NetNews Usenet Archive 1992 #26/NN_1992_26.iso/spool/alt/security/4798

Internet Message Format | 1992-11-12 | 3.8 KB

Path: sparky!uunet!charon.amdahl.com!pacbell.com!sgiblab!darwin.sura.net!ukma!nsisrv!Pt![e-mail]!rick
From: rick@[e-mail]
Newsgroups: alt.security
Subject: Re: Detecting an Ethernet Tap ( Reply Summary)
Message-ID: <[e-mail]>
Date: 12 Nov 92 16:19:12 GMT
Sender: [e-mail]
Reply-To: [e-mail]
Organization: 7TH Communications Group
Lines: 75

I received lots of mail asking me to forward any information I
received on detecting ethernet taps so I figured there was
enough interest in the answer to post. I received replies from
quite a few people. And just as many interested in the replies.

My original post:
>In article <[e-mail]> I wrote:
>
>   Does anyone know of any software available that will detect a
>   tap of an ethernet cable? Assmuming that this is possible.
>
>   I am looking at the ability to detect a tap in an ethernet cable and
>   have the software notify a network admin. We have etherhostprobe, which
>   works fine after the fact, but I am looking for something that monitors
>   the line and detects a tap or new device in real time.
>
>   I am a novice at the physical aspects of ethernet. i.e., I am not
>   sure if it is even possible to detect such a thing. I assume that it is
>   possible to detect a voltage drop across the line or something similar.
>   Or perhaps detect new ethernet packets as soon as they hit the wire.
>
>   Does anyone know of any products or methods for doing this sort of thing?
>

Replies came from:
[e-mail]
[e-mail] (David Fetrow)
[e-mail] (Mitch Wright)

....and others-- Thankyou very much!!!


    It seems the best way to do this is with a device called a Time-Domain
Reflectometer (TDR). It sends a pulse down the cable and measures the
reflections. If the cable has been cut there will be a big echo indicating
that the ether is unterminated. Normal ether taps will also show up, so if
someone taps the wire you will see a new echo. As you might expect this does
nothing to indicate that someone might have hijacked an existing tap for naughty
buisiness. (Which would be the most likely method for getting onto the ether
anyway). A TDR is not a real time solution, but it gets close. (Pulse
at regular intervals and see if anything turns up.)

    I was informed that a TDR is very expensive. So unless you have a
large network owning one would not be cost effective, unless there must
be some guarantee that there are no new taps on a wire. Such as a classified
processing environment.

    Other methods mentioned would be to use etherhostprobe to
identify new hosts attached to the wire. This is what we are currently
doing, but it is long after the fact. Etherhostprobe identifies active
ethernet addresses and records them to a file. Then you run it again
at some later date and then compare the findings to see what falls
out the bottom. Any new addresses could be a problem. The drawbacks
are that if a host was down on the previous run it will show up as a
new host in the next run. When you multiply this by a large number of
hosts that could be up or down, it turns into a real mess. It is
better than nothing however. I dunno where to find it, but it'll probably
turn up through archie. I think we got it from phloem.uoregon.edu

    All this really leaves is to pressurize the conduit the ether
wire runs through and then set off alarms if the pressure drops.
Another expensive solution.

    All in all it would probably be much better to not worry about
detecting taps, and just encrypt the info on the wire. Then a tap yields
the tapper nothing but garbage. We simply don't care that the line
is being tapped. This is the philosophy that will be persued here.
We are going to look at a Kerberos solution.



--
Rick Weldon     I-NET Inc. (Pentagon, 7TH Com Group)
E-mail: [e-mail]
Phone:  [phone]