The Sniffers "network analyzer" ~ DepoTech

The first tools that allowed system administrators to analyze their networks and to locate a specific problem "ie d. indicate exactly where a problem is it is Sniffers.

These tools are also accessible to hackers follow the same procedure to monitor your network and steal all different types of data. This article defines what that a sniffer, explains its usefulness, risks present, vulnerable to sniffing services and finally, he said the most popular sniffers.

The term sniffer is more popular than other terms such as "protocol analyzer" and "network analyzer".

A sniffer is a program that can capture all packets on a local area network (LAN) and allows to edit their content. It can capture any information sent through a local network, and therefore show both the identity of users that their passwords sent by any service carrying clear data (unencrypted) such as Telnet, DNS, SMTP , POP3, FTP and HTTP.

If the data is not encrypted and if they go through the machine's network interface when running the sniffer, capture it and offers direct reading.
If you are among those who seek in the history of the Internet, you are absolutely wondered where the terminal had sniffed?

We first can color the operation of network sniffer like more:

one morning you wake up with a cough. You go to the doctor and you tell him that your airways are obstructed by I do not know what. His first instinct will be to listen with his stethoscope. Well here is the sniffer network administrator what the stethoscope doctor: simply indispensable.

However malicious use a network sniffer can be Subversive. To be clear take a network sniffer, and a way, you get to connect to a corporate network: there you can gather confidential data. ..

Who uses Sniffers and why?

* LAN / WAN administrators use sniffers to analyze network traffic
and contribute to determine where there is a network problem.

* A security administrator could use multiple sniffers,
strategically placed throughout the network, such as intrusion detection system.

* Sniffers are great for system administrators.

* They are also one of the most common tools that hackers use.

The cracker is going to install a client on the machine sniffed the B network, which will slowly recover and save all data routing and arriving on that network. It will detach all at the cracker's machine in the network A. The network B which in principle could not sniffing has become very accessible. The remote sniffing is always composed of a client and a server, the client is controlled by the server. To carry out such an attack, there is the tool 'rpcapd'.

Rpcapd is a demon (program running in the background) that captures traffic on a machine, it is able to send data to a salvaged sniffer such as Ethereal, which facilitates reading by differentiating frames and protocols. Note that it is useful to exclude traffic between local machine and the remote machine using the filters Ethereal.

→ This is an example where we exclude the host 192.168.50.25:

Here are examples of how an attacker with a sniffer can spy and gather confidential information from users of a network.

Retrieving login and password

Once the victim connects the POP3 server "mail server", the attacker recovers thanks to sniff the login / password.

The screens below show an example of how to obtain the login and user password using the software Cain:

The list of protocols that can sniff Cain with an FTP connection:

There are many points have not been addressed, such as:

The Network Intrusion Detection System (NIDS) also based on packet sniffing, or different methods of attack, hoping that I gave you a nod on this topic

Remember that the best support for this blog is to love and share our articles!

For more news, thank you for subscribe to the blog newsletter to its RSS feed. Please also have a look at Twitter, Google+ or Facebook for other news.