RE: Caching a sniffer

["David Gillett" <gillettdavid () fhda edu>]

> -----Original Message-----
> From: Shawn Jackson [mailto:sjackson () horizonusa com]
>
> > 1. Dump the entire MAC table.  Switch acts as if power on reset just
> > occurred.
>
> Seams logical, but I've never seen it implemented. It would 
> halt traffic while learning resumes, in addition if other checks 
> needed to run (Spanning Tree/CDP) it would take much longer.

  No.  Traffic will flood while learning restarts from scratch.
Nothing was said about dumping STP/CDP statuses.

> > 2. Stop learning.  All previously learned MAC addresses 
> > remain, and so only traffic for unrecognized MAC addresses 
> > gets sent to all ports.
>
> That would damage the network. If a new client fires up, they 
> would not get added to the switches tables and not receive any 
> traffic.

  Destinations not in the table normally get flooded, not dropped.
Dropping this traffic is possible, but not a normal part of the
action being suggested.
 
> > 3. Partial Purge of table.  Some portion of the table gets purged and
> > the switch continues, treating those purged MAC addresses as if this 
> > was the first time they were seen.  Depending upon how the purged 
> > addresses are selected - oldest first, youngest first, random, lowest 
> > MAC addresses, highest MAC addresses or something else - will cause 
> > the switch to act differently for different users.
>
> Seams a better solution out of the bunch, could be a pain to 
> implement.

  Some switches routinely age unused entries out of the table.
Accelerating this process if the table fills shouldn't be too hard.
 

---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off 
any course! All of our class sizes are guaranteed to be 10 students or less 
to facilitate one-on-one interaction with one of our expert instructors. 
Attend a course taught by an expert instructor with years of in-the-field 
pen testing experience in our state of the art hacking lab. Master the skills 
of an Ethical Hacker to better assess the security of your organization. 
Visit us at: 
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------