RE: ARP Spoof Question

["Stuart" <secmail () patchsupplier dyndns org>]

If we use a Cisco switch for example, don't they have a learning period?
I would presume that the switch would go through the process of building
its ARP tables again.

Stu

-----Original Message-----
From: Simon Gray [mailto:simong () desktop-guardian com] 
Sent: 23 July 2003 17:10
To: vineet () linux com kw; security-basics () securityfocus com
Subject: Re: ARP Spoof Question

> Q1.My Question is, Node C will also reply to that request of Node A. SO
> now Node A has 2 different MAC for the same IP. How is Node A handling
> this situation???
> Q2.The switch also updates its table of IP/MAC address bindings, so how
> is switch handling this situation???
> Is it "first-come-first-serve" methodology which Node A/Switch takes???

I don't know how correct this is, but I would of thought the Node
A/Switch
would update whatever stored record of IP/MAC it has with the new
details.

Simon


------------------------------------------------------------------------
---
------------------------------------------------------------------------
----



---------------------------------------------------------------------------
----------------------------------------------------------------------------