Intrusion Detection Using Packet Sniffer

Network Intrusion Detection and Prevention system works on analyzing the packets coming and going through the interface. Computer software that can intercept and log traffic passing over a digital network or part of a network is better known as packet sniffer. Depending on the network structure one can sniff all or just parts of the traffic from a single machine within the network. With the development and popularization of network Technology, the management, maintenance and monitoring of network is Important to keep the network smooth and improve Economic efficiency. For this purpose packet sniffer is used. This paper focuses on the basics of packet sniffer and its working, development of the tool on Linux (KALI) platform and its use for Intrusion Detection. Focus has also been laid to analyze the bottleneck scenario arising in the network, using this self-developed packet sniffer. Before the development of this indigenous software, minute observation has been made on the working behavior of already existing sniffer software such as wireshark (formerly known as ethereal), tcpdump, and snort, which serve as the base for the development of our sniffer software. For the capture of the packets, a library known as libpcap has been used. In development of this software we incorporated an additional feature that was not in the original one viz. Sniffer Uploading.