Full Disclosure mailing list archives
RE: Caching a sniffer
From: Kenton Smith <ksmith () chartwelltechnology com>
Date: Thu, 11 Mar 2004 11:01:19 -0700
On Thu, 2004-03-11 at 10:43, Mike Fratto wrote:
Your assuming that the attacker 1) has control of the switch and 2) is sniffing either the uplink or has configured the switch to mirror all the switch ports or VLAN to the mirror port. Neither of which may be the case.
There are many people on this list who have more knowledge of this than I do, but having control of the switch isn't the only way to sniff a switched network. All you need is a way of spoofing ARP packets and you can intercept all the traffic you want. Here's one such set of tools - http://naughty.monkey.org/~dugsong/dsniff/ Kenton _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Caching a sniffer Patricio Bruna V. (Mar 10)
- Re: Caching a sniffer Gary E. Miller (Mar 10)
- Re: Caching a sniffer Dave Horsfall (Mar 10)
- Re: Caching a sniffer morning_wood (Mar 11)
- Re: Caching a sniffer Tim (Mar 10)
- Re: Caching a sniffer Chris Adams (Mar 10)
- Re: Caching a sniffer Eric LeBlanc (Mar 11)
- Re: Caching a sniffer Simon Richter (Mar 11)
- Re: Caching a sniffer Kenton Smith (Mar 11)
- RE: Caching a sniffer Mike Fratto (Mar 11)
- RE: Caching a sniffer Kenton Smith (Mar 11)
- RE: Caching a sniffer David Bartholomew (Mar 11)
- Re: Caching a sniffer Simon Richter (Mar 12)
- RE: Caching a sniffer Justin Baldini (Mar 12)
- RE: Caching a sniffer Mike Fratto (Mar 11)
- <Possible follow-ups>
- Re: Caching a sniffer Ian Latter (Mar 10)
- Re: Caching a sniffer Cael Abal (Mar 10)
- RE: Caching a sniffer David Vincent (Mar 10)
- Re: Caching a sniffer Lan Guy (Mar 11)
- Re: Caching a sniffer Ian Latter (Mar 10)
- RE: Caching a sniffer Motiwala, Yusuf (Mar 11)