Threat | Sniffers

• Capture all the packets on a LAN (or WAN) segment

  • Normally, NIC ignores all packets except the ones addressed to specific machine
  • NIC in promiscuous mode processes every packet
  • Difficult to detect when purely passive
    • Have to cut TX-line or configure very carefully so sniffer system doesn’t respond to anything

• Used maliciously to

  • Capture passwords
  • Obtain credit card numbers, etc.

• Used legitimately

  • To diagnose difficult network problems
  • By intrusion detection systems