Assuming you're working with an old network protocol, or insecure/unencrypted protocol (HTTP for example), is there a way to make it difficult for network sniffers from capturing the packets?

An MITM attack can be mitigated by using a SSH tunnel, but how to mitigate that if the attacker has access to one of the machines (assuming all he is capable of is packet sniffing)?

  • 2
    Not at all. If a machine is so much under the attackers control that running Wireshark as admin is no problem, then it's not your machine anymore. ... SSH, TLS and any other transport security thing are not meant to prevent such things in the first place. And if one evil host means the others might become evil too because they to what it says, then this is something you just need to change. Never trust the other side. – deviantfan Aug 10 '18 at 18:10
  • Welcome to the wonders of the OSI model. In short, no you cannot. – schroeder Aug 10 '18 at 19:08
  • Assuming the attacker can use only wireshark / tcpdump ... will he be able to sniff data if I use a local linux socket file and tunnel it through ssh to the endpoint ? – Ronan Dejhero Aug 11 '18 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.