some software for this or a way to use the existing softwares.