Transcript Remote Sniffer Detection

COEN 252
Computer Forensics
Remote Sniffer Detection
Sniffer Detection

On the Host



Look for capture files (typically big and growing).
Look for a promiscuous card.
Look for unauthorized connections or processes.
Rootkits can prevent sniffers from being
detected.
 On the Net
Traffic analysis
 Traffic injection (probing)
Much harder.

Network based Sniffer
Detection




Promiscuous mode detection
DNS tests.
Network latency tests.
Trapping
Network based Sniffer
Detection

NIC hardware addresses

NIC sets up different filters




Broadcast: receive all broadcast addresses
(with MAC ff:ff:ff:ff:ff:ff)
Multicast based on multicast address
All multicasts
Promiscuous: receive all packets.
Promiscuous mode detection


Each Network Interface Card (NIC) has
a unique Medium Access Control (MAC)
address.
Card in non-promiscuous mode only
catches packets with that MAC address.
MAC Promiscuous Mode
Detection




Send an echo request to the right IP
address but with wrong MAC address.
Only a NIC in promiscuous mode will
pick up something with a wrong MAC
address.
The “Echo Request” package is passed
up the stack to the IP layer.
IP layer answers it.
MAC detection
ARP Detection



Send an arp request with false MAC and
correct IP address.
Only promiscuous NIC will pick up
package.
Kernel sends ARP reply.
Software Filtering Based
Detection

Different OS implement filters
differently.

We can try:

Fake broadcasting messages:




FF:FF:FF:FF:FF:FF:FF:FE (Br47):
 Last bit missing
FF:FF:00:00:00:00:00:00 (BR16)
 Only first 16 bits are the same as for broadcast.
FF:00:00:00:00:00:00:00 (BR8)
F0:00:00:00:00:00:00:00 (BR4)
Software Filtering Based
Detection

Different OS implement filters differently.

We can try:

Fake multicasting messages:





01:00:00:00:00:00:00:00 (Gr)
 Only group-bit set.
01:00:5E:00:00:00:00:00 (M0)
 Multicast address zero is usually not used
01:00:5E:00:00:00:00:01 (M1)(assigned to all)
 Multicast address one should be received by all in the test
system
01:00:5E:00:00:00:00:02 (M2)(assigned to different set of nodes)
 Multicast address two should not be received by systems in
the test group.
01:00:5E:00:00:00:00:03 (M3)(not registered)
Software Filtering Based
Detection
Windows XP
WinME / 9x
Win2K/NT
Linux 2.4.x
Free BSD 5.0
B47
--
X
--
X
--
X
--
X
--
X
B16
--
X
--
X
X
X
--
X
--
X
B8
--
--
--
X
--
--
--
X
--
X
Gr
--
--
--
--
--
--
--
X
--
X
M0
--
--
--
--
--
--
--
X
--
X
M1
O
O
O
O
O
O
O
O
O
O
M2
--
--
--
--
--
--
--
X
--
X
M3
--
--
--
--
--
--
--
X
--
X
Response to various ARP requests.
Normal mode: left column, promiscuous mode: right column
O legal response, X illegal response, -- no response
Software Filtering Based
Detection

ARP requests to fake MAC addresses
can determine promiscuous cards in an
OS dependent manner.
Trabelsi, Rahmani, Kaouech, Frikha: Malicious Sniffing Systems
Detection Platform, SAINT ’04.
DNS Detection Technique


Password sniffers (or sniffers not in
stealth mode) generate network traffic.
Sniffers use reverse DNS lookup


Because they think they found a password
and want to know the system.
Because they want to provide the user with
the name of the machines.
DNS Detection Technique
Load Detection Technique



Sniffers are hard on the machine
resources.
Sniffer degrades performance when
there is a lot of network load.
Hence, generate lots of network load
and measure timing.
Load Detection Technique
Round Trip Time Measuring
Technique

Experiments show:



Round Trip Times show OS dependent
differences of 10% - 40% between normal
mode and promiscuous mode.
Allows reliable detection.
Using ICMP messages is less network load
dependent.
Bait Technique

Create telnet for a fake telnet server.
With lots of logins + passwords.
Sniffer takes bait.
Telnet attempts to non-existing server.

Works like a honey-pot.


