Agent Based Network Sniffer Detection

Network sniffing was considered as a major threat to network and web application. Every device connected to the Ethernet-network receives all the data that is passed on the segment. By default the network card processes only data that is addressed to it. However listening programs turn network card in a mode of reception of all packets called promiscuous mode. As we know sniffer is a program that eavesdrops all the data moving onto the network [1]. In this mode the NIC does not perform its basic task of filtering. The NIC forwards all the packets moving in the network to the system for further processing. Sniffer does not generate any traffic in the network, so it can not be detected easily. Many sniffers like wireshark, Cain & Abel, ethersniff etc. are available at no cost on the internet. There are many proposed solutions are available for the detection of network sniffing including antisniff [2], SnifferWall [3], Sniffer Detector [4] etc. but any solution does not guarantee full security. Here in this paper we are proposing Mobile Agents as a solution for the problem of sniffer detection. Mobile agents perform a task by migrating and executing on several hosts connected to the network. For the sniffer detection, the network administrator sends some special types of mobile agents in the network and collects information from different nodes. After analyzing this information the network administrator can identify the computer system running in promiscuous mode.