Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.



Published on

How to sniff data using wireshark

Published in: Technology
  • Be the first to comment

  • Be the first to like this


  1. 1. Mustajar Ahmad Shah
  2. 2. • Introduction • What is sniffer • Sniffing Threats • How a sniffer Work • Type of Sniffing • Protocol vulnerable to sniffing • Tools to Sniff Network Traffic • How to setup a Sniffing Attack • How to protect your self from Sniffing • Tools to detect sniffer on a network
  3. 3. Wire tapping is process of monitoring the Telephone and Internet conversation by third party. Type of Wiretapping
  4. 4. A Sniffer is a packet-capturing or frame-capturing tool. It basically captures and displays the data as it is being transmitted from host to host on the network.
  5. 5. A Sniffer turns the NIC of a system into Promiscuous(pro-mis-cu-os) mode so that it listen all the data transmitted on its segment. Sniffer can constantly Read all the information entering to the computer through NIC by Decoding the Information encapsulated in Data Packet.
  6. 6. There are Two types of Sniffing Attack Active Sniffing Passive Sniffing
  7. 7. “Passive Sniffing “mean sniffing trough a Hub. Passive Sniffing Involves sending no packets, and Monitoring the Packets sent by others. But Hub Usage is Outdated today.
  8. 8. When Sniffing is performed on a Switched network, is known as “Active Sniffing”. Active Sniffing Relies on Injecting Packets (ARP) into the Network, that Cause traffic.
  9. 9. Telnet and Rlogin HTTP SMTP NNTP POP FTP IMAP Keystrokes including User Name & Passwords Data sent in clear text Password and data sent in clear text Password and data sent in clear text
  10. 10. SPAN Port is Port which is configure to Receive a Copy of Every Packet that passes through a Switch
  11. 11. Sniffing Tools WireShark TCP Dump Cain & Able Capsa
  12. 12. Restrict the physical access to the network media to ensure that a packet sniffer cannot be installed Use Encryption to protect confidential information Permanently Add MAC address of the Gateway to ARP cache Use static IP Address and Static ARP tables to prevent attacker from adding the spoofed ARP entries for machines in the network
  13. 13. Turn off network identification broadcasts and if possible restrict the network to authorized users in order to protect network form being with sniffing tools Use UPv6 instead of IPv4 protocol Use encrypted session such as SSJ instead of Telnet, Secure Copy (SCP) instead of FTP, SSL for E-mail connection, etc. to protect wireless network users against sniffing attack.
  14. 14. Use Network Tools Such as HP Performance insight to monitor the network for strange Packets Use IDS Detect Promiscuous Mode