RE: MiM Simultaneous close attack

["David Schwartz" <davids () webmaster com>]

> Excuse my ignorance, but wouldn't a switched network be a remedy for this
> attack?  Unless you are using some type of 'port mirroring' functionality
> (at the switch) the attacking computer sitting in promiscuous mode would
> only hear broadcast traffic.  Right? Or am I missing something?

        The attack issue is that if a certain packet is sent, the two hosts will
get into an endless loop. How hard or easy it is to send that packet
mitigates the attack but doesn't remedy it. To remedy it, the behavior in
response to that packet would have to change. Staying out of the jungle
isn't a remedy for malaria.

        DS