RE: Detect Network Sniffing

["David Gillett" <gillettdavid () fhda edu>]

  Cisco switches have a feature called "SPAN" -- I forget what it's an
acronym for, but that's not important.  What matters is that the switch -- a
layer 2 device, so it needn't have a layer 3 IP address, or show up in tools
like traceroute -- can be told to forward all traffic in and/or out of a
chosen interface or VLAN to be duplicated and also forwarded to some other
port, with no visibility to anyone except the administrator of the switch.
  Basically, if your traffic goes over somebody else's wires, assume they
can see it.  If you can encrypt it, you probably should.

David Gillett


-----Original Message-----
From: Kenneth Walling [mailto:metajunkie () gmail com]
Sent: Tuesday, November 08, 2011 10:44
To: Dagni McPhee
Cc: security-basics () securityfocus com
Subject: Re: Detect Network Sniffing

If you are really concerned about this - I wouldn't wast time trying to
catch those instances where someone is being sloppy (which is all you will
catch with anything designed to find nics in promisc. mode).

You would be better served to look into encrypting all of the traffic on
your LAN.

Metajunkie

On Nov 7, 2011, at 7:11 PM, Dagni McPhee wrote:

> Is there any way to detect if a sniffer is being used to analyze my
traffic before it gets onto the Internet? Also is it required for a sniffer
to have an IP address or can it sniff while remaining "uncontactable" on the
network?
> ----------------------------------------------------------------------
> -- Securing Apache Web Server with thawte Digital Certificate In this
> guide we examine the importance of Apache-SSL and who needs an SSL
certificate.  We look at how SSL works, how it benefits your company and how
your customers can tell if a site is secure. You will find out how to test,
purchase, install and use a thawte Digital Certificate on your Apache web
server. Throughout, best practices for set-up are highlighted to help you
ensure efficient ongoing management of your encryption keys and digital
certificates.
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be4
> 42f727d1
> ----------------------------------------------------------------------
> --


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate In this guide we
examine the importance of Apache-SSL and who needs an SSL certificate.  We
look at how SSL works, how it benefits your company and how your customers
can tell if a site is secure. You will find out how to test, purchase,
install and use a thawte Digital Certificate on your Apache web server.
Throughout, best practices for set-up are highlighted to help you ensure
efficient ongoing management of your encryption keys and digital
certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727
d1
------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------