[Winpcap-users] hubs vs. switches and promiscuous mode

[David Chang]

Yes.  You have to modify the switch settings to allow one computer to see the traffic of another computer.  By the way, some switches (lower priced ones) cannot be changed and thus you cannot look at traffic destined to another computer.

If you flush the arp cache on the switch, the switch will no longer know which computers are connected to which ports and thus will have to "learn" the information by sending packets to all ports.  In this mode, it acts like a simple hub.  However, after a few minutes of network activity, the switch will probably have the information it had before flushing the arp cache.  Thus, this is not a good method of sniffing network traffic.

DC
  ----- Original Message ----- 
  From: Julie Schultz 
  To: winpcap-users at winpcap.org 
  Sent: Wednesday, October 05, 2005 3:05 PM
  Subject: [Winpcap-users] hubs vs. switches and promiscuous mode


  If you put any nic in promiscuous mode, is there any switch (default configuration) on which you would be able to see all the traffic for all the ports or do you have to be connected to a hub?  The more I read, the more I see that you cannot sniff ports you are not connected to on a switch unless you change the configuration of it, which is not done simply by putting a nic into promiscuous mode.  Is that correct?  Also, is there some kind of ARP request a nic can make that would result in it seeing all the traffic on the switch?  If so, does that result in a denial-of-service for any machines on ports which are being "spoofed" by this phony ARP request?

   

  Thanks,

  Julie Schultz  



------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20051005/a4792c15/attachment.htm