Many of us know that sniffing is possible in a shared i.e. non-switched ethernet environment. But only few of us know that sniffing is also possible in a switched ethernet environment. One of the reasons is that it's not that straighforward. But it's not impossible or difficult. You can use man in the middle technique like ARP spoofing to sniff in a switched environment.
This presentation is an attempt to explain how can somebody sniff in a switched ethernet using ARP spoofing. Dsniff has existed for long as a tool for various sniffing activities. But recently, tools like EttercapNG have made it easier. Links to the presentation:
Sniffing in a Switched Network (HTML Document with frames)
Sniffing in a Switched Network (HTML Document with no frames)
Sniffing in a Switched Network (PDF format)
Sniffing in a Switched Network (Microsoft PPT)
Mirrors for pdf and ppt:
Sniffing in a Switched Network (PDF format)
Sniffing in a Switched Network (Microsoft PPT)
Cheers,
-Manu
----------------
Manu Garg
http://manugarg.freezope.org
"Truth will set you free!"
Technorati tags: security hacking networking sniffing
Digg this; Post to del.icio.us
---------------------------------------
Update: Aug 8, 2005
Guys, freezope.org server seems to be unstable. HTML links may or may not work.
---------------------------------------
June 13, 2005
Sniffing in a Switched Network
Subscribe to:
Post Comments (Atom)
Posts
9 comments:
Keep up the good work, a very informative blog for the open source community.
Nice inofrmation there dude.Thanks
nice work GARG ,
keep going on
Old recycled info reworded. Good work man!
Nice slide , I have posted a copy of it on secguru
Great information. I was looking for a way to do packet sniffing with ethereal when I'm not using any "dumb hubs." But I was wondering, will this also work with routers?
This won't work across routers as routers segregate arp broadcast domains. You can always own the router first, however ;-)
nice stuff Manu, ettercap turned out to be pretty useful just like other MITM tools. I used it for two communicating machines in the same subnet and used the "oneway" tag to retarget the packets through my machine.
www.oxit.it (Cain) can help with that too if you are looking for something specific
Post a Comment