Active Sniffing Attack

In this method, the scanning tool actively sends requests to the target system and waits for responses.
It can also manipulates the network to intercept data.
ARP Spoofing
MAC Flooding
DNS Spoofing
DHCP Attack
ICMP Redirect

Active sniffing is a network attack technique used primarily to capture traffic on switched networks, which are generally more secure against passive monitoring.

Here is a detailed breakdown of active sniffing concepts, techniques, and tools:

Definition and Context of Active Sniffing

Active sniffing is a method of acquiring network traffic by actively injecting traffic into the network.

Network Target: Active sniffing is employed to successfully sniff a switch-based network (Switched Ethernet). This is necessary because switches, unlike hubs (which are vulnerable to passive sniffing), intelligently deliver packets only to the intended recipient based on MAC addresses, restricting the visibility of traffic on other ports.
Mechanism: Active sniffing often involves injecting Address Resolution Protocol (ARP) traffic into the LAN to manipulate the switch's functionality and enable sniffing.
Detection: Active sniffing involves sending traffic actively, which means it can be detected. This makes it more conspicuous than passive sniffing.

Active Sniffing Techniques

Active sniffing relies on various attacks designed to bypass the protective functions of a switch. The techniques listed as active sniffing include:

MAC Flooding (CAM Overflow Attack):
- This technique involves filling the switch's limited Content Addressable Memory (CAM) table (or MAC table) with a massive number of fake or bogus MAC addresses.
- Once the CAM table is full, the switch enters a fail-open mode or resets to its learning mode, causing it to behave like a hub by broadcasting all incoming traffic to every port.
- Once the switch acts like a hub, the attacker running their Network Interface Card (NIC) in promiscuous mode can easily capture and analyze all the broadcasted network traffic.
- The utility macof (part of the dsniff suite) is used for MAC flooding, capable of sending 131,000 forged MAC entries per minute to the CAM tables.
ARP Poisoning/Spoofing:
- This involves constructing a large number of forged ARP request and reply packets to overload a switch or flood a target computer's ARP cache with forged entries.
- ARP is a stateless protocol, and hosts will accept ARP replies even if they didn't send a request, a flaw exploited by attackers.
- The goal is to associate the attacker's MAC address with the IP address of another host (like the default gateway or the victim), causing traffic meant for the victim/gateway to be redirected to the attacker's machine. This creates a Man-in-the-Middle (MiTM) attack scenario, enabling sniffing of sensitive information, session hijacking, or DoS attacks.
- ARP poisoning tools like arpspoof, Ettercap, and Habu are used for this technique.
Switch Port Stealing:
- This sniffing technique utilizes MAC flooding.
- The attacker floods the switch with forged gratuitous ARP packets using the target MAC address as the source and their own MAC address as the destination.
- This causes a race condition where the switch constantly changes the MAC address binding between two different ports. If the attacker is fast enough, they can steal the target host's switch port, directing packets intended for the target host toward their port.
Spoofing Attacks (General):
- Spoofing attacks used for active sniffing also include MAC spoofing/duplicating and IRDP Spoofing.
DHCP Attacks:
- DHCP attacks (like DHCP starvation and Rogue DHCP Server attacks) are listed among active sniffing techniques. Exhausting the IP pool via starvation forces valid users to rely on a rogue DHCP server, which an attacker can configure to act as the default gateway, routing all client traffic through the attacker's machine for sniffing.

Active Reconnaissance vs. Active Sniffing

In the context of information gathering, "active" interaction also applies to the reconnaissance phase:

Category	Description	Primary Goal	Related Activities/Examples
Active Reconnaissance	Direct interaction with the target system using tools to collect information. This phase is followed by scanning and enumeration.	To detect open ports, accessible hosts, network mapping, and system details prior to an attack.	Scanning (including port scanning, host discovery, OS discovery/banner grabbing), Enumeration (active connections to gain detailed info like user lists and routing tables), DNS interrogation, and Social engineering.
Active Sniffing	Actively injecting traffic into a switched network (Layer 2) to manipulate traffic routing.	To redirect established network traffic to the attacker's machine for eavesdropping and capturing sensitive data.	MAC Flooding, ARP Poisoning, Switch Port Stealing.

Scanning itself is often considered a logical extension of active reconnaissance, involving probing the target (sending TCP/IP probes) to gather detailed information. Many specific scanning techniques involve active probes to determine the status of ports, firewalls, and operating systems, such as SYN scanning, TCP ACK ping scan, and IDLE/IPID Header Scan.