Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite
2

I would like to know if there is a product or software that can detect if there is a sniffer currently on the network?

In other words is it possible at all to detect if there is a network card on the network that its is currently at promiscuous mode?

share|improve this question

2 Answers

up vote 8 down vote

There has been some work done that I've heard of like anti-sniff, which looks to detect machines in promiscuous mode using timing information.

The idea being that machines in promiscuous mode will have to process all packets that they see so if there are large amounts of traffic that need processed the system will be busy and slower to respond to directed traffic.

This sort of approach, if it's still practical, wouldn't work in every scenario. For example if a host doesn't have an IP address it can still potentially sniff traffic and it wouldn't be possible to detect it using this approach.

However it's one possible approach that could be explored.

share|improve this answer
5  
There's also always the social aspect: produce false information and wait for someone to act on it. – Polynomial Dec 5 '12 at 10:05
up vote 7 down vote

It is possible to sniff packets on unswitched ethernet or wifi completely passively. Tools like the Throwing Star Lan Tap make this even easier. In this passive case, there is nothing you can really do about it.

However if you are on a switched lan, any sniffer would have to start poisoning ARP caches, even if only on the switch. This is something that you can much more easily detect and is a nice early warning that someone is planning something evil.

share|improve this answer
4  
"any sniffer would have to start poisoning ARP" is not technically true. To sniff all traffic, then you need to ARP poison. But sniffing broadcasts and traffic on a shared switch line do not require ARP poisoning: I do it all the time. – schroeder Dec 5 '12 at 15:18
By on a switched lan I thought it was obvious what I meant. If you have other hosts in your collision domain, you're not on a switched network segment. Also broadcasts are rarely interesting. Not that both your points aren't correct. – lynks Dec 6 '12 at 19:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.