Packet Sniffer Mitigation
Host A \ Host B
Router A .V J Router B
The following techniques and tools can be used to mitigate sniffers:
• Authentication—A first option for defense against packet sniffers is to use strong authentication, such as one-time passwords.
• Switched infrastructure—Deploy a switched infrastructure to counter the use of packet sniffers in your environment.
• Antisniffer tools—Use these tools to employ software and hardware designed to detect the use of sniffers on a network.
• Cryptography—The most effective method for countering packet sniffers does not prevent or detect packet sniffers, but rather renders them irrelevant.
© 2003, Cisco Systems, Inc. All rights reserved. CSVPN 4.0—2-26
The following techniques and tools can be used to mitigate packet sniffers:
■ Authentication—Using strong authentication is a first-option for defense against packet sniffers. Strong authentication can be broadly defined as a method of authenticating users that cannot easily be circumvented. A common example of strong authentication is one-time passwords (OTPs).
An OTP is a type of two-factor authentication. Two-factor authentication involves using something you have combined with something you know. Automated teller machines (ATMs) use two-factor authentication. A customer needs both an ATM card and a personal identification number (PIN) to make transactions. With OTPs you need a PIN and your token card to authenticate to a device or software application. A token card is a hardware or software device that generates new, seemingly random, passwords at specified intervals (usually 60 seconds). A user combines that random password with a PIN to create a unique password that works only for one instance of authentication. If a hacker learns that password by using a packet sniffer, the information is useless because the password has already expired. Note that this mitigation technique is effective only against a sniffer implementation that is designed to grab passwords. Sniffers deployed to learn sensitive information (such as mail messages) will still be effective.
■ Switched infrastructure—This can be used to counter the use of packet sniffers in your network environment. For example, if an entire organization deploys switched Ethernet, hackers can gain access only to the traffic that flows on the specific port to which they connect. A switched infrastructure obviously does not eliminate the threat of packet sniffers, but it can greatly reduce their effectiveness.
Antisniffer tools—Employing software and hardware designed to detect the use of sniffers on a network. Such software and hardware does not completely eliminate the threat, but like many network security tools, they are part of the overall system. These so-called "antisniffers" detect changes in the response time of hosts to determine if the hosts are processing more traffic than their own. One such network security software tool, which is available from Security Software Technologies, is called AntiSniff.
Cryptography—Rendering packet sniffers irrelevant, which is the most effective method for countering packet sniffers—even more effective than preventing or detecting packet sniffers. If a communication channel is cryptographically secure, the only data a packet sniffer will detect is cipher text (a seemingly random string of bits) and not the original message. The Cisco deployment of network-level cryptography is based on IPSec, which is a standard method for networking devices to communicate privately using IP. Other cryptographic protocols for network management include Secure Shell Protocol (SSH) and Secure Sockets Layer (SSL).
Continue reading here: Trust Exploitation
Was this article helpful?
Readers' Questions
-
Alem5 months ago
- Reply
-
sebastian6 months ago
- Reply
-
satu6 months ago
- Reply
-
rosario6 months ago
- Reply
-
BETTY7 months ago
- Reply
-
Sara7 months ago
- Reply
-
aran7 months ago
- Reply
-
sampsa7 months ago
- Reply
-
aristide7 months ago
- Reply
-
paola7 months ago
- Reply
-
FREDDIE7 months ago
- Reply
-
virgilio8 months ago
- Reply
-
ferdinand sackville-baggins8 months ago
- Reply
-
sebastian8 months ago
- Reply