Re: Q on external router

[Bernhard Schneck <Bernhard_Schneck () genua de>]

In message <Pine.SUN.3.95.980422171232.27846D-100000 () is3 hk super net> you writ
e:
> After posting my question, I searched the archive at nfr.net and the
> argument by "Adam Shostack" against a switch in the DMZ was not that it
> cannot prevent sniffing but rather, it may not stand malicious attack.
> However, he did not quote any concrete evidence or example because these
> are relatively new.

Switches have finite storage for ARP entries (usually some power of
2, say 4096 or 8192).  Flood them with enough (bogus) ARPs and most
of them will start passing all packets.

POOF.

\Bernhard.