Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to know if sniffing packets of a remote IP address is possibole at all, if yes i would like to know :

  • what is the success rate, i mean by that how much percent of the packets you would capture?
  • What are the benefits of secureing the local LAN if someone can capture all the packets from that LAN simply by sniffing the WAN connection?
  • What are the ways to prevent that, and if there is a way to prevent the attacker to know my DNS queries and by that knows to what web sites i am surfing.
share|improve this question
add comment

4 Answers

up vote 4 down vote accepted

If you have control over the network, you can sniff traffic remotely by using a vlan as the destination for a span port and then trunking that to where you need it. You can do this over routed networks as well using GRE tunnels but you must control the network.

1) If you have control of the network you should be able to capture 100%

2) You can encrypt WAN connections using IPSec either from host to host or at the routers that connect to the service provider to prevent the service provider from viewing the data.

3) This sounds more like you are worried about spyware on your workstation. If you have malware on the box, it really doesn't matter what else you do. You need to clean the box.

share|improve this answer
add comment

IP is an addressing mechanism that sits at layer 3 of the OSI model. By definition, the only way you can "sniff" these packets is if you lie in the path of the router itself.

So you can successfully sniff packets on your LAN as long as you are on a broadcast medium such as certain ethernet topologies or wifi without directional security capabilities. Unless you are sitting at a core router in a telecommunication facility or you successfully introduce routes into the Internet, you have no chance to capture random packets across multiple networks.

The linked story here is interesting in that it shows how dynamic these routes are. The Internet is supposed to be tolerant to route failure so it is constantly shifting around. The ability to accidentally or maliciously create a core route does exist. You could essentially capture 100% of the traffic flowing over that route, which is not the same as capturing 100% of the specific packet stream. Individual IP packets can arrive along different routes. Once your packets leave your computer, they are subjected to the whims of the intermediate routers.

Always use encryption protocols such as SSL/TLS when you are given the option.

share|improve this answer
    
Layer 3. IP addressing is handled on the Network Layer, not the Transport Layer. I would edit, but I do not have the points yet. –  Joseph Kern Dec 11 '11 at 4:00
    
Thanks for pointing that out. Changed. –  logicalscope Dec 11 '11 at 7:00
add comment

I'm not certain exactly what your question is aiming at - if you mean, "Can a remote attacker see my LAN traffic just by monitoring the WAN port" the answer is no, unless they control that router or your router has been set up to broadcast everything (not normal)

As to your specifics:

what is the success rate, i mean by that how much percent of the packets you would capture?

You could capture 100% if you are in the path, but as @greg says, that path may move

What are the benefits of securing the local LAN if someone can capture all the packets from that LAN simply by sniffing the WAN connection?

They can't.

What are the ways to prevent that, and if there is a way to prevent the attacker to know my DNS queries and by that know to what web sites i am surfing.

If they are close, they can find out your DNS queries.

share|improve this answer
add comment

A way to capture remote traffic across the internet, when you're not on the same LAN as receiver or sender, is using BGP hijacking. Kapela and Pilosov gave a great presentation on this topic at Defcon 16: http://www.securitytube.net/video/173

The attack requires the attacker to have control over an AS. He can send false prefix announcements with favorable properties to his peers so that they will choose to route traffic for the victim via him. These announcements will propagate, and the attacker can capture a large portion of traffic (or even all) that was intended for his victim. To get the traffic delivered to the victim, the attacker needs to keep one of his peers 'clean' so he can hand the traffic off there.

The attack is complex and depends on a lot of factors. The internet is not a predictable place in terms of traffic flow. However, Kapela and Pilosov give a successful live demonstration of capturing traffic of the Defcon venue. Another famous example is Pakistan accidentally hijacking YouTube traffic in 2008 (http://www.circleid.com/posts/82258_pakistan_hijacks_youtube_closer_look). China has been accused of hijacking large portions of US internet traffic (http://bgpmon.net/blog/?p=282).

A way to secure against this is by using end-to-end encryption, like using SSL or IPSec. There are also some initiatives that attempt to make BGP more secure (SBGP, SOBGP).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.