Stealth Sniffing

To sniff traffic but be guaranteed to remain unnoticed, the intruder configures the adapter to block the packet transmission at the hardware level. Thus, the sniffing adapter will only receive the packets. With adapters based on twisted pair, to achieve this goal it is enough to cut the transmitting wires, which are usually orange (Fig. 27.7). Although there exists special equipment allowing companies to locate an unauthorized connection, not every organization can afford it. Therefore, the chance of locating the hacker is negligibly small.

Figure 27.7: Turning a normal network adapter into a stealth card

Stealth sniffing supports only passive listening; therefore, in networks with an intellectual hub it is necessary to wait until the hub operates under the peak workload. In each case, it would duplicate the arriving data to all ports, like a normal hub.