5

What is the best way on Ubuntu to hide my computer from network monitoring tools(network sniffer)?

Improve this question
2
  • Do you mean preventing access, or preventing other machines knowing about the existence of your machine?
    – richzilla
    Feb 17, 2011 at 10:50
  • Run sudo ufw enable to enable the firewall.
    – Anonymous
    Nov 17, 2011 at 20:54

4 Answers 4

Reset to default
9

Obviously the best way is to disconnect it.

When that is not an option, second best is to deny all incoming connections using DROP.

iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
iptables -p INPUT DROP

This way all incoming attempts to connect to your computer fails. Connections initiated by your computer works. Some special protocols do not, for example you'll encounter problems with UDP. By dropping all incoming connections, active attacker from another network can't find your computer, except if you specifically open connection to attackers computer.

In LAN your computer is still broadcasting ARP packets. You can't prevent that, if you want it working connection.

You should also disable for example avahi-daemon, which is sending MDNS broadcasts.

Improve this answer
9
  • Olli: :) :) Now it seems as I would have copied my answer from you :)
    – LGB
    Feb 17, 2011 at 11:26
  • @Olli: I think you mean ARP packets, not ARP packages.
    – Firefeather
    Feb 22, 2011 at 19:39
  • @Firefeather: yes, obviously. I fixed it, thanks.
    – Olli
    Feb 22, 2011 at 19:43
  • Will doing this make my system invisible to other PCs on the same network?
    – Oxwivi
    Feb 22, 2011 at 20:18
  • No, as said in my answer. It'll broadcast ARP packets and respond to ARP requests.
    – Olli
    Feb 22, 2011 at 20:19
1

It's a bit hard in general, if you talk about on Ethernet level for example, you can hide your existence with not responding the ARP requests or don't answer, but then you can't use network either :) You need to "advertise" yourself otherwise networking won't work. Sure, you can hide some other things at least which can provide more "attacking surface" for others. You can use firewall, so others won't see your services, you may run on your computer, you can be careful avahi not advertise your presence, and so on. But I think it's hard to answer "in general".

Improve this answer
1

If you are communicating on the Ethernet or wireless you are open to sniffing. At the very least your computer will announce its presence when it gets or sets an IP address.

You could try masquerading as another computer on the network, but that will make things difficult for you and the other computer. Your traffic would still be open to sniffing.

Encrypting your traffic will make it more difficult to determine what traffic you are sending to. But the endpoints will still be visible.

Improve this answer
1

Perhaps a little low tech but I turn off my computer when I'm not using it. This is in addition to being behind a NAT wireless router with MAC filtering and a built in firewall. I also run a basic firewall in all my computers. No Windows PCs to be found anywhere.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .