Are Network Analyzers Traceable?

[Shad0wxPhoen1X]

So I decided to download Wireshark just to dabble in it and see what it's all about. I tried it on my home network and was instantly hooked on looking at all the traffic. So I was contemplating on loading wireshark on a flash drive and taking it to school. What I was wondering is that will I be able to run wireshark off my flash drive without being detected or traced back to by an admin?

[brwainer]

Wireshark doesn't do anything that is visible on the network - but depending on the management and security setup of the computer, it will likely get blocked or reported automatically

[NoobCase]

Quite a few av solutions report on those.  Be it port scanner or trafic analyzers

[Windows7ge]

At my college the network is setup to detect when someone is packet sniffing the network (Running Wireshark). The network won't detect the activity automatically but it has to be configured to detect and notify someone. As to weather or not your school network is set up this way is unknown.

 

To my knowledge network adapters have two modes they can be in:

Normal Mode: Sending an receiving information

Promiscuous Mode: When the adapter listens to the network and captures all activity

 

If Servers or other network gear are configured correctly they can detect when a network adapter has entered Promiscuous Mode. A network adapter will never enter this mode unless it's Packet Sniffing. In the event of this repercussions can be exponential. Here at my college which is federally funded it is considered a federal offense to Packet Sniff the network. Students have done it before and gotten arrested for it.

 

Used in the correct environment Wireshark is a powerful network analyzing tool which can be used to tell what is congesting a network but in the wrong hands it can be used for hacking purposes so some businesses take precautions against people using it like my college and repercussions are harsh.

 

Although I don't condone it if you want to use it I'd bring your own computer to the school and plug it into an empty Ethernet port. If you log into the school network under your school ID they can associate the "attack" from the time it occurs with who was logged in at that time on which machine. So don't do it on a school computer.