In the network, the data packet which any main engine transmits, can transmit on the goal main engine which through the network line assigns, possesses may intercept on this network line's main engine to this transmission data packet. In the normal condition, the network card to the data packet which passes through only makes simple judgment processing, if in data packet goal address and network card's same, then receives this data packet, otherwise does not make any processing. If supposes the network card is the omnium-gatherum pattern, then this network card may receive any flows through its data packet, no matter data packet's goal address is anything. The aggressor uses this kind of principle, establishes the omnium-gatherum pattern the network card, then the interception flows through its each kind of data packet to carry on the analysis, has the sensitive data packet to some to make the further analysis, if contains useful name of head of household (username) and the password (password) inscription data packet.
¡¡¡¡This kind of attack needs to enter in generally the local area network which is at to the goal main engine, chooses a main engine implementation network monitor, if in a router or has on the routing function main engine to carry on the monitor, then can catch to the more data messages.
¡¡¡¡Usually, the operating system itself also provides some to use in the network monitor the tool software. For example, in Linux rcpdump, NT Network Monitor, as well as in Solaris Snoop and so on. Uses these tools to be possible to carry on the effective monitoring and the management conveniently for the network. But, they will also turn the aggressor to carry on the monitor to the network the tool, then posed the huge threat to the network security. Because monitors the tool not on own initiative to the network transmission data packet, they are only steal silently flow through its data, this kind of attack has the confidentiality.
¡¡¡¡Prevents the network the general method which monitors to include:
¡¡¡¡¢Ù The inspection is moving presently frequently procedure tabulation, if discovered that has the unclear status procedure in the movement, should enhance vigilance;
¡¡¡¡¢Ú Inspects the suspicious journal file, if has the size to increase the journal file existence which unceasingly renews unceasingly with the time, should inspect its content immediately;
¡¡¡¡¢Û Examines network card's working pattern, if is in the omnium-gatherum pattern, should strengthen the guard, verifies the reason;
¡¡¡¡¢Ü Uses the secure communication agreement, strengthens the correspondence data the secrecy;
¡¡¡¡¢Ý The use security's network topology, reduces the scope which the data packet flows through.
¡¡¡¡Because the network monitor can only realize in an ether webpage, therefore divides the network Cheng Duoge the webpage, may strengthen the network the safety performance and reduces the loss which brings because of the network monitor.
|
You are here: hacking technology
> network management
> Content
Category: Home
> network management