The reader is referred here to an earlier article for the basics of sniffer detection. When sniffers are working on switches, the chances of detecting them are higher. In such a scenario the sniffer is not a passive device; it performs certain activities by which it can be detected.
ARP spoofing can be detected using a program called ARP Watch. It is used to monitor the ARP cache of a machine to see if there is duplication. If there is, it could trigger alarms and lead to detection of sniffers. It can be obtained at online.securityfocus.com/data/tools/arpwatch.tar.Z
As is clear from the above sections, one method of sniffing in a switched environment is using ARP spoofing, and the machine that will most probably be ARP spoofed is the gateway. One thing that can be done is to add the MAC address of the gateway permanently to your ARP cache. This can be done by giving the -s flag to the arp command. Read more about this on the arp man page. Alternatively, you could use the /etc/ethers file for placing the MAC addresses of the important machines to prevent spoofing of those machines.
Final words of advice: Use encryption. Switch to SSH and SCP instead of Telnet and FTP.
Sumit Dhar works for SLMsoft.com.
|Red Hat Enterprise Linux 7.1 beta available on IBM Power Platform||Jan 23, 2015|
|Designing with Linux||Jan 22, 2015|
|Wondershaper—QOS in a Pinch||Jan 21, 2015|
|Ideal Backups with zbackup||Jan 19, 2015|
|Non-Linux FOSS: Animation Made Easy||Jan 14, 2015|
|Internet of Things Blows Away CES, and it May Be Hunting for YOU Next||Jan 12, 2015|
- Designing with Linux
- Wondershaper—QOS in a Pinch
- Red Hat Enterprise Linux 7.1 beta available on IBM Power Platform
- Internet of Things Blows Away CES, and it May Be Hunting for YOU Next
- Ideal Backups with zbackup
- New Products
- Slow System? iotop Is Your Friend
- Purism Librem 15
- Hats Off to Mozilla
- 2014 Book Roundup