Ethereal-users: Re: [Ethereal-users] Sniff all packets in a subnet

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jack Jackson <jack@xxxxxxxxxxxxxxx>
Date: Fri, 07 Oct 2005 15:17:54 -0700
The question is whether or not you can see traffic from other machines, other than broadcast traffic. To find out, run Ethereal and see if you see any non-broadcast traffic for which neither the source nor destination IP address is your IP address.

Modern networks use switches (which direct traffic only to the ports that need it) rather than hubs (which send all traffic to all ports). It would be unlikely that a large network would use hubs.

At 03:02 PM 10/7/2005, Tarun Siripurapu wrote:
Hi,

How are you confident that I am behind a switch and not a router? Is
there any way to find out?

Thanks,
Tarun

On 10/7/05, Breen Mullins <bmullins@xxxxxxxxxx> wrote:
> On Fri, 2005-10-07 at 01:50 -0700, Guy Harris wrote:
> > Breen Mullins wrote:
> >
> > > You're almost certainly connected to a switch (which is marketing-speak
> > > for a bridge),
> >
> > Really?
>
> Yes, really. What we call a switch (I do too...) is an instance of
> what the IEEE standard calls a 'transparent bridge'. It's the learning
> algorithm that allows the switch/bridge to make intelligent forwarding
> decisions which makes it a bridge.
>
> > I think of a bridge as a device that forwards all received
> > packets to those networks on the bridge, other than the one on which the
> > packet came in on,
>
> No, that's more like a repeater -- IEEE-speak for a hub.
>
> >
> > But, yes, Ethernet networks tend to be switched, these days, so A, B,
> > and C are probably plugged into a switch (perhaps with a router behind
> > the switch).
> >
>
> The original post refers to trying to sniff traffic in a dorm at Purdue
> University. As I said, it's absolutely certain that it's a switched
> network.
>