Thursday, June 17, 2010

How does a Packet Sniffer work

SkyHi @ Thursday, June 17, 2010
Most of the time, your Ethernet card will only "listen" for frames addresses to it.

A packet sniffer will put your ethernet card into promiscuous mode, where it will listen to all frames on the wire -- no matter who they are addressed to.

Packet sniffing works best on a shared-medium such as a hub. To do packet sniffing on a switch, you have to configure port spanning, which copies traffic from one port to another.

The way to protect yourself from sniffers is end-to-end encryption. For example, I encrypt my login sessions with SSH, my AIM sessions with Trillian, and my web sessions with HTTPS.

The ultimate end-to-end encryption is to build a VPN between yourself and the remote system to which you are communicating.

Read this Brief Description of SPAN from Cisco.

Those are listed in the FAQ What
is a packet sniffer?