Switches and packet sniffing

Message

daschapa · Post by **daschapa** » Wed Feb 13, 2008 2:35 pm

I have a home LAN, consisting in three computes + NAT'ed router. All conected to a cheap switch.
The doubt came to me when my brother was playing "Mu" (an eye-candy, brain-boring MMORPG) in his windoze box. I noticed that Wireshark wasn't catching such frames.
I know Mu to send/receive a lot of datagrams every second. But my wireshark, looks like being catching only broadcast frames and the ones wich has my host as recipient. I've checked the box wich gets eth0 in promiscuous mode.
So, I'm beggining to suspect that maybe, switches are such smart to learn where a mac is and deliver a frame only trough such wire (I know bridges to do this, but not switches). Is this correct? or maybe my cheap ethernet card can't be turned in promiscuous mode?

Post by **NeddySeagoon** » Wed Feb 13, 2008 2:49 pm

daschapa,

Thats right, switches learn where to deliver packets. It keeps traffic down, avoids collisions on the network and allows full duplex operation.
You need an old fashioned hub.

JeliJami · Post by **JeliJami** » Wed Feb 13, 2008 2:59 pm

http://en.wikipedia.org/wiki/Network_switch
http://en.wikipedia.org/wiki/Network_hub

daschapa · Post by **daschapa** » Thu Feb 14, 2008 12:22 am

Thanx guys.
So, we can say that switches are, not only more efficient, but also more secure than hubs.
Is there any way to get a Switch in "promiscuous mode"? LOL

RoundsToZero · Post by **RoundsToZero** » Thu Feb 14, 2008 4:42 am

Some fancier ones have special monitor ports, otherwise if you can get the switch to reset itself, it will have to start broadcasting on all ports again. Not sure how long this lasts for, but it might give you a chance to get a leg up. Ways to get it to reset itself are power cycling (obviously) or maybe if it's cheap and you flood it with enough weird packets it'll give up, fail open, and there you go.

Or just position your machine between the switch and wherever all the packets are going to and run the packet trace from there.

zeek · Post by **zeek** » Sun Feb 17, 2008 6:01 am

Or

Code: Select all

emerge ettercap

and arppoison your brothers MAC. Then you'll see ALL his traffic because your machine will be relaying all the packets for your brothers machine.