Thursday, June 17, 2010

How does a Packet Sniffer work

SkyHi @ Thursday, June 17, 2010
Most of the time, your Ethernet card will only "listen" for frames addresses to it.


A packet sniffer will put your ethernet card into promiscuous mode, where it will listen to all frames on the wire -- no matter who they are addressed to.


Packet sniffing works best on a shared-medium such as a hub. To do packet sniffing on a switch, you have to configure port spanning, which copies traffic from one port to another.


The way to protect yourself from sniffers is end-to-end encryption. For example, I encrypt my login sessions with SSH, my AIM sessions with Trillian, and my web sessions with HTTPS.


The ultimate end-to-end encryption is to build a VPN between yourself and the remote system to which you are communicating.


Read this Brief Description of SPAN from Cisco.

Those are listed in the FAQ What
is a packet sniffer?



REFERENCES
http://www.pc101.com/forum/f144/how-does-packet-sniffer-work-3396/