How does a Packet Sniffer work ?

[eeeboy]

I have used some packet sniffer softwares which captured packet transmitting through my LAN. But I dont know many thing about this.

How does this work ? Is this only working for HUBs ?[ i mean can work in networks which are linked by HUBs not by switches?]

Whats the way to proetct my self from sniffers ? [because , I find it very risky and dangerous,anyone can sniff my passwords,chatlogs and browsing and other protocol requests].

I guess, I will get my ans soon here

Thanx in Advance.

[Will.Spencer]

Most of the time, your Ethernet card will only "listen" for frames addresses to it.

A packet sniffer will put your ethernet card into promiscuous mode, where it will listen to all frames on the wire -- no matter who they are addressed to.

Packet sniffing works best on a shared-medium such as a hub. To do packet sniffing on a switch, you have to configure port spanning, which copies traffic from one port to another.

The way to protect yourself from sniffers is end-to-end encryption. For example, I encrypt my login sessions with SSH, my AIM sessions with Trillian, and my web sessions with HTTPS.

The ultimate end-to-end encryption is to build a VPN between yourself and the remote system to which you are communicating.

[eeeboy]

About Encryption,I can understand first 2 points,But what about https ?

can I make https connection with any site I wish ? How can I do that ? And relevantly one more question, is there any way to bypass any https connection [ actually , I have an blog in wordpress.They always take to https connections whenever I want to post a new blog or edit my blog settings.But https is sometimes a pain because of slow connection]

More things I need to know ... and again thanx in Advance

[Will.Spencer]

You can only make an HTTPS connection with web sites which support HTTPS. End-to-end encryption requires cooperation from both ends.

Bypassing HTTPS is allowed or not, depending upon how the web server is configured.

[eeeboy]

Would please tell more about port spanning ?

and can you name any good sniffer for *NIX platform ?

[Will.Spencer]

Originally Posted by eeeboy

Would please tell more about port spanning ?

Read this Brief Description of SPAN from Cisco.

Originally Posted by eeeboy

and can you name any good sniffer for *NIX platform ?

Those are listed in the FAQ What is a packet sniffer?

[eeeboy]

I guess , in a switch based network , to capture packet , port spanning is to be enabled by my Network administrator. But if they haven't enabled switch for spanning [and consequently I cant capture packets!! ] , how can I capture them ?

I mean is there any way to bypass this spanning thingie or any alternative way to make port spanning enabled by myself ?

another Q: is there any way to capture packet in a real ip network ? I mean , in irc networks , we are in a open network. We all are connected to a single network with our real ip. Is this possible that , I can capture data from all other clients to that irc network servers ?

thanx in advance.

regards

eeeboy.

[Will.Spencer]

Originally Posted by eeeboy

I mean is there any way to bypass this spanning thingie or any alternative way to make port spanning enabled by myself?

Switches are designed so that is impossible.

Of course, there may be undocumented flaws in a design which could be discovered and expolited...

Originally Posted by eeeboy

I mean , in irc networks , we are in a open network. We all are connected to a single network with our real ip. Is this possible that , I can capture data from all other clients to that irc network servers?

You would need to install a packet sniffer on the IRC server itself, or on another computer in the same shared network as the IRC server.