Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a simple wireless router to share the internet with single access username/password.

I was wondering if it is possible somehow to set packet encryption so that other people on the LAN cannot sniff them?

share|improve this question
    
Wireless networks can always be sniffed - what matters is if they're encrypted or not. –  ekaj Apr 15 '13 at 22:08
add comment

3 Answers

up vote 3 down vote accepted

Low-level encryption, for arbitrary packets, is called a VPN. If your wireless router implements IPsec, you can use that. This will raise a few tricky questions, of course (key management, authentication...).

I doubt many home wireless routers know how to do IPsec natively (peruse the documentation of your own router), but some routers can be reflashed with an alternative firmware who can do it.


If you let hostile people physically plug in your home network, then you may have bigger problems to deal with. For instance wanton degradation by temporarily wiring an ethernet cable with 110V power...

Also, remember that the Internet at large is not a nice place. Encrypting your packets only on your home LAN will protect them against people plugged on that LAN, but only against them. If the data is sensitive, it should benefit from end-to-end protection. In simple words: use only HTTPS Web sites. And if you do, then you don't have to do anything special on the LAN.

share|improve this answer
    
Is the wired network encrypted in general? eg. If somebody connects to my internet cable outside my house. –  Arturs Apr 15 '13 at 21:50
    
Ethernet is not inherently encrypted. For other network types, anything goes... especially for cable companies, who rarely disclose the nature of the protocols they run over the cable (they want to discourage rogue wiring). It is safest to assume that there is no protection unless you explicitly configured a VPN between the relevant machines. –  Tom Leek Apr 16 '13 at 1:11
    
Sure they do, nearly all cable companies use the DOCSIS standard for network-over-cable. And the DOCSIS spec includes encryption (though I guess it's possible for a cable operator to not use the encryption capability): en.wikipedia.org/wiki/DOCSIS –  Johnny Apr 16 '13 at 21:52
    
"wanton degradation by temporarily wiring an ethernet cable with 110V power" Things like this keep me up at night... –  NULLZ Apr 18 '13 at 6:46
add comment

Encryption alone doesn't solve all of the problems posed by an attacker on a LAN. In practice if you do not trust the network, you should use a VPN to protect the trusted systems on the network.

Transport Layer Security (TLS) is the tool of choice.

share|improve this answer
add comment

I think when the asker said "LAN", he mean "Wifi LAN", not wired LAN.

If that's the case, using WPA with a shared password does give some protection against someone else on the same Wifi network from snooping the data of others on the network. Preferably using AES rather than TKIP

With some effort (see http://superuser.com/questions/156869/can-other-people-on-an-encrypted-wi-fi-ap-see-what-youre-doing ), it is possible to crack the WPA session keys and snoop the traffic of other users, so a determined hacker may be able to snoop your data, but if you're looking for protection against someone on the network casually listening in, WPA will give you that protection. But, as others have said, it gives you no protection from LAN users that are plugged into the router. Using a VPN would be a more secure solution and can help protect against someone snooping data on your WAN connection or at your ISP since your traffic would be encrypted all the way to your VPN server.

share|improve this answer
    
how would it be easier if the attacker had access to the physical internet wire? –  Arturs Apr 15 '13 at 22:06
    
It depends on the particular Wifi router. You may be able to spoof a target's MAC address or flood the switches's MAC table to get it to broadcast all traffic on all ports, then you can watch the unencrypted traffic go by on the LAN port. –  Johnny Apr 15 '13 at 22:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.