IP Networking

One of the users on my network took my aside and showed me a program called ethereal that can sniff out packets on the network. He was able to re-build a packet stream and see pretty clearly what other users where looking at.

I am using a hub. If I use a switch will that stop ability to be able to view the packets?

How do i detect if some one is using such a program? (ehtereal, snort)

Using a switched network will cut down on the amount of snooping that can be done, although it can still be possible under some circumstances. Also, you will still be able to snoop arp and other broadcast traffic. There is no way to detect these passive sniffers.

If your network has controlled IP addresses and MAC addresses you can determine if a new device that is not authorized is on the network. This might help if you know that authorized users are not sniffing.... (based on trust and/or policy)... that depends on the size of your network under administration.

As PxT says, there is no way to know if a device is running a sniffer, except by looking at the device and seeing what software is installed and what processes are being executed.

Segmenting your traffic on a switch, as you suggest, helps, but if your device talks to devices outside the segment or across the switch, then the problem still exists... for example, when you talk to 'me' from your place, then people will be able to sniff from many points across the Internet.

If you need confidentiality, then I recommend you look at different cryptographic systems such as SSH, OpenSSH, SSLeay, PHP and a host of other cryptographic systems available to insure your traffic invisible to sniffers.

Switched environments can still be sniffed via ARP poisoning, although in some cases it can cause a good amount of problems, so it's not failsafe.

It's not free, and I haven't tried it, but some tools like AntiSniff can detect interfaces in promiscuous mode on the network. It's worth a try if you want to watch for this on your network.

As far as hackers go is the arp information that powerful or will a switch reduce data enough to make it pretty difficult?

What types of software do you suggent for network analyzing.

I am Larning Snort
and now use ethereal
and cheops

any other good ones.

a way to check if some one is using an sniffer on your network, is by sending a broadcast to a diferent masc that your network have.
a normal network interface don't have to answer to this broadcast, but if is promiscuous mode...