Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to know if there is a product or software that can detect if there is a sniffer currently on the network?

In other words is it possible at all to detect if there is a network card on the network that its is currently at promiscuous mode?

share|improve this question
add comment

3 Answers

There has been some work done that I've heard of like anti-sniff, which looks to detect machines in promiscuous mode using timing information.

The idea being that machines in promiscuous mode will have to process all packets that they see so if there are large amounts of traffic that need processed the system will be busy and slower to respond to directed traffic.

This sort of approach, if it's still practical, wouldn't work in every scenario. For example if a host doesn't have an IP address it can still potentially sniff traffic and it wouldn't be possible to detect it using this approach.

However it's one possible approach that could be explored.

share|improve this answer
6  
There's also always the social aspect: produce false information and wait for someone to act on it. –  Polynomial Dec 5 '12 at 10:05
add comment

It is possible to sniff packets on unswitched ethernet or wifi completely passively. Tools like the Throwing Star Lan Tap make this even easier. In this passive case, there is nothing you can really do about it.

However if you are on a switched lan, any sniffer would have to start poisoning ARP caches, even if only on the switch. This is something that you can much more easily detect and is a nice early warning that someone is planning something evil.

share|improve this answer
5  
"any sniffer would have to start poisoning ARP" is not technically true. To sniff all traffic, then you need to ARP poison. But sniffing broadcasts and traffic on a shared switch line do not require ARP poisoning: I do it all the time. –  schroeder Dec 5 '12 at 15:18
    
By on a switched lan I thought it was obvious what I meant. If you have other hosts in your collision domain, you're not on a switched network segment. Also broadcasts are rarely interesting. Not that both your points aren't correct. –  lynks Dec 6 '12 at 19:35
add comment

If the system runs the sniffer, its interface will be in promiscuous mode. The test works like this: Send a ping with the correct IP address into the network but with a wrong mac address. The sniffing host will answer the ping packet, as it will receive every packet in promiscuous mode. There is a ready-to use script in nmap to support this detection.

http://nmap.org/nsedoc/scripts/sniffer-detect.html

HOWEVER: This method only works if,

  1. the sniffing host is on the same Layer2 network
  2. the sniffing host does not have a firewall that blocks incoming icmp packets
  3. the sniffing host does the sniffing with an interface that has TCP/IP enabled, and thus is able to answer the ICMP packet.

Source : http://ask.wireshark.org/questions/14351/detectprevent-wireshark

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.