2

This question already has an answer here:

I read in another post that wired traffic is not protected:

The only real additional threat that a malicious network administrator would pose, is that they have access to the wired side of the network also. On the wire, traffic is not protected by the same encryption (WEP/WPA/WPA2) that applies to the wireless connection. Anyone on the wire could then sniff your traffic as if it had been sent across an open (unprotected) network on the air.

If this is true, how would I know if someone is "on the wire?" I am referring to my laptop being plugged into my cable modem via ethernet cable and my apartment being a massive hotspot of wifi and ethernet. Can someone still snoop my connection if they are not physically connected to my modem?

marked as duplicate by schroeder, Iszi, Mark, Stephane, Rory Alsop Jun 23 '15 at 11:37

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

4

To clarify, your question is about detecting a passive sniffer on the wire. Therefore I will not discuss detection of much noisier ARP spoofing MitM attacks.

Since a passive sniffer only "reads" packets without responding or modifying them, these is virtually no way to detect it. However, if you know the Ethernet cable length to your next hop, you can measure the distance using either hardware or the cable diagnostic testing software that is packaged with most modern network drivers. If the sniffer is beyond the next physical hop (beyond the uplink port of the access switch you connect to), then this technique is useless.

In the future, we may use quantum communications to ensure privacy on both ends of a link. A sniffer would have to both measure and observe the state of qubits traversing a link, which is impossible according to the Heisenberg Uncertainty Principle. They would be unable to re-transmit the proper qubit states on egress of its sniffing device.

The current day countermeasure to communicating across potentially compromised links is using encryption. HTTPS, SSH, SFTP, etc. are all protocols utilizing encryption, meaning if they were sniffed on the wire their contents would be useless to the attacker. It would be a jumbled, unreadable mess.

  • If the wire and the switch are visible, a passive tap can be seen. So it's not undetectable. Anyone doing packet sniffing on another port and not doing ARP poisoning can only see his/her own traffic. A switch only routes traffic bound to it, not everyones traffic like a hub (which hasn't been in common use for 20 years) – Steve Sether Jun 23 '15 at 4:54
  • Except that many switches (especially home routers) includes a single broadcast port for diagnostic purposes meaning that for this one port the device is acting as a hub. – David Scholefield Jun 23 '15 at 6:15
  • I don't think I've ever seen a home router with such a port... – immibis Jun 23 '15 at 10:17
  • 1
    @armain The question is about a user being concerned about people intercepting traffic in his apartment building. That includes ARP poisoning. – Steve Sether Jun 23 '15 at 21:04
  • 1
    @user7149 If someone were able to get access to a machine in your network (a printer, a refrigerator connected to your network, a TV, etc), they could perform ARP poisoning and listen to traffic on your network. That's why people are concerned about all these unpatched devices, like a TV that can act as a platform for attackers to gain more access to your network. Thus a good reason to use SSL whenever possible. – Steve Sether Jun 23 '15 at 21:08
2

In an environment like an apartment building, the main threat would be ARP poisoning. There's a variety of tools to detect this threat, better covered in this SE question reply

The other, less likely attack scenario would be through a switch that supports dumping all traffic to a monitoring port. This would require a switch that supports this feature (generally more expensive managed switches), and administrative access to the switch. There's also commercially available taps that would allow someone with physical access to the switch to sniff traffic.

As far as detection goes, the physical taps could be seen on the switch. To detect monitor mode on a managed switch would require administrative access to the switch to see if it's enabled.

Not the answer you're looking for? Browse other questions tagged or ask your own question.