Question

What mechanisms are there to detect:

(a) Network sniffing

(b) Wiretapping ?

Answer 1

# Sniffing Detection :

Sniffer are  usually passive in nature , it basically collects data. Thus it becomes extremely difficult to detect sniffers. a sniffer does generate some small amount of traffic( When it is installed on a computer  ).

@ Ping Method: is used to send a ping request with the IP address of the machine(s) which are under suspection but not its MAC address.In an Ideal case nobody should see this packet . if the suspect(s) machine is running a sniffer it will definitely going to respond, because it does not care rejecting packets with a different Destination MAC address.

@ ARP Method: A machine caches ARP(s). So we need to send a non-broadcast ARP. A machine will cache your ARP address. Now we send a broadcast ping packet with our IP, but a different MAC address. a machine that has correct MAC address from our sniffed (ARP frame) will only be able to respond to our broadcast ping request and no one else.

@ Latency Method: In this method   huge amount of data is sent on the network and the suspect machine is pinged before and during the data flooding. If the machine is in ("promiscuous mode"), it will parse the data, " increasing the load on it".

@  ARP Watch: If there is duplication for a machine. It could trigger alarm(s) and lead to detection of sniffer(s). On network implementon of  DHCP, this could trigger many other false alarms. A basic change that can be made is the increase the DHCP lease time.

@ Using IDS: The Open Source IDS Snort for instance has an arp-spoof preprocessor that allows it to record packets on the network with spoofed ARP addresses. It compares the IP/MAC pairing it is given in the "snort.conf" file, against the pairing in the packet,which is flowing across the network. Whenever mismatch encountered , it generates an alert.

# Wiretap Detection :

@ An audio analysis can be done , testing wires for any indication of room audio.

@ Electrical and electronic properties must be monitored very carefully , voltage, capacitance, and other characteristics.

@ TDR and FDR equipment can be used - Time Domain and Frequency Domain Reflectometry which will display graphic analysis of wires under test to discover any wiretaps.

@ RF tracing tools can also be used that inject a radio signal onto the wires so they can then be traced .

@ Ethernet testing for pair analysis and proper network(s) configuration.