blog.6admin.io
guest@6admin.io:~$
dns, kernel, nemesis, network, security

Nemesis: detecting a network sniffer

The previous article talked about forging packets with Nemesis . This one talks about the opposite side: detecting that someone on your network is listening to what they should not.

The problem

A network card in promiscuous mode accepts ALL frames, not only the ones addressed to its MAC. That is what lets tcpdump and Wireshark work and it is also what lets a sniffer read traffic not destined for it. On a switch, it should not pass (the switch routes by MAC), but if someone has tinkered with the switch or if there is a hub somewhere, it passes.

The detection

The subtlest point is a method for detecting promiscuous mode via packet forging with Nemesis. The principle: send a packet with a partially broadcast destination MAC (ff:ff:00:00:00:00) toward a target IP. A NIC in normal mode filters by MAC and rejects this frame: it is not its MAC, it is not the full broadcast (ff:ff:ff:ff:ff:ff), it is not a multicast group it joined. A NIC in promiscuous mode accepts ALL frames, including this one: the kernel processes it, the destination IP matches and the kernel responds.

# The ff:ff:00:00:00:00 MAC is the pivot of the test:
# enough ff to resemble broadcast, enough 00 to be filtered
# by a normal NIC
nemesis arp -S 192.168.1.100 -D 192.168.1.254 -H ff:ff:00:00:00:00

If the target station responds, it is in promiscuous mode. If it does not respond, its NIC filtered the frame at layer 2.

The “weight” of the partial broadcast MAC is the parameter: ff:ff:ff:00:00:00 passes through more cards than ff:ff:00:00:00:00 (some NICs process multicast based on high-order bits) and ff:ff:ff:ff:ff:fe is the edge case: one bit less than broadcast, exactly the boundary where some firmware decides to filter or not. By varying the number of ff bytes, you probe the exact depth of each card’s MAC filter.

The method is documented in the paper “Detection of Promiscuous Nodes Using ARP Packets” (securityfriday.com), which is the reference for the Nmap sniffer-detect script.

Complementary era methods:

  • ICMP broadcast MAC, unicast IP: an echo request to an existing IP but with a broadcast MAC. In normal mode, the NIC filters. In promiscuous mode, the kernel answers.
  • DNS callback: a reverse DNS query for a non-existent IP, sent with an incorrect MAC. The promiscuous card processes the packet, the kernel launches a DNS resolution and your DNS server logs the sniffer’s IP.
  • ARP watch: watch ARP responses and flag MACs answering for IPs that are not theirs.
  • Switch logs: managed switches show which port received how many frames that were not for it.

What it is worth

Honestly, on a modern switched network, promiscuous mode only sees broadcast and traffic destined for the sniffer’s own MAC, not other people’s traffic. Detection only has value in three cases: a network with hubs (rare in 2008 but still alive), a wifi network (where everything is broadcast by nature), or a compromised switch.

But it is an instructive exercise and knowing how to detect a sniffer is part of the kit. The network is a permanent cat-and-mouse game: tcpdump listens, Nemesis forges and detects. The two tools together form the complete diagnostic.