In-Reply-To: <[EMAIL PROTECTED]>
I think you ask how sniff switch network cos the ARP Table stay in switch, then the packets will never become to your machine. or not? In hub network the broadcast go to all machines... If i undestand the problem (i think), you will need to change remote ARP tables on switch. So you will need the Arpoison. So you�ll finally can use dsniff ou ohter great sniff. >Received: (qmail 27711 invoked from network); 31 Jan 2003 18:30:06 -0000 >Received: from outgoing3.securityfocus.com (205.206.231.27) > by mail.securityfocus.com with SMTP; 31 Jan 2003 18:30:06 -0000 >Received: from lists.securityfocus.com (lists.securityfocus.com [205.206.231.19]) > by outgoing3.securityfocus.com (Postfix) with QMQP > id 817BDA31AD; Fri, 31 Jan 2003 10:49:23 -0700 (MST) >Mailing-List: contact [EMAIL PROTECTED]; run by ezmlm >Precedence: bulk >List-Id: <security-basics.list-id.securityfocus.com> >List-Post: <mailto:[EMAIL PROTECTED]> >List-Help: <mailto:[EMAIL PROTECTED]> >List-Unsubscribe: <mailto:[EMAIL PROTECTED]> >List-Subscribe: <mailto:[EMAIL PROTECTED]> >Delivered-To: mailing list [EMAIL PROTECTED] >Delivered-To: moderator for [EMAIL PROTECTED] >Received: (qmail 28726 invoked from network); 31 Jan 2003 01:23:48 -0000 >content-class: urn:content-classes:message >MIME-Version: 1.0 >Content-Type: text/plain; > charset="iso-8859-1" >Content-Transfer-Encoding: quoted-printable >Subject: RE: Sniffing in switched network >X-MimeOLE: Produced By Microsoft Exchange V6.0.6334.0 >Date: Fri, 31 Jan 2003 09:24:19 +0800 >Message-ID: <[EMAIL PROTECTED]> >X-MS-Has-Attach: >X-MS-TNEF-Correlator: >Thread-Topic: Sniffing in switched network >Thread-Index: AcLIg/t9qW+c/vyqSd+TuvStEWEpywAQ15SQ >From: "Lim Meng Koon" <[EMAIL PROTECTED]> >To: <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]> >X-OriginalArrivalTime: 31 Jan 2003 01:24:19.0834 (UTC) FILETIME= [7A7525A0:01C2C8C7] > >have you checked out dsniff? > >-----Original Message----- >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] >Sent: Thursday, January 30, 2003 8:52 PM >To: [EMAIL PROTECTED] >Subject: Sniffing in switched network > > > > >Hello, > > > >I've read through some documentation about sniffing the > >switched network. There are some arp-cache methods to > >discover a sniffing host (switched or "normal" network > >is not important here I think), if it is the switched > >network will I get the result I want, or first I have > >to become a sniffer also (i.e. arp-poison the switch > >cache) - to get the responses that will tell me who is > >the sniffer? > > > >Most documentation I read is somewhat old (2 years), is > >everything aleady well known and described in this > >subject or are there any running projects?=20 > > > >Thanks for help, > > > >Norbert >
