Re: arpwatch

[Tomas Wolf <tomas () skip cz>]

my 2c --
a) some switches horribly leak :-)
b) port mirroring would be the best bet (managable switches necessary)
c) some under heavy load work like hubs (flood it)

good luck - T.

zidan wrote:

> hello,
>
> I have recently installed arpwatch on one of our servers. I understood
> arpwatch "learns" arp replies, but since arp replies are destined to a
> specific MAC and
> this is a switched network, how can arpwatch see all arp replies ?
>
>
> -Z
>  



---------------------------------------------------------------------------
Captus Networks 
Are you prepared for the next Sobig & Blaster? 
- Instantly Stop DoS/DDoS Attacks, Worms & Port Scans 
- Precisely Define and Implement Network Security 
- Automatically Control P2P, IM and Spam Traffic 
FIND OUT NOW -  FREE Vulnerability Assessment Toolkit 
http://www.captusnetworks.com/ads/42.htm
----------------------------------------------------------------------------