Network Packet Capture FAQ

Version: 3.01
This Network Packet Capture FAQ will hopefully give administrators a clear understanding of packet capture problems and hopefully possible solutions to follow up with. Network packet capture is one of the main causes of mass break-ins on the Internet today.

This FAQ will be broken down into:

What network packet capture is and how it works

Unlike telephone circuits, computer networks are shared communication channels. It is simply too expensive to dedicate local loops to the switch (hub) for each pair of communicating computers. Sharing means that computers can receive information that was intended for other machines. To observe and appropriate the information going over the network is network packet capturing.

Most popular way of connecting computers is through ethernet. Ethernet protocol works by sending packet information to all the hosts on the same circuit. The packet header contains the proper address of the destination machine. Only the machine with the matching address is suppose to accept the packet. A machine that is accepting all packets, no matter what the packet header says, is said to be in promiscuous mode.

Because, in a normal networking environment, account and password information is passed along ethernet in clear-text, it is not hard for an intruder once they obtain root to put a machine into promiscuous mode and by capturing packets, compromise all the machines on the net.

Where are network packet capture applications available

Network packet capture is one of the most popular forms of attacks used by hackers. One special network capture program, called Esniff.c, is very small, designed to work on SunOS, and only captures the first 300 bytes of all telnet, ftp, and rlogin sessions. It was published in Phrack, one of the most widely read freely available underground hacking magazines. You can find Phrack on many FTP sites. Esniff.c is also available on many FTP sites such as coombs.anu.edu.au:/pub/net/log.

You may want to run Esniff.c on an authorized network to quickly see how effective it is in compromising local machines.

Other packet capture products that are widely available which are intended to debug network problems are:

Commercial packet capture applications are available at:

How to detect running packet capture utilities.

To detect a device that only collects data and does not respond to any of the information requires physically checking all your ethernet connections by walking around and checking the ethernet connections individually.

It is also impossible to remotely check by sending a packet or ping if a machine is capturing packets.

A packet capture utility running on a machine puts the interface into promiscuous mode, which accepts all the packets. On some Unix boxes, it is possible to detect a promiscuous interface. It is possible to run a capture utility in non-promiscuous mode, but it will only monitor sessions from the machine it is running on. It is also possible for the intruder to do similiar capture of sessions by trojaning many programs such as sh, telnet, rlogin, in.telnetd, and so on to write a log file of what the user did. They can easily watch the tty and kmem devices as well. These attacks will only compromise sessions coming from that one machine, while promiscuous packet capture compromises all sessions on the ethernet.

For SunOs, NetBSD, and other possible BSD derived Unix systems, there is a command

"ifconfig -a"
that will tell you information about all the interfaces and if they are in promiscuous mode. DEC OSF/1 and IRIX and possible other OSes require the device to be specified. One way to find out what interface is on the system, you can execute: 

# netstat -r

Routing tables

Internet:

Destination      Gateway            Flags     Refs     Use  Interface

default          iss.net            UG          1    24949  le0

localhost        localhost          UH          2       83  lo0
Then you can test for each interface by doing the following command: 

#ifconfig le0

le0: flags=8863<UP,BROADCAST,NOTRAILERS,RUNNING,PROMISC,MULTICAST>

        inet 127.0.0.1 netmask 0xffffff00 broadcast 255.0.0.1
Intruders often replace commands such as ifconfig to avoid detection. Make sure you verify its checksum.

There is a program called cpm available on ftp.cert.org:/pub/tools/cpm that only works on SunOS and is supposed to check the interface for promiscuous flag.

Ultrix can possibly detect someone running a packet capture utility by using the commands pfstat and pfconfig.

pfconfig allows you to set who can run a packet capture utility
pfstat shows you if the interface is in promiscuous mode.

These commands only work if packet capture is enabled by linking it into the kernel. By default, the utility is not linked into the kernel. Most other Unix systems, such as Irix, Solaris, SCO, etc, do not have any flags indication whether they are in promiscuous mode or not, therefore an intruder could be capturing your whole network and there is no way to detect it.

Often a capture utility log becomes so large that the file space is all used up. On a high volume network, a capture utility will create a large load on the machine. These sometimes trigger enough alarms that the administrator will discover the utility's presence. I highly suggest using lsof (LiSt Open Files) available from coast.cs.purdue.edu:/pub/Purdue/lsof for finding log files and finding programs that are accessing the packet device such as /dev/nit on SunOS.

There is no commands I know of to detect a promiscuous IBM PC compatible machine, but they at least usually do not allow command execution unless from the console, therefore remote intruders can not turn a PC machine into a packet capture device without inside assistance.

Stopping network packet capture attacks

Active hubs send to each system only packets intended for it rendering promiscuous packet capture useless. This is only effective for 10-Base T.

The following vendors have available active hubs:

Encryption

There are several packages out there that allow encryption between connections therefore an intruder could capture the data, but could not decypher it to make any use of it.

Some packages available are:

Kerberos

Kerberos is another package that encrypts account information going over the network. Some of its draw backs are that all the account information is held on one host and if that machine is compromised, the whole network is vulnerable. It is has been reported a major difficulty to set up. Kerberos comes with a stream-encrypting rlogind, and stream-encrypting telnetd is available. This prevents intruders from capturing what you did after you logged in.

There is a Kerberos FAQ at ftp at rtfm.mit.edu in /pub/usenet/comp.protocols/kerberos/Kerberos_Users__Frequently_Asked_Questions_1.11 or try: ftp://aeneas.mit.edu/pub/kerberos/doc/KERBEROS.FAQ

One time password technology

S/key and other one time password technology makes capturing account information almost useless. S/key concept is having your remote host already know a password that is not going to go over insecure channels and when you connect, you get a challenge. You take the challenge information and password and plug it into an algorithm which generates the response that should get the same answer if the password is the same on the both sides. Therefore the password never goes over the network, nor is the same challenge used twice. Unlike SecurID or SNK, with S/key you do not share a secret with the host. S/key is available on ftp:thumper.bellcore.com:/pub/nmh/skey

OPIE is the successor of Skey and is available at ftp://ftp.nrl.navy.mil/pub/security/nrl-opie/

Other one time password technology is card systems where each user gets a card that generates numbers that allow access to their account. Without the card, it is improbable to guess the numbers.

The following are companies that offer solutions that are provide better password authenication (ie, handheld password devices):


Secure Net Key (SNK)

Digital Pathways, Inc.
201 Ravendale Dr. Mountainview, Ca.
97703-5216 USA

Phone: 415-964-0707 Fax: (415) 961-7487


SecurID

Security Dynamics,
One Alewife Center
Cambridge, MA 02140-2312
USA Phone: 617-547-7820
Fax: (617) 354-8836
SecurID uses time slots as authenication rather than challenge/response.


ArKey and OneTime Pass

Management Analytics
PO Box 1480
Hudson, OH 44236
Email: fc@all.net
Tel:US+216-686-0090 Fax: US+216-686-0092

OneTime Pass (OTP):
This program provides unrestricted one-time pass codes on a user by user basis without any need for cryptographic protocols or hardware devices. The user takes a list of usable pass codes and scratches out each one as it is used. The system tracks usage, removing each passcode from the available list when it is used. Comes with a very small and fast password tester and password and pass phrase generation systems.

ArKey:
This is the original Argued Key system that mutually authenticates users and systems to each other based on their common knowledge. No hardware necessary. Comes with a very small and fast password tester and password and pass phrase generation systems.

WatchWord and WatchWord II

Racal-Guardata
480 Spring Park Place
Herndon, VA 22070
703-471-0892
1-800-521-6261 ext 217


CRYPTOCard

Arnold Consulting, Inc.
2530 Targhee Street, Madison, Wisconsin
53711-5491 U.S.A.
Phone : 608-278-7700 Fax: 608-278-7701
Email: Stephen.L.Arnold@Arnold.Com
CRYPTOCard is a modern, SecureID-sized, SNK-compatible device.


SafeWord

Enigma Logic, Inc.
2151 Salvio #301
Concord, CA 94520
510-827-5707 Fax: (510)827-2593
For information about Enigma ftp to: ftp.netcom.com in directory /pub/sa/safeword


Secure Computing Corporation:

2675 Long Lake Road
Roseville, MN 55113
Tel: (612) 628-2700
Fax: (612) 628-2701
debernar@sctc.com

Non-promiscuous Interfaces

You can try to make sure that most IBM DOS compatible machines have interfaces that will not allow packet capture. Here is a list of cards that do not support promiscuous mode:

Test the interface for promiscuous mode by using the Gobbler. If you find a interface that does do promiscuous mode and it is listed here, please e-mail cklaus@iss.net so I can remove it ASAP.

IBM Token-Ring Network PC Adapter
IBM Token-Ring Network PC Adapter II (short card)
IBM Token-Ring Network PC Adapter II (long card)
IBM Token-Ring Network 16/4 Adapter
IBM Token-Ring Network PC Adapter/A
IBM Token-Ring Network 16/4 Adapter/A
IBM Token-Ring Network 16/4 Busmaster Server Adapter/A
The following cards are rumoured to be unable to go into promiscuous mode, but that the veracity of those rumours is doubtful.
Microdyne (Excelan) EXOS 205
Microdyne (Excelan) EXOS 205T
Microdyne (Excelan) EXOS 205T/16
Hewlett-Packard 27250A EtherTwist PC LAN Adapter Card/8
Hewlett-Packard 27245A EtherTwist PC LAN Adapter Card/8
Hewlett-Packard 27247A EtherTwist PC LAN Adapter Card/16
Hewlett-Packard 27248A EtherTwist EISA PC LAN Adapter Card/32
HP 27247B EtherTwist Adapter Card/16 TP Plus
HP 27252A EtherTwist Adapter Card/16 TP Plus
HP J2405A EtherTwist PC LAN Adapter NC/16 TP
Adapters based upon the TROPIC chipset generally do not support promiscuous mode. The TROPIC chipset is used in IBM's Token Ring adapters such as the 16/4 adapter. Other vendors (notably 3Com) also supply TROPIC based adapters. TROPIC-based adapters do accept special EPROMs, however, that will allow them to go into promiscuous mode. However, when in promiscuous mode, these adapters will spit out a "Trace Tool Present" frame.