Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

What is the best way on Ubuntu to hide my computer from network monitoring tools(network sniffer)?

share|improve this question
    
Do you mean preventing access, or preventing other machines knowing about the existence of your machine? –  richzilla Feb 17 '11 at 10:50
    
Run sudo ufw enable to enable the firewall. –  Anonymous Nov 17 '11 at 20:54
add comment

4 Answers

up vote 7 down vote accepted

Obviously the best way is to disconnect it.

When that is not an option, second best is to deny all incoming connections using DROP.

iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
iptables -p INPUT DROP

This way all incoming attempts to connect to your computer fails. Connections initiated by your computer works. Some special protocols do not, for example you'll encounter problems with UDP. By dropping all incoming connections, active attacker from another network can't find your computer, except if you specifically open connection to attackers computer.

In LAN your computer is still broadcasting ARP packets. You can't prevent that, if you want it working connection.

You should also disable for example avahi-daemon, which is sending MDNS broadcasts.

share|improve this answer
    
Olli: :) :) Now it seems as I would have copied my answer from you :) –  LGB Feb 17 '11 at 11:26
    
@Olli: I think you mean ARP packets, not ARP packages. –  Firefeather Feb 22 '11 at 19:39
    
@Firefeather: yes, obviously. I fixed it, thanks. –  Olli Feb 22 '11 at 19:43
    
Will doing this make my system invisible to other PCs on the same network? –  Oxwivi Feb 22 '11 at 20:18
    
No, as said in my answer. It'll broadcast ARP packets and respond to ARP requests. –  Olli Feb 22 '11 at 20:19
show 4 more comments

It's a bit hard in general, if you talk about on Ethernet level for example, you can hide your existence with not responding the ARP requests or don't answer, but then you can't use network either :) You need to "advertise" yourself otherwise networking won't work. Sure, you can hide some other things at least which can provide more "attacking surface" for others. You can use firewall, so others won't see your services, you may run on your computer, you can be careful avahi not advertise your presence, and so on. But I think it's hard to answer "in general".

share|improve this answer
add comment

If you are communicating on the Ethernet or wireless you are open to sniffing. At the very least your computer will announce its presence when it gets or sets an IP address.

You could try masquerading as another computer on the network, but that will make things difficult for you and the other computer. Your traffic would still be open to sniffing.

Encrypting your traffic will make it more difficult to determine what traffic you are sending to. But the endpoints will still be visible.

share|improve this answer
add comment

Perhaps a little low tech but I turn off my computer when I'm not using it. This is in addition to being behind a NAT wireless router with MAC filtering and a built in firewall. I also run a basic firewall in all my computers. No Windows PCs to be found anywhere.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.