Download Lecture 23: Port Scanning, Vulnerability Scanning, Packet Sniffing

23.10: Packet Sniffing
• A packet sniffer is a passive device (as opposed to a port or vulnerability scanners that by their nature are “active” systems).
• Packet sniffers are more formally known as network analyzers
and protocol analyzers.
• The name network analyzer is justified by the fact that you
can use a packet sniffer to localize a problem in a network. As an
example, suppose that a packet sniffer says that the packets are
indeed being put on the wire by the different hosts. Now if the
network interface on a particular host is not seeing the packets,
you can be a bit more sure that the problem may be with the
network interface in question.
• The name protocol analyzer is justified by the fact that a
packet sniffer could look inside the packets for a given service
(especially the packets exchanged during handshaking and other
such negotiations) and make sure that the packet composition is
as specified in the RFC document for that service protocol.
31