Sniffing network traffic. 10-23-2012, 05:58 PM
#1
SNIffING NETWORK TRAffIC
Another popular technique that can be used to gain access to systems is net-
work sniffing. sniffing is the process of capturing and viewing traffic as it is
passed along the network. several popular protocols in use today still send
sensitive and important information over the network without encryption.
network traffic sent without using encryption is often referred to as clear text
because it is human readable and requires no deciphering. sniffing clear text
network traffic is a trivial but effective means of gaining access to systems.
Before we begin sniffing traffic, it is important that you understand some basic
network information. the difference between promiscuous mode and nonpro-
miscuous network modes will be discussed first.
By default most network cards operate in nonpromiscuous mode. non-
promiscuous mode means that the network interface card (nic) will only
pass on the specific traffic that is addressed to it. if the nic receives traffic that
matches its address, the nic will pass the traffic onto the cPU for processing.
if the nic receives traffic that does not match its address, the nic simply dis-
cards the packets. in many ways, a nic in nonpromiscuous mode acts like a
ticket taker at a movie theater. the ticket taker stops people from entering the
theater unless they have a ticket for the specific show.
Promiscuous mode on the other hand is used to force the nic to accept all
packets that arrive. in promiscuous mode, all network traffic is passed onto the
cPU for processing regardless of whether it was destined for the system or not.
in order to successfully sniff network traffic that is not normally destined for
your Pc, you must make sure your network card is in promiscuous mode.
You may be wondering how it is possible that network traffic would arrive at
a computer or device if the traffic was not addressed to the device. there are
several possible scenarios where this situation may arise. first any traffic that is
broadcast on the network will be sent to all connected devices. Another exam-
ple is networks that use hubs rather than switches to route traffic.
A hub works by simply sending all the traffic it receives to all the devices con-
nected to its physical ports. in networks that use a hub, your nic is constantly
disregarding packets that do not belong to it. for example, assume we have a
small 8-port hub with 8 computers plugged into the hub. in this environment
when the Pc plugged into port number 1 wants to send a message to the Pc
plugged into port number 7, the message (network traffic) is actually delivered
to all the computers plugged into the hub. However, assuming all the computers
are in nonpromiscuous mode, machines 2–6 and 8 simply disregard the traffic.
many people believe you can fix this situation by simply swapping your hubs
with switches. this is because unlike hubs that broadcast all traffic to all ports,
switches are much more discrete. when you first plug a computer into a switch,
the mAc address of the computer’s nic is registered with the switch. this
information (the computer’s mAc address and switch’s port number) is then
used by the switch to intelligently route traffic for a specific machine to the spe-
cific port. going back to your previous example, if a switch is being used and
Pc 1 sends a message to Pc 7, the switch processes the network traffic and con-
sults the table containing the mAc address and port number. it then sends the
message to only the computer connected to port number 7. devices 2–6 and 8
never receive the traffic.
Another popular technique that can be used to gain access to systems is net-
work sniffing. sniffing is the process of capturing and viewing traffic as it is
passed along the network. several popular protocols in use today still send
sensitive and important information over the network without encryption.
network traffic sent without using encryption is often referred to as clear text
because it is human readable and requires no deciphering. sniffing clear text
network traffic is a trivial but effective means of gaining access to systems.
Before we begin sniffing traffic, it is important that you understand some basic
network information. the difference between promiscuous mode and nonpro-
miscuous network modes will be discussed first.
By default most network cards operate in nonpromiscuous mode. non-
promiscuous mode means that the network interface card (nic) will only
pass on the specific traffic that is addressed to it. if the nic receives traffic that
matches its address, the nic will pass the traffic onto the cPU for processing.
if the nic receives traffic that does not match its address, the nic simply dis-
cards the packets. in many ways, a nic in nonpromiscuous mode acts like a
ticket taker at a movie theater. the ticket taker stops people from entering the
theater unless they have a ticket for the specific show.
Promiscuous mode on the other hand is used to force the nic to accept all
packets that arrive. in promiscuous mode, all network traffic is passed onto the
cPU for processing regardless of whether it was destined for the system or not.
in order to successfully sniff network traffic that is not normally destined for
your Pc, you must make sure your network card is in promiscuous mode.
You may be wondering how it is possible that network traffic would arrive at
a computer or device if the traffic was not addressed to the device. there are
several possible scenarios where this situation may arise. first any traffic that is
broadcast on the network will be sent to all connected devices. Another exam-
ple is networks that use hubs rather than switches to route traffic.
A hub works by simply sending all the traffic it receives to all the devices con-
nected to its physical ports. in networks that use a hub, your nic is constantly
disregarding packets that do not belong to it. for example, assume we have a
small 8-port hub with 8 computers plugged into the hub. in this environment
when the Pc plugged into port number 1 wants to send a message to the Pc
plugged into port number 7, the message (network traffic) is actually delivered
to all the computers plugged into the hub. However, assuming all the computers
are in nonpromiscuous mode, machines 2–6 and 8 simply disregard the traffic.
many people believe you can fix this situation by simply swapping your hubs
with switches. this is because unlike hubs that broadcast all traffic to all ports,
switches are much more discrete. when you first plug a computer into a switch,
the mAc address of the computer’s nic is registered with the switch. this
information (the computer’s mAc address and switch’s port number) is then
used by the switch to intelligently route traffic for a specific machine to the spe-
cific port. going back to your previous example, if a switch is being used and
Pc 1 sends a message to Pc 7, the switch processes the network traffic and con-
sults the table containing the mAc address and port number. it then sends the
message to only the computer connected to port number 7. devices 2–6 and 8
never receive the traffic.
it wasn't me nobody saw me you can't prove anything
Knowledge is free
Knowledge is free
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
