Taranis is a tool that demonstrates the necessity of strong cryptography and authentication on local Ethernet networks. Taranis will steal username / password pairs by redirecting traffic intended for the POP or IMAP server to the host running Taranis. Once this is achieved, the login information is saved to a file.
Taranis redirects traffic on switch hardware by sending spoofed Ethernet traffic. This is not the same as an ARP poisoning attack as it affects only the switch, and does not rely on ARP packets. In addition, it is virtually invisible because the packets it sends are not seen on any other port on the switch. Evading detection by an IDS that may be listening on a monitoring port is as simple as changing the type of packet that is sent by the packet spoofing thread.
