June 13, 2005

Sniffing in a Switched Network

Many of us know that sniffing is possible in a shared i.e. non-switched ethernet environment. But only few of us know that sniffing is also possible in a switched ethernet environment. One of the reasons is that it's not that straighforward. But it's not impossible or difficult. You can use man in the middle technique like ARP spoofing to sniff in a switched environment.

This presentation is an attempt to explain how can somebody sniff in a switched ethernet using ARP spoofing. Dsniff has existed for long as a tool for various sniffing activities. But recently, tools like EttercapNG have made it easier.


Sniffing in a Switched Network (PDF format)
Sniffing in a Switched Network (Microsoft PPT)

Manu Garg
"Truth will set you free!"

Technorati tags:

Digg this; Post to del.icio.us


  1. nice work GARG ,
    keep going on

  2. Old recycled info reworded. Good work man!

  3. Nice slide , I have posted a copy of it on secguru

  4. Great information. I was looking for a way to do packet sniffing with ethereal when I'm not using any "dumb hubs." But I was wondering, will this also work with routers?

  5. This won't work across routers as routers segregate arp broadcast domains. You can always own the router first, however ;-)

  6. nice stuff Manu, ettercap turned out to be pretty useful just like other MITM tools. I used it for two communicating machines in the same subnet and used the "oneway" tag to retarget the packets through my machine.

  7. www.oxit.it (Cain) can help with that too if you are looking for something specific