Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I have read that some network adapters can switch to promiscuous mode and get all the packets sent by my router.

We have multiple computers here connected to the same router. They all have the WEP key for authentification.

So basicaly, this means that anyone of them, using the promiscuous mode, can see all the packets destined to others computers?

That's frightening. How can I prevent this?

share|improve this question
IPSec, SSL, SSH etc to encrypt, however this is not a programming question. – SpliFF Jun 11 '09 at 2:04

7 Answers

up vote 6 down vote

Unplug from the network.

Really there's not much you can do short of implementing something complex like IPSec.

share|improve this answer
up vote 5 down vote

WEP has been completely broken since at least 2007. Bruce Schneier has a link.

Also, both WEP and WPA-PSK use the same encryption key for all computers connected to the AP, so any computer on the network can see all packets by design. You want WPA2-Enterprise, which uses username/password authentication and uses a different session key for every client. Setting up WPA2-Enterprise requires a RADIUS server; you can either set up your own (there are step-by-step instructions available on teh intarwebz) or outsource to e.g. witopia.net.

share|improve this answer
up vote 2 down vote

Use a switch instead of a hub ( which you likely do anyway... it's getting harder to find simple hubs these days ).

A switch will intelligently route traffic only to those ports that need it; a hub broadcast traffic to all ports.

Better switches also have a management port to allow you to control which ports get what, as well as get access to everything so that you can debug problems.

share|improve this answer
That only works if you replace the router with the switch. If the switch is plugged into the router then you still have the same problem. The problem also exists upstream of the router, etc. "Someone is always listening." – Talljoe Jun 11 '09 at 2:04
1  
Switches are trivial to sniff traffic from. There are at least two methods you can use to get traffic destined for another computer. – David Pashley Jun 11 '09 at 7:59
MAC poisoning is one, what's the other? – ptman Mar 16 '10 at 12:15
up vote 1 down vote

End-to-End Encryption is the only way to stop it. Use IPSec or SSL/TLS.

And even this won't stop simple traffic analysis or signal intelligence.

share|improve this answer
up vote 0 down vote

More details : I am talking about a wireless lan here (WLAN).

So, the damn router is basicaly broadcasting my packets to everyone! And those in promiscuous mode can intercept it easly

Am I right?

share|improve this answer
Not just the router is doing that. Your wifi card/antenna is also broadcasting every packet you send to everyone in the area. There are certain cryptographic protections in place, assuming they have been enabled. Even with those enabled there are fairly trivial ways to read every packet anyway. – Kyle Hodgson Jun 11 '09 at 2:21
That sucks, I would expect that people who promote wireless devices would do an effort to protect the privacy of users, even in a local wireless network where eveyone has the key. – Rivari Jun 11 '09 at 2:29
4  
There is a fundamental misunderstanding here. Wireless internet is wireless because it transmits information through the air, rather than through a wire. Current protocols are not (I would almost say 'will never be') smart enough to only emit electromagnetic waves in the exact direction of the wireless card the packet is intended for. Anywhere those EM waves reach (and most antennae are omnidirectional), someone can use an antenna to see what waves are being transmitted, same as you can. This "problem" is solved by encryption, and they just see garbage. – Matt J Jun 11 '09 at 3:29
They can see garbage, but in some cases just knowing where the garbage is coming from, how much and how often is still useful. – jldugger Jun 18 '09 at 6:45
up vote 0 down vote

The only way to protect yourself from promiscuous mode is to protection :) But seriously, unless you are running linux on all your machines, and compile the kernel to make sure they cant, dont allow machine access to bios/boot, and dont lock down your workstations your pretty much screwed...

Where there is a will there is a way. you can sniff a switch traffic btw...

share|improve this answer
up vote 0 down vote

Standard off-the-shelf wireless is not secure. Period.

When you say that you find this 'frightening' what is the possible ramification you are thinking of? Are you running a bank? If so, then you should buy some proper wireless (see Brad Ackerman's post)...

It'll take more than a PC enthusiast to 'capture' the packets, and a relatively experienced hacker to actually put the packets together into something useful. In short, regardless of what you read in the media, an experienced individual would have to work very hard to get your data into a usable form and either cause any damage/use the data against you. Don't let paranoia get to you!!

However...

A cheap solution is to put the wireless router 'outside' your network - i.e. in the DMZ part of your router (assuming it has one) - and then VPN into the inside of your network - ensuring that you/Windows is encrypting traffic over the VPN - not all do. That would give you security - just not in the way/spirit that WEP/WPA was intended!!

Mike

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.