The reader is referred here to an earlier article for the basics of sniffer detection. When sniffers are working on switches, the chances of detecting them are higher. In such a scenario the sniffer is not a passive device; it performs certain activities by which it can be detected.
ARP spoofing can be detected using a program called ARP Watch. It is used to monitor the ARP cache of a machine to see if there is duplication. If there is, it could trigger alarms and lead to detection of sniffers. It can be obtained at online.securityfocus.com/data/tools/arpwatch.tar.Z
As is clear from the above sections, one method of sniffing in a switched environment is using ARP spoofing, and the machine that will most probably be ARP spoofed is the gateway. One thing that can be done is to add the MAC address of the gateway permanently to your ARP cache. This can be done by giving the -s flag to the arp command. Read more about this on the arp man page. Alternatively, you could use the /etc/ethers file for placing the MAC addresses of the important machines to prevent spoofing of those machines.
Final words of advice: Use encryption. Switch to SSH and SCP instead of Telnet and FTP.
Sumit Dhar works for SLMsoft.com.
|Dr Hjkl on the Command Line||May 21, 2015|
|Initializing and Managing Services in Linux: Past, Present and Future||May 20, 2015|
|Goodbye, Pi. Hello, C.H.I.P.||May 18, 2015|
|Enter to Win Archive DVD + Free Backup Solution||May 18, 2015|
|Using Hiera with Puppet||May 14, 2015|
|Urgent Kernel Patch for Ubuntu||May 12, 2015|
- Initializing and Managing Services in Linux: Past, Present and Future
- Dr Hjkl on the Command Line
- Goodbye, Pi. Hello, C.H.I.P.
- Using Hiera with Puppet
- Gartner Dubs DivvyCloud Cool Cloud Management Vendor
- Enter to Win Archive DVD + Free Backup Solution
- Mumblehard--Let's End Its Five-Year Reign
- Infinite BusyBox with systemd
- It's Easier to Ask Forgiveness...
- Urgent Kernel Patch for Ubuntu