Packet Sniffing - By: Robert Thomson

Packet Sniffing can best be described as the process of using a software application for audio monitoring of one’s network device. The goal of sniffing is to locate interesting packets. The application monitors the device until it encounters a pack that meets certain conditions, at which point it saves it in a file. Most of the time, potentially interesting packets are those in which terms such as ‘login’ or ‘password’ are found. Sniffing requires one to purchase or encode a software application that is compatible with the interface design featured by your network’s operating system. Some of these designs include:

1. LLI: This interface was employed by SCO, and has been upgraded by using Data Link Provider Interface (DLPI) support technology when the corporation released its OpenServer V operating system.

2. Network Interface Tap (NIT): Sun implemented this interface, but later scrapped it in favor of the SunOS/Solaris system, which also uses DLPI support.

3. Ultrix Packet Filter: Ultrix Corporation maintained this prior to the advent of DLPI support for BPF systems.

4. DLPI: This technology is featured in the present versions of System V, as well as SunOS/Solaris products, Advanced Interactive Executive (AIX) systems, and Hewlett Packard Unix (HP/UX). Other systems that utilize this technology include Unixware, as well as both Irix and the Macintosh OS, and is partly supported by Digital Unix systems. The second and more recent version of this technology supports Ethernet, Token Ring, and Bisync protocols. In addition, it acts as a data-link protocol for Software Development Life Cycle (SDLC), Integrated Services Digital Network (ISDN), LAPD, and Token Bus, as well as Fiber Distributed Data Interface (FDDI), Carrier Sense Multiple Access/Collision Detection (CSMA/CD), and Link Access Protocol, Balanced (LAPB). Furthermore, the interface that is offered together with HP/UX offers support to IEEE network standards 802.3 and 802.5, as well as Fiber Distributed Data Interface (FDDI) and Fibre Channel.

5. Berkeley Packet Filter (BFP): This interface is used by Berkeley Software Distribution as well as Digital Unix. A library for BFP is accessible to Linux users. AIX systems can read, but not write to, BFP interfaces. It can be ported to both Solaris and Sun Operating Systems.

Packet Sniffing can best be described as the process of using a software application for audio monitoring of one’s network device. The goal of sniffing is to locate interesting packets. The application monitors the device until it encounters a pack that meets certain conditions, at which point it saves it in a file. Most of the time, potentially interesting packets are those in which terms such as ‘login’ or ‘password’ are found. Sniffing requires one to purchase or encode a software application

Sean Hinds writes on topics such as Packet Sniffer , Firewall and DMZ for The Tech FAQ.