Member Avatar for 00musdan

Hey guys I am a noob when it comes to this stuff. I go to college for electrical engineering and me and my professor were discussing a cool senior project. There are regular vending machines in most buildings of the school that are connected to the schools network. The ethernet cords are out in the open. This way kids can swipe their school ID's for a soda and get charged through their dining dollars. Their ID #'s are sent to the schools computer which deducts from their account. Is there a way to build a packet sniffer and connect it in between the vending machine and the walls ethernet jack. Then have the sniffer intercept the data packets of the kids ID #'s and have it change that number to a different value so that the wrong person gets charged? I think compromising the schools system with a teachers permission is a cool project.

  • 2 Contributors
  • 2 Replies
  • 179 Views
  • 20 Hours Discussion Span
  • Latest Post Latest Post by 00musdan

Dani AI

Generated

Short answer up front: intercepting and changing student ID numbers on a live campus network to charge a different account is unethical and very likely illegal. is right to flag the legal risk. A classroom or professor's verbal OK is not a substitute for formal, written authorization from campus IT and whatever campus compliance office handles student data. Experiments must be limited to an isolated test network or a documented, IT-approved lab environment.

A few technical points that matter for planning: modern campus networks are usually switched, so casual sniffing from a random plug rarely exposes other hosts' traffic. Methods that force traffic onto a monitoring port (ARP spoofing, MAC flooding, etc.) are active attacks and must not be used on production infrastructure. Legitimate capture techniques include asking IT to configure a SPAN/mirror port or creating a controlled VLAN where test devices talk only to each other. Analysis tools for an educational project are standard (Wireshark, libpcap/Npcap/tcpdump) — capture traffic in the lab and analyze payloads and protocol fields rather than tampering with live transactions.

Project directions that teach useful skills without breaking the law: 1) build a passive analyzer that logs metadata (timestamps, MAC/IP pairs, protocols) and looks for cleartext identifiers; 2) implement a vending-machine emulator plus a server and show how TLS, tokenization, or HMACs prevent tampering; 3) propose and demo mitigations (network segmentation, port security, 802.1X). Example pseudocode for a safe, capture-only component:

open_capture(device_or_file)
while packet = read_packet():
  ts = packet.timestamp
  src = parse_src(packet)
  dst = parse_dst(packet)
  proto = parse_protocol(packet)
  log(ts, src, dst, proto)

Document every step: get written signoffs, define scope, keep test data synthetic or anonymized, and include an ethics/legal section in the final report. If vending traffic contains unprotected IDs, note that the correct remediation is encryption/tokenization and proper network isolation — those are the real value-adds for a senior project.

Recommended Answers

All 2 Replies

Member Avatar for rubberman

1. Make sure that the school agrees to this - it is probably illegal.
2. What makes you think it hasn't already been done? :-)

Member Avatar for 00musdan

The school will be fine with it because I will never actually use this besides for the presentation. And it has never been done at my school and from googling i dont see any1 else that has tried this

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.