> Pardon me for jumping in, but if you're trying to keep traffic > statistics while connected to a switch port (as opposed to a hub), > how does your traffic statistic program convince the switch to > forward all of the network's packets to its port? I am far > from expert in this area, but it seems to me that the switch > would _have_ to "think" that machines of all active IP's existed > on that leg, or it would never forward the packets to it. > Isn't that why they call it a "switch" in the first place? > > This hint might shed a glimmer of light on the problem (and then > again, it probably won't).
Rob yes to truly sniff all packets on a switch you would need to reply with ARP's to requests for IP's that were not yours, then again it wouldnt really be sniffing. I guess it depends if the switch decides whether to keep multiple MACs for a certain IP. We tried a couple of switches and all exibited the behaviour of ONE to ONE ARP -> IP mapping. Secondly I'm not trying to get stats on ALL the machines on the switch, just the IP's bound to a single machine with a single MAC. I never asked it to go grabbing packets not meant for itself. ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/winpcap-users@winpcap.polito.it/ To unsubscribe use mailto: [EMAIL PROTECTED] ==================================================================
