1

I would like to know if it is possible to detect if someone has tapped your network connection (eth cable).

If done properly, it may be undetectable without ISP help or manual verification of the link.

I would like to know if there are ways to detect a less than perfect tapping :)

4
  • 13
    Encrypt your traffic end-to-end and don't worry about eavesdroppers. Assume the Internet is an untrusted public network because it is. Oct 28, 2010 at 17:36
  • 4
    It's more likely that your ISP is helping the eavesdropper if this is a valid concern for you.
    – danlefree
    Oct 28, 2010 at 18:17
  • @danlefree is right. Might not be personal, but that pipe should be thought of as hostile.
    – chiggsy
    Feb 14, 2011 at 1:30
  • Define less than perfect tapping giving that every network equipment of the lat 10 years (switches, managed) can make copy ALL traffic to a specific port for the purpose of debugging. Here is your perfect tap on a 50USD 8 port low cost witch and upward.
    – TomTom
    May 20, 2011 at 5:02

6 Answers 6

3

If done properly, it may be undetectable without ISP help or manual verification of the link.

You mean without visual inspection. A bridge with the electronics to just move a packet to another port (basically switch in promiscous mode) would be impossible to detect if installed profesionally.

Eth you COULD try a cable length measurement system, if you know the original length.

3

I think it would be somewhat difficult, whether it was less then perfect or not. There are many ways to monitor and\or intercept network traffic.

For instance, I could insert a hub between your router and firewall (if I have physical access to the link in between the two), connect a laptop to the same hub, and monitor all of the traffic between the router and the firewall and I'm hard pressed to see how you could discover that without visually inspecting that link.

1
  • CALEA specifically mandates that all ISPs in the US are able to tap your Internet connection without the end user knowing. Most other countries have similar laws.
    – Chris S
    Oct 28, 2010 at 19:37
2

To detect a "less than perfect tapping, calculate your cat5e cables "Delay Skew", you should see a above normal delay skew if your cable has been tapped. Or you can check for crosstalk that is being generated by the tap, yet both methods will require you to purchase testing equipment.

Now for detecting a perfect passive tap implementation, it can be located using Near-End/Far-End High Frequency Cross-Talk TDR (Time-Domain Reflectometry) analysis. Such methods are required because the passive tap may be deployed at a far distance to prevent many detection methods. Yet if its a single cable and not a drop or a trunk line calculate your cables nominal velocity of propagation and compare it with the manufactures NVP specification for that cable.

1

That's a terrificly open-ended question. If you're asking to see if someone is physically accessing your cable, a physical check would really be the only way to be sure. Some ways to have an idea though would include packet sniffing and IP scanning. Other than that, you can monitor a managed switch above both connections to see what MAC addresses are connecting and restrict further connections by MAC address (although those could be cloned but would add a high level of difficulty if they can't access your hardware first).

If you want to get into this same question from the Wifi angle, it's a whole new can of worms.

1

If someone taps into your network using a passive tap the only way to detect it is using fairly sophisticated tools that can measure not just the load on the cable but can usually tell you how far from the test point something is connected. Of course very few of us would have access to such gear.

If someone connects using an active (normal connection) there are a multitude of ways of detecting it, mainly by monitoring traffic. Bear in mind that any active network device will send out broadcast packets, so they can still be detected even when you cannot see their point to point traffic. Many software tools take advantage of this (e.g. Fluke Network Inspector - old but still very useful).

2
  • When I put my sniffer to use (Windows XP running Wireshark or MS NetMon) I unbind all network protocols and components on the NIC I'm sniffing from. I do this so that my sniffer doesn't influence the traffic flow or the data that's captured. I'm assuming that because of this that it also doesn't inject traffic, such as broadcasts, onto the network.
    – joeqwerty
    Oct 29, 2010 at 1:24
  • @joeqwerty, under those circumstances your NIC should be invisible to the network, as it's acting as a passive tap. However, the physical connection can still be detected electrically because it places a load on the lines, albeit very small. It's that load that the right test gear can detect. It's easy for network people to forget about the electrical properties of connected devices. Oct 29, 2010 at 1:46
0

The closest you're going to get on a typical home ISP link is to analyze the MAC addresses of your traffic, and if the gateway changes to something else it's a sign that something has changed on the network. That could be an eavesdropper, or it could be a simple equipment changeout.

However, if the snooping is happening beyond the gateway even a sloppy snooper will remain undetected. Also, if the snooper is using a simple bridge rather than an attack based on ARP-spoofing, the only indication of their presence will be a slightly higher latency; slight enough it'll hide in the statistical noise for most home broadband connections.

If the snooping is actually an intercept proxy of some kind (layer 5-7) instead of a network tap (L2), say sniffing all of your HTTP traffic but leaving the rest alone, there is a possibility that you can detect that by watching your HTTP headers. If their DNS settings are crappy you may find some sites unavailable that really should be.

And finally, stateful firewalls do exactly this kind of thing by design. Figuring out the difference between a stateful firewall and a snooper is very, very tricky.

In short, it is very hard to detect snoopers, even sloppy ones.

Not the answer you're looking for? Browse other questions tagged or ask your own question.