Re: A Solution for sniffing

Hey there,
I've only heard/read of ways to protect against attacks on switches (checking the arp tables for modifications or tampering), but not really much reliable info on doing stuff on hubs (like the last poster mentioned below, sending echo packets, etc) But generally, you will not be able to detect against a sniffer attack, since its very passive, as said below.

Some things that you can do to prevent people from viewing information coming to and from your computer are many of these basic steps that people neglect so often...

Keep your anti-virus updated (if any).
Keep a personal firewall (if possible) online. These two are your best bet if you're generally paranoid. A good example of a personal firewall would be ZoneAlarm for Windows, and under Linux using the iptables filtering suite, PF in BSD and possibly a secondary suite to supplement those. Encrypt your communications...PGP your e-mail, download instant messenging clients that can support good-grade encryption...etc

Some of these things don't necessarly mean that you won't be sniffed at and prodded at, but it will certaintly make you a harder target for most would-be sniffers.

If you're a sniffer, your machine should be as discreet as you want it to be :)

David

>From: "Shanon" <liquid_nitrogen79@hotmail.com>
>To: <Bruce.Orcutt@alltel.com>, <SMerrell@avbpgh.com>
>CC: <security-basics@securityfocus.com>
>Subject: Re: A Solution for sniffing
>Date: Sat, 21 Dec 2002 02:05:58 +0530
>
>
>Not only DNS, but IMO a lot things should not be run on the sniffer machine