In this lecture we'll talk about the packet sniffing or analyzing which are essentials when it comes to
networking in general and information security in particular. When someone who wants to send an email
or another piece of information on the network
that information is segmented and encapsulated into individual packets that are sent over the network.
Normally an end user does not see individual packets but the final application data like the web page
you are seeing right now. At the destination the network packets are and reassembled back into the complete
web page or email. Packet sniffing or packet analyzing is the process of capturing any packets passed
over at the local network and looking for any information that may be useful.
Most of the time system administrators use packets sniffing to troubleshoot network problems or to detect
intrusions or compromised workstations like a workstation that is connected to a remote machine and
is sending data continuously.
However black hat hackers could find creative ways to sniff packets using Men in the Middle (MiTM) Attack like
arp spoofing in order to steal sensitive data that is passed over the network.
When traffic is captured either the entire contents of the packets are recorded or just the headers.
Note that
most of the time packet sniffing is a passive technique.
The hacker is not attacking any computer, he’s just eavesdropping on the conversation the victim
has with its default gateway. To sniff traffic
someone has to use a spatial application called packet analyzer or packet sniffer that can intercept
and log traffic that passes over the network or a part of it.
There are many applications available but one of the most favourite is a free open source and multi-platform
application called Wireshark.
It works in graphical mode. There are also command line tools for sniffing packets, tshark and tcpdump
being among the most used ones. That was just a short introduction to packet sniffing and in the
next lectures will dive deeper into the applications that are used for packet sniffing and analysing.