RE: Sniffing in switched network

["Trevor Cushen" <Trevor.Cushen () sysnet ie>]

Not sure what you are asking, if you are asking is there a way to find
poisoned arps on your network then the answer is yes, ETTERCAP will do
that for you.  If you are looking for good tools to sniff in a switched
environment then ETTERCAP and DSNIFF are very good tools and both handle
switched networks.

Google searches will quickly find both for you.

Hope this helps.

Trevor Cushen
Sysnet Ltd

www.sysnet.ie
Tel: +353 1 2983000
Fax: +353 1 2960499



-----Original Message-----
From: nork () gazeta pl [mailto:nork () gazeta pl] 
Sent: 30 January 2003 12:52
To: security-basics () securityfocus com
Subject: Sniffing in switched network




Hello,



I've read through some documentation about sniffing the

switched network. There are some arp-cache methods to

discover a sniffing host (switched or "normal" network

is not important here I think), if it is the switched

network will I get the result I want, or first I have

to become a  sniffer also (i.e. arp-poison the switch

cache) - to get the responses that will tell me who is

the sniffer?



Most documentation I read is somewhat old (2 years), is

everything aleady well known and described in this

subject or are there any running projects? 



Thanks for help,



Norbert


**************************************************************************************

This email and any files transmitted with it are confidential and intended 
solely for the use of the individual or entity to whom they are addressed. 

If you have received this message in error please notify SYSNET Ltd., at
telephone no: +353-1-2983000 or postmaster () sysnet ie

**************************************************************************************