Capture Network Traffic

• Each message has a sender and a recipient.
  • Ethernet delivers messages to all computers on a network.
  • Only the recipient retrieves and reads the message from the network.

• Most network cards can be put into promiscuous mode.
  • A promiscuous network card can retrieve and read all messages that pass over the network to which it is connected.
  • Normally only root can make a device promiscuous.

• Packet sniffers listen on promiscuous devices.
  • Many software packages can do this.
    • Ethereal
    • tcpdump
  • Packet sniffers can be selective about which messages they display.

What about encrypting information?

---

---

© 2006 John Michael Pierobon

Notes