Understanding Network Sniffing and TCP Packets
Explore the world of network sniffing, packet sniffers, TCP packets, and different types of sniffing techniques. Learn about the information captured, the features of packet sniffers, and the essential elements of TCP packets in networking. Discover active and passive sniffing methods to safeguard your network against potential threats.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
BASIC SNIFFING GAME
PACKET SNIFFERS Host A Host B Router A Router B A packet sniffer is a software application that uses a network adapter card in promiscuous mode to capture all network packets. The following are the packet sniffer features: Packet sniffers exploit information passed in clear text. Protocols that pass information in the clear include the following: Telnet FTP SNMP POP Packet sniffers must be on the same collision domain.
TCP PACKETS Source + destination ports Sequence number (used to order packets) Acknowledgement number (used to verify packets are received)
TCP SEGMENT 0 4 10 16 19 24 31 Source Port Destination Port Sequence Number Acknowledgment Number Len Reserved Flags Window Checksum Urgent Pointer Options... Padding Data... Field Source Port Destination Port Sequence Number Acknowledgment # Len Flags Window Checksum Urgent Pointer Pointer to end of urgent data Options Special TCP options such as MSS and Window Scale Purpose Identifies originating application Identifies destination application Sequence number of first octet in the segment Sequence number of the next expected octet (if ACK flag set) Length of TCP header in 4 octet units TCP flags: SYN, FIN, RST, PSH, ACK, URG Number of octets from ACK that sender will accept Checksum of IP pseudo-header + TCP header + data You just need to know port numbers, seq and ack are added
SNIFFING TYPES Active Sniffing: Sniffing in the switch is active sniffing. A switch is a point to point network device. The switch regulates the flow of data between its ports by actively monitoring the MAC address on each port, which helps it pass data only to its intended target. In order to capture the traffic between target sniffers has to actively inject traffic into the LAN to enable sniffing of the traffic. This can be done in various ways. Passive Sniffing: This is the process of sniffing through the hub. Any traffic that is passing through the non-switched or unbridged network segment can be seen by all machines on that segment. Sniffers operate at the data link layer of the network. Any data sent across the LAN is actually sent to each and every machine connected to the LAN. This is called passive since sniffers placed by the attackers passively wait for the data to be sent and capture them. 5
PACKET SNIFFING What kinds of data can we get? Asked another way, what kind of information would be most useful to a malicious user? Answer: Anything in plain text Passwords are the most popular 15-441 Networks Fall 2002 6
PACKET SNIFFING How can we protect ourselves? SSH, not Telnet Many people at CMU still use Telnet and send their password in the clear (use PuTTY instead!) Now that I have told you this, please do not exploit this information Packet sniffing is, by the way, prohibited by Computing Services HTTP over SSL Especially when making purchases with credit cards! SFTP, not FTP Unless you reallydon t care about the password or data Can also use KerbFTP (download from MyAndrew) IPSec Provides network-layer confidentiality 15-441 Networks Fall 2002 7
DISCUSSION How to interpret data packet from network packet analyser? What are the risks of unencrypted data transmission?
