Test Sniffer in a network using ARP camouflage Broadcast

Sniffer has always been an annoying hacker tool because it is a static attack software and its existence does not leave any trace, therefore, it is difficult for people to pull it out. However, it is quite harmful (it is like a monitor, and your "every action" is under its surveillance, you say it is not very harmful ). Therefore, it is necessary to find a way to check whether there is Sniffer in the network.

1. Sniffer Principle

The so-called "Know Yourself" and "Know Yourself" have no advantages. To understand the method of detecting Sniffer, you must first understand the principles of Sniffer. First, let's take a look at how data is transmitted in the LAN. When a data packet is destined for a computer in the LAN, the data packet is sent to each computer in the network as a broadcast. The NIC of each computer analyzes the destination Mac address (that is, the ethernet address) in the packet, if this address is the Mac address of this computer or the broadcast address (FF-FF-FF-FF-FF-FF), then, the packet will be received, and if not, the NIC will discard it directly. However, there is a premise that the NIC of the computer on the receiving end works in normal mode. If the NIC is set to the hybrid mode, it can receive all the packets that pass through (including, of course, packets whose destination is not local ). That is to say, as long as the packet is sent to the LAN, it will be received by the NIC in the mixed mode! This is the basic principle of Sniffer. As for the specific implementation and some details of Sniffer, I will not talk about it here. If you are interested, please refer to the relevant materials.

2. ARP datagram transmitted over Ethernet

Now that we know the basic principles of Sniffer, we need to think about how to pull out the hidden Sniffer in the LAN. This is the topic of this article. Here, we need to construct our own ARP data packets. So we will first briefly introduce the structure of ARP requests and response data packets:

Typedef struct _ et_header // Ethernet header

{

Unsigned char eh_dst [6];

Unsigned char eh_src [6];

Unsigned short eh_type;

} ET_HEADER;

Typedef struct _ arp_header // ARP Header

{

Unsigned short arp_hdr;

Unsigned short arp_pro;

Unsigned char arp_hln;

Unsigned char arp_pln;

Unsigned short arp_opt;

Unsigned char arp_sha [6];

Unsigned long arp_spa;

Unsigned char arp_tha [6];

Unsigned long arp_tpa;

} ARP_HEADER;

　　

The above is the structure of the ARP packet transmitted in the network. As for the specific meaning of each field in the structure and how to initialize, beyond the scope of this article, you are interested to see the TCP-IP protocol details book.

3. Detect Sniffer in the LAN

Finally, the topic is entered. Since Sniffer is a static blacklist and does not leave any logs, We need to actively detect it. In view of the principle of Sniffer is to set the network card to the mixed mode, we can find a way to detect the network card that is set to the mixed mode in the network, in order to determine whether there is Sniffer.

Here, let's take a look at the computer's rules for receiving data packets. As mentioned above, in normal mode, the network adapter first determines the destination Mac address of the data packet. If it is a local Mac address or a broadcast address, the data packet will be received into the system core, otherwise, it will be discarded. If the NIC is set to the hybrid mode, all data packets will directly enter the system core. After data packets arrive at the system core, the system further filters data packets: the system only responds to packets whose destination Mac address is the local Mac address or broadcast address. If arp request packets are received, the system returns an ARP response packet. However, the difference is that the core of the system and the NIC have different judgment on the broadcast address: in Windows, the NIC determines all the six digits of the Mac address, the system core only determines the first two digits of the Mac address (Win98 or even the first digit). That is to say, for the system core, the correct broadcast address FF-FF-FF-FF-FF-FF and the wrong broadcast address FF-FF-FF-FF-FF-FE are the same, are considered as broadcast addresses, and even the FF-FF-00-00-00-00 will be considered as broadcast addresses by the system's core!

Here, smart readers probably know how to do it. If we construct an ARP request packet whose destination Mac address is FF-FF-FF-FF-FF-FE, the packet will be discarded for the NIC in normal working mode, of course, no packet will be returned; for NICs in hybrid mode, data packets are received at the core of the system. The system core considers this Mac address as a broadcast address, so it returns an ARP response packet. In this way, we can determine that Sniffer exists on this machine.

 

4. Main source code analysis

The above analysis shows that the program is divided into two modules: one is the ARP request packet that sends the disguised broadcast address, and the other is the ARP response packet that receives the feedback for analysis. We use two threads respectively. The main thread is responsible for sending and the listening thread is responsible for receiving.

First, create the structure of the Ethernet header and ARP header:

★

Typedef struct _ et_header // Ethernet header

{

Unsigned char eh_dst [6];

Unsigned char eh_src [6];

Unsigned short eh_type;

} ET_HEADER;

Typedef struct _ arp_header // ARP Header

{

Unsigned short arp_hdr;

Unsigned short arp_pro;

Unsigned char arp_hln;

Unsigned char arp_pln;

Unsigned short arp_opt;

Unsigned char arp_sha [6];

Unsigned long arp_spa;

Unsigned char arp_tha [6];

Unsigned long arp_tpa;

} ARP_HEADER;

★

Then the main thread that sends the ARP request message gets the names of all adapters. "Adapter_name" indicates a buffer for storing the name of the adapter, which is stored in the buffer using UNICODE encoding. UNICODE encoding is used to store one character in two bytes. In this way, each character will naturally appear. The two adapter names are separated by a word. Adapter_length: buffer size:

★

If (PacketGetAdapterNames (char *) adapter_name, & adapter_length) = FALSE)

{

Printf ("PacketGetAdapterNames error: % d", GetLastError ());

Return 0;

}

★

Open the adapter. By default, the first adapter is Enabled:

★

LpAdapter = (LPADAPTER) PacketOpenAdapter (LPTSTR) adapter_list [0]);

If (! LpAdapter | (lpAdapter-> hFile = INVALID_HANDLE_VALUE ))

{

Printf ("Unable to open the driver, Error Code: % lx", GetLastError ());

Return 0;

}

★

Assign values to the structure of the Ethernet header and ARP header. The StrToMac function is the function for converting a custom string to a Mac address:

★

StrToMac ("00E06E41508F", s_Mac); // "00E06E41508F" is the NIC address of the local machine used by the author to test the program. The tester should change it to the NIC address of the testing machine.

Memcpy (et_header.eh_src, s_Mac, 6 );

StrToMac ("fffffffffe", d_Mac); // set the destination physical address to fffffffffe.

Memcpy (et_header.eh_dst, d_Mac, 6 );

Et_header.eh_type = htons (0x0806); // type 0x0806 indicates this is an ARP packet

Arp_header.arp_hdr = htons (0x0001); // hardware address type ethernet address

Arp_header.arp_pro = htons (0x0800); // The Protocol address type is IP protocol.

Arp_header.arp_hln = 6; // The hardware address length is 6.

Arp_header.arp_pln = 4; // The Protocol address length is 4.

Arp_header.arp_opt = htons (0x0001); // identifies as an ARP request

Arp_header.arp_spa = inet_addr ("172.24.21.10"); // "172.24.21.10" is the IP address of the Local Machine Used by my test program. The tester should change it to the IP address of the testing machine.

Memcpy (arp_header.arp_sha, et_header.eh_src, 6 );

Arp_header.arp_tpa = inet_addr (argv [1]);

Memcpy (arp_header.arp_tha, et_header.eh_dst, 6 );

★

Send data packets:

★

LpPacket = PacketAllocatePacket (); // allocate memory to the PACKET structure pointer

PacketInitPacket (lpPacket, buffer, 512); // initialize the PACKET structure pointer

PacketSetNumWrites (lpAdapter, 5); // you can specify the number of sent messages.

PacketSendPacket (lpAdapter, lpPacket, TRUE); // sends an ARP request packet

★

Finally, don't forget to finish the work:

★

PacketFreePacket (lpPacket); // release the PACKET structure pointer

PacketCloseAdapter (lpAdapter); // close the adapter

★

Finally, the listening thread:

Set the series parameters for receiving data packets:

★

PacketSetHwFilter (lpAdapter, NDIS_PACKET_TYPE_DIRECTED); // set the NIC to the direct mode.

PacketSetBuff (lpAdapter, 1024); // sets the buffer size of packets received by the network adapter.

PacketSetReadTimeout (lpAdapter, 2); // set the "rest" time after receiving a package

★

Receive data packets:

★PacketReceivePacket (lpAdapter, lpPacket, TRUE); // receives data packets★

Analyze the data packets to draw a conclusion:

★

Char * buf;

Bpf_hdr * lpBpfhdr;

ET_HEADER * lpEthdr;

In_addr addr = {0 };

Buf = (char *) lpPacket-> Buffer;

LpBpfhdr = (bpf_hdr *) buf;

LpEthdr = (ET_HEADER *) (buf + lpBpfhdr-> bh_hdrlen );

If (lpEthdr-> eh_type = htons (0x0806) // determines whether the ARP packet is used

{

ARP_HEADER * lpArphdr = (ARP_HEADER *) (buf + lpBpfhdr-> bh_hdrlen + sizeof (ET_HEADER ));

Char source_ip [20] = {0}, dest_ip [20] = {0 };

Addr. S_un.S_addr = lpArphdr-> arp_spa;

Memcpy (source_ip, inet_ntoa (addr), strlen (inet_ntoa (addr )));

Memset (& addr, 0, sizeof (in_addr ));

Addr. S_un.S_addr = lpArphdr-> arp_tpa;

Memcpy (des