Sniffing In Ethical Hacking (Cyber Security).pptx

Sniffing In Ethical Hacking Explained

1. SNIFFING Class : III B.Sc Cyber Security Subject : Ethical Hacking Subject Code : XCI503B Presented By Mr. S.Vignesh (AP/CS) Department of Computer Science

2. What is Sniffing ? Process of monitoring and capturing network data. Uses sniffers (software tools) Requires NIC in promiscuous mode to capture all packets

3. TYPES OF SNIFFING Passive sniffing : On hubs (outdated now). Captures all traffic in a collision domain. Hub : Send to All Devices Active sniffing : On switched networks Uses techniques like ARP spoofing or port mirroring (SPAN) Switch : Send by address

4. Port Mirroring / SPAN SPAN (Switched Port Analyzer) = P ort M irroring. Forwards all switch traffic to a designated port Useful for sniffers & IDS tools (e.g., Snort )

5. Tools for Sniffing Range from free to <$1,000 Wireshark → most popular open-source sniffer Other tools : RSA NetWitness → deep packet inspection OmniPeek → commercial sniffer with GUI Dsniff suite → includes Filesnarf , Mailsnarf , Urlsnarf , Webspy TCPdump → command-line Linux sniffer WinDump → Windows port of TCPdump

6. Wireshark Features Views of captured traffic : Summary view → one-line-per-packet Detail view → expand packet fields Hex view → raw packet data in hex

7. Filters: Capture filters → define traffic before capture (e.g., HTTP only) Display filters → refine results after capture Example: ip.addr ==192.168.123.1 arp , http, icmp tcp.port ==23 tcp.flags.reset ==1

8. SNIFFING COUNTERMEASURES Static ARP entries (not feasible on large networks) Port security → restricts allowed MAC addresses per port Dynamic ARP Inspection (DAI) → validates ARP packets (Cisco feature) IP Source Guard → prevents IP spoofing on untrusted Layer 2 ports DNSSEC (RFC 4035) → digitally signs DNS replies to prevent DNS spoofing

9. SPOOFING Spoofing is a technique where an attacker pretends to be someone or something else by falsifying data, with the goal of tricking systems or users into trusting them. It’s basically impersonation in the digital world .