I have a simple wireless router to share the internet with single access username/password.
I was wondering if it is possible somehow to set packet encryption so that other people on the LAN cannot sniff them?
asked Apr 15, 2013 at 19:26
-
Wireless networks can always be sniffed - what matters is if they're encrypted or not.– cutrightjmApr 15, 2013 at 22:08
Add a comment
|
3 Answers
Low-level encryption, for arbitrary packets, is called a VPN. If your wireless router implements IPsec, you can use that. This will raise a few tricky questions, of course (key management, authentication...).
I doubt many home wireless routers know how to do IPsec natively (peruse the documentation of your own router), but some routers can be reflashed with an alternative firmware who can do it.
If you let hostile people physically plug in your home network, then you may have bigger problems to deal with. For instance wanton degradation by temporarily wiring an ethernet cable with 110V power...
Also, remember that the Internet at large is not a nice place. Encrypting your packets only on your home LAN will protect them against people plugged on that LAN, but only against them. If the data is sensitive, it should benefit from end-to-end protection. In simple words: use only HTTPS Web sites. And if you do, then you don't have to do anything special on the LAN.
answered Apr 15, 2013 at 19:35
-
Is the wired network encrypted in general? eg. If somebody connects to my internet cable outside my house. Apr 15, 2013 at 21:50
-
Ethernet is not inherently encrypted. For other network types, anything goes... especially for cable companies, who rarely disclose the nature of the protocols they run over the cable (they want to discourage rogue wiring). It is safest to assume that there is no protection unless you explicitly configured a VPN between the relevant machines.– Tom LeekApr 16, 2013 at 1:11
-
Sure they do, nearly all cable companies use the DOCSIS standard for network-over-cable. And the DOCSIS spec includes encryption (though I guess it's possible for a cable operator to not use the encryption capability): en.wikipedia.org/wiki/DOCSIS– JohnnyApr 16, 2013 at 21:52
-
"wanton degradation by temporarily wiring an ethernet cable with 110V power" Things like this keep me up at night...– NULLZApr 18, 2013 at 6:46
Encryption alone doesn't solve all of the problems posed by an attacker on a LAN. In practice if you do not trust the network, you should use a VPN to protect the trusted systems on the network.
Transport Layer Security (TLS) is the tool of choice.
I think when the asker said "LAN", he mean "Wifi LAN", not wired LAN.
If that's the case, using WPA with a shared password does give some protection against someone else on the same Wifi network from snooping the data of others on the network. Preferably using AES rather than TKIP
With some effort (see https://superuser.com/questions/156869/can-other-people-on-an-encrypted-wi-fi-ap-see-what-youre-doing ), it is possible to crack the WPA session keys and snoop the traffic of other users, so a determined hacker may be able to snoop your data, but if you're looking for protection against someone on the network casually listening in, WPA will give you that protection. But, as others have said, it gives you no protection from LAN users that are plugged into the router. Using a VPN would be a more secure solution and can help protect against someone snooping data on your WAN connection or at your ISP since your traffic would be encrypted all the way to your VPN server.
-
how would it be easier if the attacker had access to the physical internet wire? Apr 15, 2013 at 22:06
-
It depends on the particular Wifi router. You may be able to spoof a target's MAC address or flood the switches's MAC table to get it to broadcast all traffic on all ports, then you can watch the unencrypted traffic go by on the LAN port.– JohnnyApr 15, 2013 at 22:16