Building an Automated Security Monitor

Abstract

In a local network, the act of sniffing has been a big threat. Today, most network users and administrators believe that sniffing is a threat in hub-based networks, but it is no more a threat in switched networks. Because, in a hub-based network, any packet sent to a host will be received by all network's hosts, sniffing can be easily performed. However, in a switched network, any packet sent to a host will be received only by the destination host, unless it is a broadcast packet. Therefore, sniffing seems impossible in switched networks. This article shows that there are several ways that sniffing can be performed in switched networks. The man-in-the-middle (MiM) attack is a key step in the process of preparing a sniffing activity in a switched network.