Penetration Testing mailing list archives
Re: unswitched behavior of a switched network...
From: Jon Hart <jhart () spoofed org>
Date: Sat, 14 Oct 2006 13:48:03 -0700
On Sat, Oct 14, 2006 at 07:52:27AM -0400, Michael Scheidell wrote:
My question is, has anyone seen a situation where the same broadcast behavior occurs, but the CAM table itself is not overloaded and there is no good reason for entries to be expiring? Furthermore, even if the entries were expired, has anyone encountered situations (malicious or otherwise), where a given port will receive traffic outside of its own L2?Broadcasts are, well, broadcasts. They have to broadcast. All broadcasts are passed to all ports.
Sorry, I shouldn't have used the term broadcast. What I'm seeing is snippets of conversations going on between another hosts that I should certainly not be seeing. This could be conversation between two other hosts on the same network as I am, other hosts on different VLANs, or a "local" host and some host somewhere out on the internet. The port I have access to is confirmed to be nothing special, and identical to what any other host on the network would have.
In fact, you will always see broadcasts, ipx, multicast, vrrp, CDP and other type messages on all ports.
Well, yes. I certainly see that, but I *expect* to see that.
Also, is it a Cisco? Or some other box? Some 'switches' are just cheap hubs (ok, expensive hubs) and if you have some 10mb and some 100mb traffic, it can act as a hub.
This is all Cisco. Thanks, -jon ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW ------------------------------------------------------------------------
Current thread:
- Re: unswitched behavior of a switched network..., (continued)
- Re: unswitched behavior of a switched network... Jon Hart (Oct 16)
- Re: unswitched behavior of a switched network... Tim (Oct 17)
- RE: unswitched behavior of a switched network... Erin Carroll (Oct 17)
- Re: unswitched behavior of a switched network... David C. Smith (Oct 18)
- Re: unswitched behavior of a switched network... Florian Osses (Oct 16)
- Re: unswitched behavior of a switched network... Can't dig that daddy (Oct 16)
- Re: unswitched behavior of a switched network... Jon Hart (Oct 16)
- RE: unswitched behavior of a switched network... Tonnerre Lombard (Oct 17)