Security

Ask something
Discussion Locked

Sniffing through firewall

0 helpful
13 replies

by aseem_kumar_2001 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I want to know that is it possible that even if a firewall is running, a sniffer can run and capture all the data off the network.
I have been trying to do so but no results.

13 replies

by lmon

With the right tools the best system could be hacked. Maybe you need more tools that will get you what you need.

by mshavrov

Sniffing is not so easy even with a switch, not speaking about a router or firewall. So, you have to use another approach.

1. Use remote tools like UNIX sniffers or RMON sniffers. Some free tools available for Linux.

2. Using Network Analisys Modules (for example, Cisco NAM for routers or Catalyst Switches). You may sniff whatever you want but it's costly.

3. Use Remote Desktop Sharing (or Windows Terminal Server) on the PC in sniffed segment. You run sniffer on that PC and control that PC remotely.

Anyway, general idea is to set device where you need to sniff, and get data (screens or data files) to wherever you want to be.

Good luck,

Michael Shavrov
CCNP, CCDP, CCSP, Security+, Checkpoint CCSP, MCSE W2K, etc...

by aseem_kumar_2001

What i want is that : my system has a firewall , if i want to run a sniffer on my system i have to shut the firewall
Is it possible for me to sniff even with firewall functioning

by choppit

If I understand you correctly, you have a personal firewall installed on your PC in which case the firewall will block the packets you're interested in (unless you tell it otherwise).

by aseem_kumar_2001

Hey choppit yes i have a firewall and that's what i am looking for how to let the sniffer capture all the packets before they are filtered by the firewall

by drsysadmin

Depending on your setup - this is possible. What you want to do is set up your firewall to not drop packets, but to forward them to a null machine - running your packet sniffer. Usually, this is done so that a network eng/adm can see what is hitting the firewall. IDS systems (like cisco) will, in essence, do the same thing at the router level, via logging.

If your doing this from a home pc network, using say a gateway router, you can still set up a null PC, just do it using a shunt to IP.

Luck.
Dr. Sys

by gerhon

Yes! its really possible to have sniffer running behind firewall, nowadays that more sniffer programs at the loss and available in many security sites... try lophtcrack, cain, etc..
visit astalavista.net, hackers.com

This discussion is closed to new replies.