Network security

[Bruno Wolff III]

On Thu, Jun 10, 2004 at 11:37:17 -0400,
  "Scot L. Harris" <webid at cfl.rr.com> wrote:
> On Thu, 2004-06-10 at 04:37, Chadley Wilson wrote:
> > Hello friends,
> > 
> > My network with approx 300 users is routed to the internet through a
> > proxy and firewall, we have a DNS server and PDC Server.
> > It is a winXplease network.
> > 
> > With a linux PC connected -
> > What tools would you suggest I could use for the following:
> > 
> > 1) Track an internal PC running a sniffer of some sort, obtain its ip
> > and mac address, then stop it sniffing and maybe kick it off the
> > network.
> > 
> 
> The bad news is this would be very difficult to detect.  The good news
> is if you are using switches sniffing on your network becomes almost
> impossible.  In a switched network you would need access to the switch

Traffic on switches can be sniffed using a couple of varients of arp
spoofing. However if something is monitoring the traffic, this should
be detectable.