How can I tell if my ethernet connection is being sniffed? [duplicate]

Question

I read in another post that wired traffic is not protected:

The only real additional threat that a malicious network administrator would pose, is that they have access to the wired side of the network also. On the wire, traffic is not protected by the same encryption (WEP/WPA/WPA2) that applies to the wireless connection. Anyone on the wire could then sniff your traffic as if it had been sent across an open (unprotected) network on the air.

If this is true, how would I know if someone is "on the wire?" I am referring to my laptop being plugged into my cable modem via ethernet cable and my apartment being a massive hotspot of wifi and ethernet. Can someone still snoop my connection if they are not physically connected to my modem?

Answer 1

To clarify, your question is about detecting a passive sniffer on the wire. Therefore I will not discuss detection of much noisier ARP spoofing MitM attacks.

Since a passive sniffer only "reads" packets without responding or modifying them, these is virtually no way to detect it. However, if you know the Ethernet cable length to your next hop, you can measure the distance using either hardware or the cable diagnostic testing software that is packaged with most modern network drivers. If the sniffer is beyond the next physical hop (beyond the uplink port of the access switch you connect to), then this technique is useless.

In the future, we may use quantum communications to ensure privacy on both ends of a link. A sniffer would have to both measure and observe the state of qubits traversing a link, which is impossible according to the Heisenberg Uncertainty Principle. They would be unable to re-transmit the proper qubit states on egress of its sniffing device.

The current day countermeasure to communicating across potentially compromised links is using encryption. HTTPS, SSH, SFTP, etc. are all protocols utilizing encryption, meaning if they were sniffed on the wire their contents would be useless to the attacker. It would be a jumbled, unreadable mess.

Answer 2

In an environment like an apartment building, the main threat would be ARP poisoning. There's a variety of tools to detect this threat, better covered in this SE question reply

The other, less likely attack scenario would be through a switch that supports dumping all traffic to a monitoring port. This would require a switch that supports this feature (generally more expensive managed switches), and administrative access to the switch. There's also commercially available taps that would allow someone with physical access to the switch to sniff traffic.

As far as detection goes, the physical taps could be seen on the switch. To detect monitor mode on a managed switch would require administrative access to the switch to see if it's enabled.