RE: unswitched behavior of a switched network...

["Michael Scheidell" <scheidell () secnap net>]

> -----Original Message-----
> From: listbounce () securityfocus com 
> [mailto:listbounce () securityfocus com] On Behalf Of Jon Hart
> Sent: Friday, October 13, 2006 12:32 PM
> To: pen-test () securityfocus com
> Subject: unswitched behavior of a switched network...
>
> My question is, has anyone seen a situation where the same 
> broadcast behavior occurs, but the CAM table itself is not 
> overloaded and there is no good reason for entries to be 
> expiring?  Furthermore, even if the entries were expired, has 
> anyone encountered situations (malicious or otherwise), where 
> a given port will receive traffic outside of its own L2?

Broadcasts are, well, broadcasts.  They have to broadcast.  All
broadcasts are passed to all ports.

In fact, you will always see broadcasts, ipx, multicast, vrrp, CDP and
other type messages on all ports.

Also, is it a Cisco? Or some other box? Some 'switches' are just cheap
hubs (ok, expensive hubs) and if you have some 10mb and some 100mb
traffic, it can act as a hub.

-- 
Michael Scheidell, CTO
561-999-5000, ext 1131
SECNAP Network Security Corporation
 

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------