The reader is referred here to an earlier article for the basics of sniffer detection. When sniffers are working on switches, the chances of detecting them are higher. In such a scenario the sniffer is not a passive device; it performs certain activities by which it can be detected.
ARP spoofing can be detected using a program called ARP Watch. It is used to monitor the ARP cache of a machine to see if there is duplication. If there is, it could trigger alarms and lead to detection of sniffers. It can be obtained at online.securityfocus.com/data/tools/arpwatch.tar.Z
As is clear from the above sections, one method of sniffing in a switched environment is using ARP spoofing, and the machine that will most probably be ARP spoofed is the gateway. One thing that can be done is to add the MAC address of the gateway permanently to your ARP cache. This can be done by giving the -s flag to the arp command. Read more about this on the arp man page. Alternatively, you could use the /etc/ethers file for placing the MAC addresses of the important machines to prevent spoofing of those machines.
Final words of advice: Use encryption. Switch to SSH and SCP instead of Telnet and FTP.
Sumit Dhar works for SLMsoft.com.
|Huge Package Overhaul for Debian and Ubuntu||Jul 23, 2015|
|diff -u: What's New in Kernel Development||Jul 22, 2015|
|Shashlik - a Tasty New Android Simulator||Jul 21, 2015|
|Embed Linux in Monitoring and Control Systems||Jul 20, 2015|
|The Controversy Behind Canonical's Intellectual Property Policy||Jul 17, 2015|
|Non-Linux FOSS: Portable Apps, in the Cloud!||Jul 15, 2015|
- Huge Package Overhaul for Debian and Ubuntu
- Shashlik - a Tasty New Android Simulator
- diff -u: What's New in Kernel Development
- The Controversy Behind Canonical's Intellectual Property Policy
- Home Automation with Raspberry Pi
- Embed Linux in Monitoring and Control Systems
- Purism Librem 13 Review
- One Port to Rule Them All!
- Privacy Is Personal
- General Relativity in Python