Wireshark · Ethereal-users: Re: [Ethereal-users] sniffing in a switched network - arp spoofing using ettercap and ethereal

[Jay Taylor <foosyou@xxxxxxxxx>]

Instead of crippling the network by using a hub near the core or spoofing arp you can mirror a port on most managed switches. Mirroring (or SPAN in Cisco speak) forwards an additional copy of each from from the spanned port to the port you connect your network analyzer to. This method has no impact on the other hosts communicating through the switch as long as the switch is robust enough for the traffic it will pass. Keep in mind that the port you attach your network analyzer to may drop packets if it can not handle the cumulative bandwidth of all the ports it is monitoring. IE: If you try to monitor several hosts with 100Mb connections it could quickly overwhelm the 100Mb link you are analyzing from.

Ulf Lamping wrote:

Manu Garg wrote:

  

Many of us know that sniffing is possible in a shared i.e.
non-switched ethernet environment. But only few of us know that
sniffing is also possible in a switched ethernet environment. One of
the reasons is that it's not that straighforward. But it's not
impossible or difficult. You can use man in the middle technique like
ARP spoofing to sniff in a switched environment.


This presentation is an attempt to explain how can somebody sniff in a
switched ethernet using ARP spoofing. Dsniff has existed for long as a
tool for various sniffing activities. But recently, tools like
EttercapNG have made it easier.


Link to my original post and presentation -
http://manugarg.freezope.org/2005/06/sniffing-in-switched-network-many-of.html

Presentation-
http://manugarg.freezope.org/notes/arp_spoofing

Please let me know your views on it.
 

    

Yes it is possible, but it is really ugly for it's various side effects.

Have a look at the information on this topic so far at:
http://wiki.ethereal.com/CaptureSetup_2fEthernet

As the wiki page says:

*Please do not try this on any LAN other than your own.*

Regards, ULFL

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users