I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
When you feel your local computer network is insecure, there are five main approaches.
- Ensure that your computer and the destination computer use encrypted network protocols. (e.g. IPSEC) This encrypts any and all traffic from your machine to the destination machine over the whole of it's journey.
- Establish an encrypted tunnel between your computer and a trusted network. (e.g. VPN). This encrypts any and all traffic from your machine to any destination over the untrusted part of it's journey.
- Use only applications that encrypt their communications. (e.g. HTTPS). This encrypts your communications with just that application over the whole journey.
- Encrypt sensitive files before sending them over the network. (e.g. zip them with AES enabled). This only works for the very specific scenario where you are sending discrete files.
- Don't use the network at all. (e.g. go home) This is safest and should be your default position. If your attackers can sniff, they may well be able to alter, and then you have to start worrying about Man-In-The-Middle.
Which to use depends on precisely what you are doing. If it's just "read my private gmail and do my online banking" then HTTPS should be enough, but if you want to hide all your private online activity then a VPN to home might be a better idea.
Lastly, bear in mind that your employer may not want you to be doing any of this. Apart from stopping you goofing of, some organisations want to read everything you send out of their network to ensure you are not leaking confidential information. So may try and block any and all of these, either by policy or with technical controls. Again, the safest method is to do your private stuff somewhere else.
A basic method of detecting and stopping a class of network interception attacks is managing your ARP table. Here are tools that provide ARP security:
- XArp: Advanced ARP spoofing detection, active probing and passive checks. Two user interfaces: normal view with predefined security levels, pro view with per-interface configuration of detection modules and active validation. Windows and Linux, GUI-based.
- ArpON: Portable handler daemon for securing ARP against spoofing, cache poisoning or poison - routing attacks in static, dynamic and hybrid networks.
- Antidote: Linux daemon, monitors mappings, unusually large number of ARP packets.
- Arp_Antidote: Linux Kernel Patch for 2.4.18 - 2.4.20, watches mappings, can define action to take when.
- Arpalert: Predefined list of allowed MAC addresses, alert if MAC that is not in list.
- Arpwatch/ArpwatchNG/Winarpwatch: Keep mappings of IP-MAC pairs, report changes via Syslog, Email.
- Prelude IDS: ArpSpoof plugin, basic checks on addresses.
- Snort: Snort preprocessor Arpspoof, performs basic checks on addresses
I feel you need to provide more details. On one level, you suggest your environment is one in which packet sniffing can be done, but then ask how this is done. How do you know you are working in an environment which is vulnerable if you don't know how this can be done?
The type of environment has some baring on what you can do and what you need to do. For example, if you feel you are at risk becase you are connecting to the network over wireless, then using 802.x, based security may be enough. If you are concerned because you are using a public wired network in a library or internet cafe etc, then perhapse ensuring all outgoing connections are encrypted with ssl, ssh etc may be sufficient. On the other hand, if you are concerned about a remote network you need to access, the answer may be VPN. If on the other hand you feel your home network is at risk, you may only need to make some minor changes to your router/modem to get sufficient protection.
In addition to the environment, it is also important to consider the data you are concerned about. For example, if you are talking about your email messages, then the real issue may be whether email is the right communication channel to use and the solution may be as simple as just encrypting files before sending them. On the other hand, if you are involved in multi-million dollare stock trades, the requirements may be much higher.
Security is not an absolute. You can never be 100% 'secure'. All you can do is try to understand what the risks are and apply reasonable measures to mitigate them. I'm assuming that is what has prompted your question. Unfortunately, there is not sufficient information to provide any real non-generic advice past "use encryption" answers, which may not actually be correct. Failing to get the right balance will mean that things become harder and more inconvenient to do while not actually providing you with any real benefit.