【導讀】通信產(chǎn)生于各種形式，范圍從簡單的語音通話，到復雜的光線操作。型的通信是基于兩個基本原則：波浪理論和粒子理論。波通信使用空氣作為信號承載介質的結果是，兩個人可以互。但是，大氣是一種常見的媒介，任何人接近，足以收到相同的波可以監(jiān)。聽和暗中聽取討論。的過程中，媒介和類型可能會改變多次。盡管如此，計算機通信很容易被攻擊，陷會以這樣或那樣的形式存在。截取通訊的能力，取決于通信的類型和租用的媒。通過分析截獲的通信的各種屬性，管理員可以收集用于診斷或檢測網(wǎng)絡的。網(wǎng)絡活動的配置不當?shù)腻e誤，來輔助網(wǎng)絡設計的決定方案。擅自使用網(wǎng)絡嗅探器、分析儀或監(jiān)聽器表明了對于信息安全的一種基本風。網(wǎng)絡監(jiān)視和嗅探器具有相同的性質，事實上這兩個術語經(jīng)常交換使用。為了減少任何解釋的問題，嗅探器最好與數(shù)據(jù)竊聽的安全方面解釋這個整。和網(wǎng)絡拓撲結構與正在使用的媒介相關的。完成類比，揚聲器處理組中只有一個人，其名字確定在句子的開頭。

　　

【正文】 ks. Wide area work munications typify the relationship between topology, transmission medium, and location as pared with the level of access. In a typical Ether environment, nearly any work jack in the corner of a room can provide adequate access to the work for the sniffer to do its job. However, in some infrastructures, location can be a crucial factor in determining the effectiveness of a sniffer. For WAN munications the topology is much simpler. As a focal point device, such as a router, processes data, the information is placed into a new frame and forwarded to a 11 corresponding endpoint. Because all traffic is multiplexed into a single data stream, the location of the device can provide amazing access to work activities: Exhibit 4 illustrates a mon implementation of WAN connectivity. However, the location is sensitive and not easily accessed without authorization. One way the sniffer can gain access to the data stream is through a probe. A probe is an optional feature on some Channel Service Unit/Data Service Unit (CSU/DSU) devices。 it is a device that provides connectivity between the Customer Premise Equipment (CPE), such as a router, and the demarcation point of the serial line. As illustrated in Exhibit 5, a probe is implemented to capture all the frames that traverse the CSU/DSU. Another way that the sniffer can gain access to the data stream is through a Y cable. A Y cable is connected between the CSU/DSU and the CPE. This is the most mon location for a Y cable because of the plicated characteristics of the actual connection to the service provider39。s work, or local loop. Between the CSU/DSU and the CPE, a Y cable functions just like a normal cable. The third connector on the Y cable is free and can be attached to a sniffer. Once a Y cable is installed， each frame is electrically copied to the sniffer where it is absorbed and processed without disturbing the original data stream (see Exhibit 6).Unlike probe, the sniffer installed with a Y cable must be configured for the topology being used. Aerial munication can be provided by several framing formats, including PointtoPoint Protocol (PPP), High Level Data Link Control (HDLC)， and frame relay encapsulation. Once the sniffer is configured for the framing format of the topologymuch as an Ether sniffer is configured for Ether framesif can collect data from the munication stream. Other Communication Formats Microwave munications are typically associated with lineofsight implementations. Each endpoint has a clear, unobstructed focal path to the other. Microwave is a powerful carrier that can be precisely focused to reduce unauthorized interaction. However, as shown in Exhibit 7, the microwaves can wash around the receiving dish, or simply pass through the dish itself. In either event, a sniffer can be placed behind one .of the endpoint microwave dishes to receive some of the signal. In some cases, all of the signal is available but weak, but it can be amplified prior to processing. Wireless munications devices, such as cellular phones or wireless home telephones, are extremely susceptible to interception. These devices must transmit their signal through the air to a receiving station. Even though the location of the receiving station is fixed, the wireless device itself is mobile. Thus, signal transmission cannot rely on a line of sight, because a direct signal such as this would have to traverse a variety of 12 paths during the course of a transmission. So, to enable wireless devices to municate with the receiving station, they must broadcast their signal across a wide enough space to ensure that the device on the other end will receive some of the signal. Because the signal travels across such a wide area, an eavesdropper would have little trouble placing a device in a location that would receive the signal. SUMMARY Network sniffers exist primarily to assist work administrators in analyzing and troubleshooting their works. These devices take advantage of certain characteristics of electronic munications to provide a window of observation into the work. This window provides the operator with a clear view into the details of work traffic flow. In the hands of an attacker, a work sniffer can be used to learn many types of information. This information can range from basic operational characteristics of the work itself to high1y sensitive information about the pany or individuals that use the work. The amount and significance of the information learned through a snifferbased attack is dependent on certain characteristics of the work and the attacker39。s ability to introduce a sniffer. The type of medium employed, the topology of the work, and the location of the sniffer are key factors that bine to determine the amount and type of information seen by the sniffer.