Re: Sniffing in switched network

From: <hallx(at)mail.com>
Date: Fri Jan 31 2003 - 14:19:45 EST

('binary' encoding is not supported, stored as-is)
In-Reply-To: <2A087C64E426484C8F36B69FF2B7176D0138FC85@MBXSRV01.stf.nus.edu.sg>

I think you ask how sniff switch network cos the ARP Table stay in switch, then the packets will never become to your machine. or not? In hub network the broadcast go to all machines...
If i undestand the problem (i think), you will need to change remote ARP tables on switch. So you will need the Arpoison. So you´ll finally can use dsniff ou ohter great sniff.

>Received: (qmail 27711 invoked from network); 31 Jan 2003 18:30:06 -0000
>Received: from outgoing3.securityfocus.com (205.206.231.27)
[205.206.231.19])
> by outgoing3.securityfocus.com (Postfix) with QMQP
> id 817BDA31AD; Fri, 31 Jan 2003 10:49:23 -0700 (MST)
>Mailing-List: contact security-basics-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <security-basics.list-id.securityfocus.com>
>List-Post: <mailto:security-basics@securityfocus.com>
>List-Help: <mailto:security-basics-help@securityfocus.com>
>List-Unsubscribe: <mailto:security-basics-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:security-basics-subscribe@securityfocus.com>
>Delivered-To: mailing list security-basics@securityfocus.com
>Delivered-To: moderator for security-basics@securityfocus.com
>Received: (qmail 28726 invoked from network); 31 Jan 2003 01:23:48 -0000
>content-class: urn:content-classes:message
>MIME-Version: 1.0
<2A087C64E426484C8F36B69FF2B7176D0138FC85@MBXSRV01.stf.nus.edu.sg>
>X-MS-Has-Attach:
>X-MS-TNEF-Correlator:
>Thread-Topic: Sniffing in switched network
>Thread-Index: AcLIg/t9qW+c/vyqSd+TuvStEWEpywAQ15SQ
>From: "Lim Meng Koon" <ccelimmk@nus.edu.sg>
>To: <nork@gazeta.pl>, <security-basics@securityfocus.com>
>X-OriginalArrivalTime: 31 Jan 2003 01:24:19.0834 (UTC) FILETIME=
[7A7525A0:01C2C8C7]
>
>have you checked out dsniff?
Received on Fri Jan 31 19:16:59 2003