I would like to know if it is possible to detect if someone has tapped your network connection (eth cable).
If done properly, it may be undetectable without ISP help or manual verification of the link.
I would like to know if there are ways to detect a less than perfect tapping :)
If done properly, it may be undetectable without ISP help or manual verification of the link.
You mean without visual inspection. A bridge with the electronics to just move a packet to another port (basically switch in promiscous mode) would be impossible to detect if installed profesionally.
Eth you COULD try a cable length measurement system, if you know the original length.
I think it would be somewhat difficult, whether it was less then perfect or not. There are many ways to monitor and\or intercept network traffic.
For instance, I could insert a hub between your router and firewall (if I have physical access to the link in between the two), connect a laptop to the same hub, and monitor all of the traffic between the router and the firewall and I'm hard pressed to see how you could discover that without visually inspecting that link.
To detect a "less than perfect tapping, calculate your cat5e cables "Delay Skew", you should see a above normal delay skew if your cable has been tapped. Or you can check for crosstalk that is being generated by the tap, yet both methods will require you to purchase testing equipment.
Now for detecting a perfect passive tap implementation, it can be located using Near-End/Far-End High Frequency Cross-Talk TDR (Time-Domain Reflectometry) analysis. Such methods are required because the passive tap may be deployed at a far distance to prevent many detection methods. Yet if its a single cable and not a drop or a trunk line calculate your cables nominal velocity of propagation and compare it with the manufactures NVP specification for that cable.
That's a terrificly open-ended question. If you're asking to see if someone is physically accessing your cable, a physical check would really be the only way to be sure. Some ways to have an idea though would include packet sniffing and IP scanning. Other than that, you can monitor a managed switch above both connections to see what MAC addresses are connecting and restrict further connections by MAC address (although those could be cloned but would add a high level of difficulty if they can't access your hardware first).
If you want to get into this same question from the Wifi angle, it's a whole new can of worms.
If someone taps into your network using a passive tap the only way to detect it is using fairly sophisticated tools that can measure not just the load on the cable but can usually tell you how far from the test point something is connected. Of course very few of us would have access to such gear.
If someone connects using an active (normal connection) there are a multitude of ways of detecting it, mainly by monitoring traffic. Bear in mind that any active network device will send out broadcast packets, so they can still be detected even when you cannot see their point to point traffic. Many software tools take advantage of this (e.g. Fluke Network Inspector - old but still very useful).
The closest you're going to get on a typical home ISP link is to analyze the MAC addresses of your traffic, and if the gateway changes to something else it's a sign that something has changed on the network. That could be an eavesdropper, or it could be a simple equipment changeout.
However, if the snooping is happening beyond the gateway even a sloppy snooper will remain undetected. Also, if the snooper is using a simple bridge rather than an attack based on ARP-spoofing, the only indication of their presence will be a slightly higher latency; slight enough it'll hide in the statistical noise for most home broadband connections.
If the snooping is actually an intercept proxy of some kind (layer 5-7) instead of a network tap (L2), say sniffing all of your HTTP traffic but leaving the rest alone, there is a possibility that you can detect that by watching your HTTP headers. If their DNS settings are crappy you may find some sites unavailable that really should be.
And finally, stateful firewalls do exactly this kind of thing by design. Figuring out the difference between a stateful firewall and a snooper is very, very tricky.
In short, it is very hard to detect snoopers, even sloppy ones.
