Re: About promiscuous mode

[Max Laier <max () love2party net>]

On Tuesday 03 July 2007, l0he1g () 126 com wrote:
>     I'm a college student,now I'm programing a small sniffer use
> pcaplib.when I put into promiscuous mode as:
> handle=pcap_open_live(dev,SNAP_LEN,1,1000,errbuf); it only can receive
> packets post from or sent to me,cannot inercept any packets from others
> who is in the same LAN(Ethernet).My os is linux,but their are
> Windows.Does this has any matter?And what should I to if I want to
> capture all packets in my LAN?

[this is not necessarily the right mailinglist for this question, but ...]

In a switched LAN you will only see broadcasts and packets destined to the 
address(es) that are advertised behind your switch port.  The sollution 
is:
 a) use the "monitor" port on your switch
 b) use a hub rather than a switch
 c) overflow the forwarding table of your switch to turn it into a hub

The first being the preferred option, of course.

-- 
/"\  Best regards,                      | mlaier () freebsd org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier@EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News

Attachment: _bin
Description: