Packet Sniffing

How does packet sniffing work?

A network is a collection of nodes, such as personal computers, servers, and networking hardware that are connected. The network connection allows data to be transferred between these devices. The connections can be physical with cables, or wireless with radio signals. Networks can also be a combination of both types.

As nodes send data across the network, each transmission is broken down into smaller pieces called packets. The defined length and shape allows the data packets to be checked for completeness and usability. Because a network’s infrastructure is common to many nodes, packets destined for different nodes will pass through numerous other nodes on the way to their destination. To ensure data is not mixed up, each packet is assigned an address that represents the intended destination of that packet.

A packet’s address is examined by each network adapter and connected device to determine what node the packet is destined for. Under normal operating conditions, if a node sees a packet that is not addressed to it, the node ignores that packet and its data.

Packet sniffing ignores this standard practice and collects all, or some of the packets, regardless of how they are addressed.

There are two main types of packet sniffers:

• Hardware Packet Sniffers
  A hardware packet sniffer is designed to be plugged into a network and to examine it. A hardware packet sniffer is particularly useful when attempting to see traffic of a specific network segment. By plugging directly into the physical network at the appropriate location, a hardware packet sniffer can ensure that no packets are lost due to filtering, routing, or other deliberate or inadvertent causes. A hardware packet sniffer either stores the collected packets or forwards them on to a collector that logs the data collected by the hardware packet sniffer for further analysis.
• Software Packet Sniffers
  Most packet sniffers these days are of the software variety. While any network interface attached to a network can receive every bit of network traffic that flows by, most are configured not to do so. A software packet sniffer changes this configuration so that the network interface passes all network traffic up the stack. This configuration is known as promiscuous mode for most network adapters. Once in promiscuous mode, the functionality of a packet sniffer becomes a matter of separating, reassembling, and logging all software packets that pass the interface, regardless of their destination addresses. Software packet sniffers collect all the traffic that flows through the physical network interface. That traffic is then logged and used according to the packet sniffing requirements of the software.

Capturing data on an entire network may take multiple packet sniffers. Because each collector can only collect the network traffic that is received by the network adapter, it may not be able to see traffic that exists on the other side of routers or switches. On wireless networks, most adapters are capable of connecting to only one channel at a time. In order to capture data on multiple network segments, or multiple wireless channels, a packet sniffer is needed on each segment of the network. Most network monitoring solutions provide packet sniffing as one of the functions of their monitoring agents.

What kind of information does packet sniffing gather?

Packet sniffing collects the entire packet of each network transmission. Packets that are not encrypted can be reassembled and read in their entirety. For example, intercepted packets from a user accessing a website would include the HTML and CSS of the web pages. Most notoriously, users logging in to network resources across unencrypted transmissions expose their username and password as plain text that can be seen in captured packets.

When should I consider using packet sniffing?

Packet sniffing has many practical uses. Typically, packet sniffing is used for network troubleshooting. Packets detected on a network they are not supposed to be in might suggest improper routing or switching. Packets marked for ports that do not match their protocol might also suggest a misconfiguration of one or more nodes. You can also analyze traffic and the responses received for requests. Does the node query the correct DHCP server? Does the correct DNS request get routed to the correct location? Is traffic encrypted with SSL or HTTPS when it should be, or are unencrypted responses being sent? Is the routing path taken by the packet the most efficient route to its final destination?

Packets can also be analyzed to see if a specific application is using too much bandwidth or if authentication is requiring numerous back-and-forth calls. Based on the data provided, you might upgrade communications, or troubleshoot applications to enhance the software performance.

You may use packet sniffing to monitor consumption trends on a network. Analysis of collected packets may show that a large amount of traffic is being used by a certain in-house application, or video transmissions. Also, a decline in traffic may suggest that specific resources are being used less.

Packet sniffing may be useful in increasing network security. When monitoring traffic for clear-text usernames and passwords, for example, you could notice possible security issues before any hacker. In addition, monitoring remote traffic can help ensure that all traffic is properly encrypted and not being sent out onto the open internet without encryption.