Printable View
I was wondering if anyone can explain this to me more in depth. I have read something similar to this in another thread, but I feel that it didn't give a detail description in what it is.
Is it like a phone tap only with packets? Can it be detected with conventional software tools?
Thanks
Enforcer
Network Enforce,
Try here...
http://www.snort.org/docs/tap/
Hey thats pretty cool, useless to me and looks a little complicated but cool. POINTS FOR Egaladeist!
I beleive you put a passive tap between the host you want to sniff and the switch. You can then intercept the traffic going to and from the host. Putting in the passive tap will ensure that you only get the data going to and from the host you are interested in. You don't have to filter out the rest of the traffic. It would be difficult if not impossible to find through software and an it is an effective hardware solution. (assuming that you can hide it well... server room? right off the switch? in the wall? etc.)
A lot of people put them at the border or gateway of their networks to watch for malicious traffic...
It would also be just as easy, but more costly, to put in a hub.
I say more costly because you have to power it, you waste unused ports, therefore wasting resources, the hub will cost more than it will to buy the parts to make your passive tap.
You could also want to do this if you have an unmanaged switch and can't "mirror" a port or use "port spanning". Or if you just want to monitor traffic between your internet connection and your firewall... or your firewall and your LAN/WAN. etc.
Another effective, but noisy technique for sniffing on a switched LAN is to use ettercap or dsniff or a tool like it to flood the arp table on the switch(s) effectively turning it into a hub.
I prefer to use Cain and Abel to do the flooding and sniffing of passwords, then I can single out my targets and then use ethereal to do my sniffing for detailed activity.
Ettercap has a lot of nice features in it that I rarely use. MITM attacks, DoS, etc.
To each his own. Use what you like.
I work in our IS department as a Network Admin. I am aware with Snort and it's construction of the Pasive Ethernet TAP. I only bring this up because a co-worker and I have come across the documention of the construction on the tap within our department. We feel that it might be used against some of us and so outside the department. We are trying to take measures to counter this action since we feel that the party is not aware that we know about it.
Further more, the company recently purchased a Hardware Utility to block and capture such traffic. But was stated that it would not be used on our perticular subnet.
If they put a hardware tap between you and them, it will be difficult to find.
You'll have to go looking for it.
You can try to find network cards that are in promiscous mode. There are weaknesses in some operating systems and sniffers that cause it to reveal itself.
Here is an article from earlier this month (Feb 10th) that shows how to detect a sniffer on an NT box.
Some tools like ettercap also have plugins to detect other sniffers on the network.
Searches on google for "detect network sniffer" or terms similar will turn up other results.
If your "attacker" were to create one of these boxes, then they could have also created a "receive only" patch cord to go between the network card and the passive tap. This would ensure that absolutely NO data was sent from that network card onto the line that is being sniffed.
receive only network tap
If that were the case, then you would not be able to detect the promisc. network card because the flaws in the OS or sniffer that gives it self away will never be sent back onto the network.
A co-worker and I determined that the actual rj-45 jacks will be connected either behind our workstation plugged into the jack in the wall or most likely in our MDF where our drops go to the switches. Unless they decided to put some time in it and route my or anyone elses connection to an IDF which we still can go out. In either case, there isn't a place that we (IS Staff and Department) can't go or get access to.
Thanks for the info phish. My co-worker and I will be hard at work to get to the bottom of this because at the moment, we can only go off of assumption. And I for one am a paranoid person when it comes to people trying to get information from me whether or not I am informed about it.
Enforcer
The tap will most likely be near your switch or even at your patch panels... as you've already guessed. You can probably make one of these taps by just duplicating a port on the patch panel... Just like you can duplicate a phone line... That would be easy enough to hide.
Under your desk is too obvious and you'd notice extra hardware there.
If "they" really know what they're doing... it'll be hard to find.
They can sniff/trace you at any patch panel, hub, switch, hop, etc.
Anywhere the physical layer goes... they can go.
Do you have any reason to suspect they are monitoring you?
All you found was a diagram and you're getting this parinoid over it?
I print out and save all kinds of "weird" stuff...
Besides... to go through all that trouble and leave the documents where you can find them?
Use encryption...
This was a set-up, right?
Ok, you sucked me in because this fries my as_.
Taps are, by there nature, passive. They listen, don’t respond. If they set up an IDS or IPS on a hub ( which is not really a tap, but called a “ cheap man’s tap “ ) without a custom read-only cable ( or maybe a home-made tap from a hub ) you might be able to detect it, but these should NEVER be used in a corporate environment.
If you are thinking that it might inadvertently pick up some violation of the AUP ( if there is one ) by you or one of your colleagues, you may be correct, depending how it was set up and where.
Actually, most commercial taps that I know are expensive, require power, and many can interrupt the network if power is lost. ( something to think about when deciding on hardware? )Quote:
I say more costly because you have to power it, you waste unused ports, therefore wasting resources, the hub will cost more than it will to buy the parts to make your passive tap.
Even some of the home-made taps require some type of power, usually battery power. And wasting unused ports? I don’t know how to respond on that one.
------------------- now to issue ---------
We have an alleged Network Administrator here in a corporate environment complaining that someone, admittedly from the “company” with “company” approval, MAY have put in a tap and MAY be spying on them? And he wants to know how to find it and defeat it because he thinks the person(s) who put it there doesn’t know they know about it?Quote:
... I only bring this up because a co-worker and I have come across the documention of the construction on the tap within our department. We feel that it might be used against some of us and so outside the department. We are trying to take measures to counter this action since we feel that the party is not aware that we know about it.
Further more, the company recently purchased a Hardware Utility to block and capture such traffic. But was stated that it would not be used on our perticular subnet.
Maybe it was the Security Administrator that placed it? And there was a reason for it besides just spying on you? ( Does the phrase “ Network Security “ ring any bells here? )
The ONLY thing you should be concerned about as a Network Admin is does it impact adversely on your network. Period!
Go ahead, mess with the tap! Loose your job! You apparently don’t belong there anyway because you can’t be trusted!
Where is GORE when you need him?
I was trying to think of some advantages/disadvantages of a passive tap over a hub. I have no direct experience with passive taps... just what I've read about them.Quote:
Actually, most commercial taps that I know are expensive, require power, and many can interrupt the network if power is lost. ( something to think about when deciding on hardware? )
Even some of the home-made taps require some type of power, usually battery power. And wasting unused ports? I don’t know how to respond on that one.
At any rate, I was talking about making your own tap... not buying one.
As far as wasting ports... it is a waste of resources. Its more than you need.
Hopefully I didn't provide any misinformation. I thought I had researched it sufficiently.
Guess not.
You didn't provide any misinformation phish, it's not so cut and dry. There are many devices out there. When I think of a passive tap it is just that, passive. If it's in line with the network and takes the network down it's not very passive. Not meaning a passive tap is the same as passive monitoring. If the tap requires power it's doing something else or you got taken with a sales pitch or poor design. For instance it may be doing aggregation (combining multiple NIC into a single stream), regeneration (taking a single NIC and regenerating traffic across multiple ports to feed to different devices) or signal conversions at layer 1 (Data Link). Otherwise all ya need is a simple tap with no power and I wouldn't call those above examples passive taps. Since none of them really respond to requests, they all get called passive but in reality they are manipulating things.
Oh and Just because there is a tap present does not mean someone is spying on ya, I use them for bandwidth allocation in a couple of places. The IDS taps are further upstream.
I in particular have no reason to be a suspect of any sort since I have nothing to hide nor anything that I do that violates our Minimum Internat Control Standards. The person that is trying to screw around with the ethernet tap is one of those people that gets the answer the next day because he looks it up on the web and doesn't pull the majority of his knowledge from his brain. From what it looks like, my co-worker and I determined that he is only in the baby stages of trying to figure this out.
If it's the case that he will try to route to an IDF to another patch panel to do this then all we can humanly do is walk the IDF's. And from the way it looks, it is unauthorized because my company is a multibillion dollar a year type place. This place doesn't skimp onkeeping up with technology so having to go out to SNORT.org and pull up schematics for a home made ethernet tap dongle doesn't fit the description of a company that supports it's IT department on tech matters.
Let's put it this way, pacbell setup our routers and pix. We do have people that are cisco certified to configure routers and firewalls, but this person doesn't. So if that's the case, why would he go through the trouble to setup an IDS? Which only brings it back to packet sniffing from what I can conclude.Quote:
Originally posted here by RoadClosed
Oh and Just because there is a tap present does not mean someone is spying on ya, I use them for bandwidth allocation in a couple of places. The IDS taps are further upstream.
To go along with that, I am paranoid which is why I am trying to gather information first then make the conclusion :D
lol, or maybe he's just curious.