How to monitor if someone is using wireshark in my corporate network

Question

I would like to know if it's possible to monitor if any users are using a network sniffer like Wireshark in my corporate network?.

This is answered there: http://security.stackexchange.com/questions/25011/how-can-i-detect-if-someone-is-sniffing-network-packets-on-the-lan — thanasisk, Sep 08 '14 at 08:35
There are a number of IDS (Intrusion Detection System) products that will do this for you. — Katherine Villyard, Sep 08 '14 at 16:59

score 3 · Answer 1 · answered Sep 08 '14 at 08:22

IIRC Wireshark is copying data received by the network interface and working on them. I don't think it's possible to detect usage of Wireshark or other tools like tcpdump on network layer. On OS layer you might can check wether a device is entering promiscuous mode which indicates something is listening at the device.

How to monitor if someone is using wireshark in my corporate network

1 Answers1