Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is it possible to crash a packet sniffer through a specially-formed packet to stop website administrators from tracking down the source? If it is possible, has it been done before? Or is it just not an effective method of attack that nobody tried to do so?
I know that a huge amount of packets can crash a packet sniffer, but that won't stop a determined administrator from finding the first packet from the attack.
You have to know what software the administrators are using to sniff the packets, additionally you have to know a vulnerability that is capable of crashing the application.
If these requirements apply, the answer to your question is yes.
For reference, take a look at past wireshark vulnerabilitys: https://www.cvedetails.com/vulnerability-list/vendor_id-4861/cvssscoremin-9/cvssscoremax-/Wireshark.html
It is absolutely possible. Not only crashing, but arbitrary code execution is possible. The popular tcpdump tool has had more remote code execution vulnerabilities than we can count. And yes, vulnerabilities that allow for crashing the packet sniffing utility are also quite common. You should never run a packet sniffer on a sensitive system of you suspect an intelligent attacker with access to your network will be targeting you.
