Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to know if it is possible to detect if someone has tapped your network connection (eth cable).

If done properly, it may be undetectable without ISP help or manual verification of the link.

I would like to know if there are ways to detect a less than perfect tapping :)

share|improve this question
Encrypt your traffic end-to-end and don't worry about eavesdroppers. Assume the Internet is an untrusted public network because it is. – Evan Anderson Oct 28 '10 at 17:36
It's more likely that your ISP is helping the eavesdropper if this is a valid concern for you. – danlefree Oct 28 '10 at 18:17
@danlefree is right. Might not be personal, but that pipe should be thought of as hostile. – chiggsy Feb 14 '11 at 1:30
Define less than perfect tapping giving that every network equipment of the lat 10 years (switches, managed) can make copy ALL traffic to a specific port for the purpose of debugging. Here is your perfect tap on a 50USD 8 port low cost witch and upward. – TomTom May 20 '11 at 5:02
up vote 3 down vote accepted

If done properly, it may be undetectable without ISP help or manual verification of the link.

You mean without visual inspection. A bridge with the electronics to just move a packet to another port (basically switch in promiscous mode) would be impossible to detect if installed profesionally.

Eth you COULD try a cable length measurement system, if you know the original length.

share|improve this answer

I think it would be somewhat difficult, whether it was less then perfect or not. There are many ways to monitor and\or intercept network traffic.

For instance, I could insert a hub between your router and firewall (if I have physical access to the link in between the two), connect a laptop to the same hub, and monitor all of the traffic between the router and the firewall and I'm hard pressed to see how you could discover that without visually inspecting that link.

share|improve this answer
CALEA specifically mandates that all ISPs in the US are able to tap your Internet connection without the end user knowing. Most other countries have similar laws. – Chris S Oct 28 '10 at 19:37

To detect a "less than perfect tapping, calculate your cat5e cables "Delay Skew", you should see a above normal delay skew if your cable has been tapped. Or you can check for crosstalk that is being generated by the tap, yet both methods will require you to purchase testing equipment.

Now for detecting a perfect passive tap implementation, it can be located using Near-End/Far-End High Frequency Cross-Talk TDR (Time-Domain Reflectometry) analysis. Such methods are required because the passive tap may be deployed at a far distance to prevent many detection methods. Yet if its a single cable and not a drop or a trunk line calculate your cables nominal velocity of propagation and compare it with the manufactures NVP specification for that cable.

share|improve this answer

The closest you're going to get on a typical home ISP link is to analyze the MAC addresses of your traffic, and if the gateway changes to something else it's a sign that something has changed on the network. That could be an eavesdropper, or it could be a simple equipment changeout.

However, if the snooping is happening beyond the gateway even a sloppy snooper will remain undetected. Also, if the snooper is using a simple bridge rather than an attack based on ARP-spoofing, the only indication of their presence will be a slightly higher latency; slight enough it'll hide in the statistical noise for most home broadband connections.

If the snooping is actually an intercept proxy of some kind (layer 5-7) instead of a network tap (L2), say sniffing all of your HTTP traffic but leaving the rest alone, there is a possibility that you can detect that by watching your HTTP headers. If their DNS settings are crappy you may find some sites unavailable that really should be.

And finally, stateful firewalls do exactly this kind of thing by design. Figuring out the difference between a stateful firewall and a snooper is very, very tricky.

In short, it is very hard to detect snoopers, even sloppy ones.

share|improve this answer

If someone taps into your network using a passive tap the only way to detect it is using fairly sophisticated tools that can measure not just the load on the cable but can usually tell you how far from the test point something is connected. Of course very few of us would have access to such gear.

If someone connects using an active (normal connection) there are a multitude of ways of detecting it, mainly by monitoring traffic. Bear in mind that any active network device will send out broadcast packets, so they can still be detected even when you cannot see their point to point traffic. Many software tools take advantage of this (e.g. Fluke Network Inspector - old but still very useful).

share|improve this answer
When I put my sniffer to use (Windows XP running Wireshark or MS NetMon) I unbind all network protocols and components on the NIC I'm sniffing from. I do this so that my sniffer doesn't influence the traffic flow or the data that's captured. I'm assuming that because of this that it also doesn't inject traffic, such as broadcasts, onto the network. – joeqwerty Oct 29 '10 at 1:24
@joeqwerty, under those circumstances your NIC should be invisible to the network, as it's acting as a passive tap. However, the physical connection can still be detected electrically because it places a load on the lines, albeit very small. It's that load that the right test gear can detect. It's easy for network people to forget about the electrical properties of connected devices. – John Gardeniers Oct 29 '10 at 1:46
Thanks. As you said, I hadn't thought of that. – joeqwerty Oct 29 '10 at 1:56

That's a terrificly open-ended question. If you're asking to see if someone is physically accessing your cable, a physical check would really be the only way to be sure. Some ways to have an idea though would include packet sniffing and IP scanning. Other than that, you can monitor a managed switch above both connections to see what MAC addresses are connecting and restrict further connections by MAC address (although those could be cloned but would add a high level of difficulty if they can't access your hardware first).

If you want to get into this same question from the Wifi angle, it's a whole new can of worms.

share|improve this answer

protected by voretaq7 Nov 8 '12 at 19:47

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.