THE DETECTION AND PREVENTION OF SNIFFING ON NETWORKS

ABSTRACT

With the presence of some faults in online protocols and operating systems, any person who is connected to a network, especially in a Local Area Network (LAN) can fall victim to his information getting monitored by another person that is connected to the same network. Due to this problem at hand, an uninformed person can have his private information endangered to getting exposed to other unknown persons. Such act is called “Sniffing” and mostly occurs on networks. By sniffing the network, a user can gain access into confidential documents and invade into anyone’s privacy. This project tends to curb the problem by developing an application called “Encrypto AntiSniff”. Encrypto AntiSniff is a packet sniffer that captures and analyses network traffic in real time. Coupled with the network analysis, Encrypto AntiSniff is able to detect for network intrusion automatically by immediately highlighting a captured packet it suspects malicious activities to be taking place in with a red colour and performing encryption on that packet in order to render the attacker’s aim of acquiring information from that packet useless. Encrypto AntiSniff combines multiple Sniffer detection and Intrusion detection techniques in its algorithm for detecting sniffers in order to achieve a more accurate result. This application was developed using Netbeans Integrated Development Environment (IDE) in Java programming language with WinPcap and Jpcap APIs. At the end of development, the application passed all tests given, despite that, development will still continue for future enhancements.

CHAPTER 1: INTRODUCTION

1.1   OVERVIEW

Sniffing is a technique of monitoring network traffic. Network administrators use this technique with a program called a packet sniffer which would help them monitor a network, find faults in it, and know the necessary actions to take. However, it has a negative effect. A person can use this technique to acquire confidential information from another person’s computer when connected to the same network. Hence the need to curb this problem arises. In order to detect when one is sniffing your network, a packet sniffer is used which would monitor the network traffic and detect if someone is using another packet sniffer to acquire your personal information. The rest of this chapter talks about the background and motivation behind this topic, a proposed solution designed to curb the problem and why it is significant to develop this system.

 

1.2   BACKGROUND AND MOTIVATION

A Packet Sniffer is a program running in a network-attached device that inactively receives all data link layer frames that passes through the device’s network adapter. (Henry et al, 2019) noted that a packet sniffer is a software tool that is used in monitoring network activities which captures all the packets on the network without any regard of the final destination of the packet. It can also be called a Network/Protocol Analyzer. The packet sniffer records the data that is addressed to other computers, and will save it for future analysis. It can be used legitimately by a network or system administrator to monitor and troubleshoot network traffic (Fuentes, 2016). With the information that is captured by the packet sniffer, a system administrator can detect erroneous packets and then use the data to pinpoint illegitimate data, thereby helping to maintain a proficient network data transmission. The actual motif behind implementing Packet Sniffers was to provide security for computers that are connected to networks and also to monitor network traffic. However, as computer systems continue to evolve and provide benefits for mankind such as entertainment, ease of jobs, better research, good marketing, etc. there are still those who desire to use the computer system for crimes.

 

The act of sniffing has been a major string in local networks. Without any much effort, confidential documents, photos, passwords, anyone’s private information in general can be stolen by malicious users just by sniffing the network. Sniffing can be done simply by downloading a free sniffer software (packet sniffers) from the Internet and installing them into personal computers(Oluwabukola et al., 2013). Since Packet Sniffers do not interfere with the network traffic at all, the sniffing attack on a network are usually difficult to detect. System administrators are having tough times in detecting and dealing with sniffing attacks.

 

The driving force behind implementing another system that would detect and prevent sniffing attacks on network is to overcome the downsides of some already existing systems which would be discussed in chapter 2 and to provide a better user experience for system administrators when trying to detect and prevent sniffing on networks.

 

1.3   STATEMENT OF THE PROBLEM

Sniffing has been a long-standing problem in the networking environment. Sniffers can intercept and log traffic passing over a digital network or part of a network. Packets are captured by sniffers when the sniffers set the Network Interface Card (NIC) in promiscuous mode, the sniffers then proceed to decodes them. The decoded information can then be used in any aspect depending on the intention of the person behind the attack. With this, the person could commit common and very dangerous crimes such as the Identity Theft (Lisa, 2018). The affected would be framed victims for crimes they did not commit or use their private information like their names and details to acquire financial benefits. Depending on the structure of the network, an attacker can sniff some parts of or all of the traffic from a single computer within the network. In past cases, there have been records of loss of data, security card numbers getting compromised, unauthorized users accessing data, bank details being discovered etc. all due to sniffing attacks.

 

Sniffing attacks also occur at the hubs and switches. When a sniffer device is placed at the hub, all the network traffic can be captured directly by the sniffer. This implies that the sniffer can go undetected for a long period of time and spy on the network. It would also affect all connected devices.

1.4   AIM AND OBJECTIVES

This project is aimed at developing an application that will detect if a sniffer is running on a network and prevent the attacker from gaining any information from it. The following objectives were laid out in order to achieve the stated aim:

1. Find a more accurate and efficient method of detecting sniffers running on networks
2. Find a method of protecting the packet that a sniffer is being run on.

• Develop an application that will handle i and ii and also monitor network activities by capturing packets sent and received by the computer in a user friendly manner.

 

1.5   SIGNIFICANCE OF THE PROJECT

With the successful implementation of this project, important areas of our society like the academic areas, business areas, etc. would without a doubt benefit from this project due to the fact that connecting to networks in a local area is a common occurrence during our daily activities. Encrpyto AntiSniff would offer a better security to someone’s data and also help them tackle a sniffing attack before it gets to inflict much damage. This project also provides added functionality to related topics and thus creates more benefits and options to a wider community, especially scholars in the field of cloud security as it will serve as a reference point to them or a beginning point for better researches.

 

1.6   PROJECT RISKS ASSESSMENT

The Project Risk Assessment describes the occurrences that could possibly disrupt the workflow of this project and the possible precautions to be taken during such events.

 

 

 

 

Table 1 Project Risk Assessment Table

RISKS	PRECAUTIONS
Exams and Continuous Assessments can disrupt the work process of the project	Speed-up workflow to avoid clashes with other school related work and to finish on time
Software availability (Unavailability of API’s)	Alternative API’s will be checked for. Software requirements should also be identified at an early stage for possible contentious API’s
Loss of work due to equipment failure	Data should be backed up weekly to a hard drive and GIT HUB
Inability to carry out research due to loss of hardware/software resources	Be aware of and observe the school IT security procedures. Secure mobile phone when not in use
Inability to physically meet up with supervisors at regular times	Ensure to always reach out to your supervisors and meet up with them on Google Meet, in order to have a video conference call where ideas can be discussed.

 

1.7   SCOPE/PROJECT ORGANIZATION

The remaining parts of this project consists on a literature review of Detecting and Preventing Sniffing on Ethernet Networks, which would be treated exhaustively in chapter 2. The chapter 3 of this project consists of the requirements, which include: The Functional and Non-Functional Requirements. It also consists of the chosen methodology and a detailed description of the system designed involving the use of analyst tools. Finally, the last chapters of this project which are chapter 4 to chapter 5 consists of the *implementation, testing, conclusions, challenges and limitations, and recommended improvements for the system.

THE DETECTION AND PREVENTION OF SNIFFING ON NETWORKS

Sharing is caring!