detecting wireshark and ethereal

anyway to detect wireshark and ethereal users on a wireless network?

<(E-Mail Removed)> wrote:

> anyway to detect wireshark and ethereal users on a wireless network?

Send out a packet to a MAC address you know is not on the network. I
think an ARP packet or something like that - any packet that a card in
passive mode would normally respond to.

Here are two (Google) hits explaining in more detail how, along with
some of the exceptions:

<http://www.linuxjournal.com/article/5201>

<http://cns.tstc.edu/cpate/LINUX/Linux_How2/Sniffers.htm>

Unfortunately, Axel's advice only applies on an ethernet network. If
people are sniffing your traffic wirelessly (either via unencrypted
wireless, or comprimised WEP keys) they are likely using an
application like KISMET to collect the packet data. (this dumped
packet data can then be analyzed offline via Wireshark). KISMET does
not participate in the wireless network to collect packets, in essense
it represents a level of passivity that even Wireshark alone doesn't
match. Active arp/mac/latency probes on your part will elicit no
response from the KISMET user's wireless interface.

Your best defense as always is to:
* use WPA or WPA2 encryption at all sites you control
* At untrusted hotspots or where WPA is not available, handle all
truly sensitive data (bank, financial, corporate email) via SSL, TLS,
VPN, IPSEC, or SSH Tunnel
* Consider all wireless data you handle not protected by either of the
above measures as non-private, similar to a conversation in a crowded
room. Anyone genuinely interested will hear what you have to say or
may interrupt the conversation.

Good luck, friend!

Jesse Thompson, Systems Administrator
Webformix, Broadband Internet for Bend, Oregon
http://www.webformix.com/bend.html


On Sep 24, 11:11*am, hl...@hotmail.com (Axel Hammerschmidt) wrote:
> <genericprofil...@gmail.com> wrote:
> > anyway to detect wireshark and ethereal users on a wireless network?
>
> Send out a packet to a MAC address you know is not on the network. I
> think an ARP packet or something like that - any packet that a card in
> passive mode would normally respond to.
>
> Here are two (Google) hits explaining in more detail how, along with
> some of the exceptions:
>
> <http://www.linuxjournal.com/article/5201>
>
> <http://cns.tstc.edu/cpate/LINUX/Linux_How2/Sniffers.htm>