Week 10 - Passive & Active Data Collection Flashcards
What is Passive data collection in a network context?
When data is collected from a network in a way that doesn’t emit its own data. You are only passively listening to the data.
What is Active data collection in a network context?
When data is collected in a network via direct interaction with devices on that network. You gather data that the devices might have stored. This creates data/logs and leaves a trace which is why it is active.
What is a way to collect data from a network?
To directly connect to the network via network cables.
Give some examples of network cables.
Optical Fibre
Coaxial Cable
Shielded Twisted Pair
Unshielded Twisted Pair
What is a cable tap?
A devices that can allow you to gain access to a network by connecting to the cables (Or device) of a network.
What type of network is the easiest to listen in on?
A network with a hub.
Why does having a hub in a network make it easy to listen in on?
Because all traffic goes to the hub and the hub sends the traffic back out to everyone. So if you are connected to the hub, you can ‘eavesdrop’ on all the data being sent on the network.
Why do switches make it difficult to listen in on data?
Because switches only send data packets to the device they are addressed to. It connects to sender and receiver and sends the traffic between them. This makes it harder to listen in on.
What device layer number is a switch?
A layer 2 device
How might you listen in on traffic in a switch?
Switches have a port mirroring feature, which allows you to configure the switch to make a copy of all traffic and packets and send them to a specific port. Doing this means you can configure it so you receive all the data going through the switch.
What is the most common way to listen to data on a network?
Sniffing.
What is the most common way to listen to data on a network passively?
Sniffing.
What are some applications/tools for listening in on data in a network using sniffing?
TCP Dump
Win Dump
Wireshark
How do you use sniffing?
Make sure you device ins on the network, and then set it to ‘promiscous’ mode. This will let it listen to all the passing data.
Why might you actively gather data instead of passively?
Because active data collection allows for the gathering of more specific data like log data on devices, rather than just listening to traffic which may not be useful.
