Ethical Hacking Sniffing Syllabus

Which filter language do both tcpdump and Wireshark capture filters use?

Berkeley Packet Filter (BPF) syntax.

Write a tcpdump filter expression that captures only traffic to or from host 10.0.0.5 on port 80.

$\texttt{host 10.0.0.5 and port 80}$

What does the tcpdump flag -n do?

It disables name resolution, printing numeric IP addresses and port numbers instead of resolving them to hostnames and service names, which speeds up output and avoids DNS lookups.

What is Ettercap?

Ettercap is a free, open-source comprehensive suite for man-in-the-middle attacks on LANs, supporting sniffing of live connections, content filtering, and active/passive dissection of many protocols including ARP poisoning.

Name two core capabilities of Ettercap beyond simple packet capture.

ARP poisoning (to place itself as MITM on a switched LAN) and on-the-fly content filtering/injection or credential harvesting from dissected protocols; it also supports DNS spoofing via plugins.

What is the fundamental countermeasure against sniffing attacks?

Encryption of data in transit, so that even if packets are captured, their contents are unreadable ciphertext without the key.

Why does encryption defeat the goal of a sniffing attack?

Sniffing captures raw packets; if the payload is encrypted, the attacker sees only ciphertext and cannot recover plaintext credentials or data without the decryption key, so interception yields no usable information.

Which secure protocols replace their cleartext counterparts to prevent credential sniffing?

HTTPS (TLS) replaces HTTP, SSH replaces Telnet, SFTP/FTPS replace FTP, and IMAPS/POP3S/SMTPS replace their unencrypted mail equivalents.

What is the difference between symmetric and asymmetric encryption used to protect network traffic?

Symmetric encryption uses a single shared secret key for both encryption and decryption (fast, e.g., AES). Asymmetric encryption uses a public/private key pair (e.g., RSA) and is used for key exchange and authentication; TLS combines both.

What does TLS provide that raw TCP does not, relevant to sniffing defense?

Confidentiality (encryption), integrity (message authentication codes), and authentication (certificates) of the transmitted data, so captured packets cannot be read or undetectably modified.

What is network segmentation as a defense against sniffing?

Network segmentation divides a network into smaller isolated segments (e.g., via VLANs, subnets, or firewalls) so that traffic in one segment is not visible to hosts in another, limiting the scope a sniffer can observe.

How do VLANs help mitigate sniffing?

VLANs logically separate broadcast domains on a switch, so hosts in one VLAN cannot receive broadcast/ARP traffic or (without a router) reach hosts in another VLAN, reducing the attack surface for ARP poisoning and passive sniffing.

Why does replacing hubs with switches reduce passive sniffing risk?

A hub broadcasts every frame to all ports (so any host can passively sniff all traffic), while a switch forwards unicast frames only to the destination port, so passive sniffing captures only the attacker's own and broadcast traffic.

What is an Intrusion Detection System (IDS)?

An IDS is a device or software that monitors network or system activity for malicious behavior or policy violations and generates alerts when suspicious activity, such as sniffing-related attacks, is detected.

What is the key difference between an IDS and an IPS?

An IDS (Intrusion Detection System) only detects and alerts on suspicious activity (passive/out-of-band), while an IPS (Intrusion Prevention System) sits inline and can actively block or drop malicious traffic in real time.

What are the two primary detection methodologies used by intrusion detection systems?

Signature-based (misuse) detection, which matches traffic against known attack patterns, and anomaly-based detection, which flags deviations from an established baseline of normal behavior.

Compare signature-based and anomaly-based IDS detection in terms of unknown attacks.

Signature-based detection cannot catch novel (zero-day) attacks lacking a signature but has low false positives; anomaly-based detection can catch unknown attacks by flagging deviations from baseline but tends to produce more false positives.

How can an IDS/network monitoring detect ARP poisoning used for active sniffing?

By detecting anomalies such as multiple IP addresses mapping to one MAC, duplicate or changing MAC-to-IP bindings, and a flood of gratuitous ARP replies, which tools like arpwatch and IDS signatures flag.

What is the difference between a NIDS and a HIDS?

A NIDS (Network-based IDS) monitors traffic on network segments via a sensor/tap, while a HIDS (Host-based IDS) runs on an individual host and monitors that system's logs, files, and activity.

How can a host in promiscuous mode potentially be detected on a network?

Detection techniques include the ARP test (sending a request to a nonexistent MAC to which only promiscuous NICs may respond), abnormal latency/ping tests with crafted MACs, and DNS reverse-lookup tests, since promiscuous NICs process frames non-promiscuous ones ignore.

Which protocols commonly transmit credentials in cleartext, making them prime sniffing targets?

Telnet, FTP, HTTP, POP3, IMAP, SMTP, and SNMPv1/v2 all transmit data (and often credentials) in plaintext, making them highly vulnerable to sniffing.

What is a SPAN port (port mirroring) and how does it relate to sniffing/monitoring?

A SPAN (Switched Port Analyzer) port, or port mirror, copies traffic from one or more switch ports to a designated monitoring port. It is used legitimately by IDS/analyzers and can also be abused to sniff traffic on a switch.

What is a network tap and how does it differ from a SPAN port?

A network tap is a dedicated hardware device inserted inline on a link that copies all traffic to a monitoring port without loss. Unlike a SPAN port, it does not consume switch resources and does not drop packets under heavy load, providing a full, reliable copy.

What is DNS spoofing in the context of a sniffing/MITM attack?

DNS spoofing (DNS cache poisoning) supplies forged DNS responses so a victim resolves a hostname to an attacker-controlled IP, redirecting traffic to the attacker where it can be sniffed or manipulated.

What is a man-in-the-middle (MITM) attack and how does it enable sniffing on switched networks?

In a MITM attack the attacker secretly positions itself between two communicating parties (e.g., via ARP poisoning) so all traffic flows through the attacker, allowing them to sniff, and potentially alter, the data on an otherwise switched network.

What is a .pcap file?

A .pcap (packet capture) file is the standard binary file format, defined by libpcap, that stores captured network packets along with metadata (timestamps, lengths) for later analysis in tools like Wireshark or tcpdump.

What is the modern successor to the classic .pcap format used by Wireshark?

PCAPNG (.pcapng, PCAP Next Generation), which supports multiple interfaces, richer metadata, comments, and enhanced timestamps, and is now Wireshark's default capture format.

Give an example of how DHCP snooping mitigates active sniffing attacks.

DHCP snooping is a switch feature that builds a trusted binding table of legitimate IP-to-MAC-to-port mappings and blocks rogue DHCP servers; combined with Dynamic ARP Inspection it drops forged ARP packets, defeating ARP poisoning used for sniffing.

What is Dynamic ARP Inspection (DAI) and which attack does it counter?

Dynamic ARP Inspection is a switch security feature that validates ARP packets against the DHCP snooping binding table and drops invalid IP-to-MAC mappings, countering ARP spoofing/poisoning used to enable man-in-the-middle sniffing.

Why is a fully switched network with encryption and Dynamic ARP Inspection considered strong defense-in-depth against sniffing?

Switching limits which traffic a host can see, DAI/DHCP snooping prevent the ARP poisoning needed for active sniffing/MITM, and end-to-end encryption ensures that any packets that are captured remain unreadable ciphertext, so multiple layers must fail for an attack to succeed.