Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was reading the wiki about promiscuous mode when I came across a piece of information here that suggests that one could use network switches to prevent malicious use of promiscuous mode.

In the context of an ethernet LAN, an attacker can sniff packets or perform ARP spoofing at the very least. I'm curious about how using a network switch can prevent either of these issues.

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

Promiscuous mode means telling an Ethernet card to record all packets that pass by, not just those addressed directly to it or broadcasts.

If that card is connected to a switch, however, then the switch normally only sends the card packets that are addressed directly to it (or to broadcast), so there's nothing else for the card to see.

I said normally because there are some circumstances where a switch sends other traffic out a particular port:

  • the switch admin might configure it to do that (e.g. so an IDS can monitor traffic)
  • the switch might do that if it is having problems (e.g. if it's not sure which port to send a packet to)

So you can't assume that just installing switches makes promiscuous mode go away completely as a threat; a determined attacker might attack the switch to try and make it do one of these things and send her host extra packets she can read with a promiscuous network card.

(And of course a determined attacked will do other things as well, such as attacking other bits of the network to make them send her packets they shouldn't.)

However, switches stop the casual user from using WireShark or Firesheep to poke about on the network; and in any case they offer other advantages, so most network managers have already upgraded to them.

share|improve this answer
    
I would add this is the only security improvement the switch adds, an attacker can start to do more active attacks like ARP spoofing or DNS cache poisoning to get the network to start sending data it's way and the switch has little ability to stop it. –  ewanm89 Oct 25 '12 at 11:59
    
I disagree @ewanm89. Managed switches have the ability to define a specific mac for a specific port and not learn mac on a port, preventing arp spoofing. Managed switches also have an isolated mode which prevent 2 devices from talking to each other unless one is "promiscuous" ciscopress.com/articles/article.asp?p=1181682&seqNum=3 These features make a switch very powerful against layer 2 attacks. One would be left to DNS cache poisoning or other L3 attacks. –  jrwren Nov 9 '12 at 18:30
    
jrwen, yes managed switched can stop some kinds of attacks in some circumstances. They can not stop every kind of attack. –  ewanm89 Nov 9 '12 at 19:27
add comment

As @Graham-hill mentions, at a basic level with a switch, a host on the network will only see the traffic destined for it.

The common attack cited for this is ARP spoofing/poisoning where a malicious host sends ARP responses to requests to attempt to get other hosts to believe it is a specific system (usually the router for that subnet).

defences against ARP spoofing/poisoning depend largely on the switches you use. Many switches do have features to defend against this. For example Cisco Port Security. Essentially from what I've seen these involve the switch learning which ports have which MAC addresses and rejecting traffic from hosts which claim to have an address it already knows is on a different port..

share|improve this answer
add comment

I think the entry might be referring to the differences between a switch and hub. A switch will not share traffic to the other ports on the device, unlike a hub. You can sniff anyone that's hooked up to a hub (not a switch) regardless of what port they are on.

There are issues with switches, too. However, many newer switches will protect against MAC flooding, aka overload a switch with ARP replies and forcing the switch into forwarding mode, where someone in promiscuous mode will see all info regardless of port (like a hub).

ARP poisoning is a problem but some DHCP severs or newer switches should have detection built-in.

Either way, tools like ARPwatch and various NetMon tools should be used to watch for irregularities.

In conclusion, a switch is better than a hub but its not perfect.

share|improve this answer
    
I like this answer. I would like to add a note about IDS though. If op is concerned enough about active sniffing using an IDS is a must. They will be able to detect exactly this sort of behavior, responding accordingly. –  November Oct 26 '12 at 0:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.