A user on your Windows 2000 network has discovered that he can use L0phtcrack to sniff the SMB exchanges which carry user logons. The user is plugged into a hub with 23 other systems. However, he is u

While a Network Intrusion Detection System (NIDS) might detect an attack, it does not prevent the sniffing of traffic itself, which is the user's immediate problem in capturing logons.

In a Windows 2000 Active Directory environment, Kerberos is the default authentication protocol. Kerberos uses a ticket-based system for authentication, meaning that the user's password hash is not transmitted directly over the network during logon, unlike NTLM. This prevents tools like L0phtcrack from sniffing usable password hashes from SMB exchanges, even on a hub where traffic is broadcast.

Windows logons can indeed be sniffed if NTLM authentication is used, especially on older systems or non-Kerberos enabled environments, making this statement generally false.

L0phtcrack is primarily designed to crack Windows passwords, including those from SMB, not specifically logons to web servers, which often use different authentication mechanisms.