Network Monitoring/Sniffing Tools
Modified 14 March October 2008
There's a variety of general types:
-
Capture all packets on wire, provide very nice
analysis of protocols
(e.g., Wireshark, formerly called
Ethereal)
-
Show general characteristics of traffic on the LAN
(e.g., EtherApe or ntop)
-
Only show counts of packets to/from the host itself
(e.g., iptraf)
A wonderful archive is:
http://packetstormsecurity.org/sniffers/
Also see
my wireless LAN security section
On with my lists.
First, wireful LAN monitoring and analysis tools,
divided by operating system:
Then, wireless LAN/WAN monitoring, discovery, and analysis
tools.
LAN Monitoring Tools
UNIX / Linux / BSD LAN Monitoring Tools
-
Wireshark,
formerly called
Ethereal,
is really the very best tool,
short of a dedicated piece of hardware costing
US$ 20,000 or more —
http://www.wireshark.org/
-
My biggest complaint with Wireshark is the difficult of
building filter strings, particularly for new users.
Note that Wireshark uses the same filter
syntax as tcpdump, and that is
well-documented if you have an Internet connection:
See the tcpdump manual page
-
Other tools include:
DOS/Windows LAN Monitoring Tools
Beware a false sense of security based on switches
-
A switch does not provide security
by partitioning a LAN.
The dsniff toolkit includes arpspoof,
which uses ARP trickery to confuse hosts about the
mappings between IP and MAC addresses.
The attacker can get all datagrams sent to a sniffing
host, which grabs copies and possibly modifies
contents before sending them to the legitimate
hardware addresses.
-
ALso be aware that some tools (dsniff,
mailsnarf, webspy)
understand application-layer protocols and make it
easy to capture and analyze telnet and
FTP logins and passwords,
web traffic, mail, etc.
Wireless LAN/WAN Monitoring and Security
Here is a useful introduction to wireless networking
and the security issues:
http://en.wikipedia.org/wiki/802.11b
Note that wireless monitoring tools can be extremely
dependent on chipset — make sure that your planned software
and WLAN card will get along.
The Trifinite Group
has information on wireless security, including
RFIDiot
and other RFID security tools and information:
http://www.trifinite.org/
-
Free sniffers for UNIX / Linux / BSD —
-
Free sniffers for Mac OS —
-
Free sniffers for Windows —
-
Commercial tools — divided into categories:
-
Packet Sniffing and War-Driving Tools
-
Vulnerability Assessment Tools —
more than just sniffing
-
Traffic Monitoring and Analysis Tools —
and also consider the free tool
Wireshark
and
-
WLAN Intrusion Detection Tools
-
WLAN attack tools:
-
Hotspot directories —
among many others see:
-
Antennas, access point modification,
building your own WLAN, etc.
-
Other lists of tools:
-
2002 U.S. NIST report on top ten 802.11b wireless LAN security
problems —
-
Security features in vendor products
frequently not enabled,
poor in many cases even if enabled.
-
Initialization vectors are only 24 bits,
causes generated keystream to repeat.
-
40-bit cryptographic keys are inadequate,
allow for relatively easy brute-force attack.
-
Cryptographic keys are shared, so easy to
compromise.
-
Cryptographic keys cannot be updated
automatically and frequently.
-
RC4 keystream is inappropriately used in
Wired Equivalent Privacy (WEP) protocol,
vulnerable to key-recovery attack.
-
Packet integrity-checking is poor, may allow
undetected modification.
-
Only device authentication,
no user authentication.
-
Only Service Set Identification (SSI) is done,
vulnerable in wireless system.
-
Device authentication based on one-way
challenge-response,
vulnerable to "man in the middle" attack.
Tapping optical fibre
no longer requires splicing.
You can read the data by removing some of the sheath
and gently bending the fibre in a bend coupler.
You can supposedly buy them for a few hundred US$,
even off eBay.
There are claims that optical taps
have been found on police networks in the Netherlands
and Germany,
and the FBI investigated one discovered on Verizon's network
in the US.
For more see:
The "ISS Sniffer FAQ"
answers the
Frequently-Asked Questions on LAN "sniffers"
and then some.
It points you to sniffer software, to sniffer detectors,
and to other privacy and authentication tools.
For suggestions on spotting sniffer attacks, see
http://www.cert.org/pub/advisories/CA-1994-01.html
Detecting interfaces in promiscuous mode
-
The best tools would be:
-
Two other tools require that they be run on the
attacking host during an attack — not very likely!
Back to the Security Page
