Re: [SAGE] sniffing switched nets

["Mark C. Langston" <mark@bitshift.org>]

On Fri, Jan 25, 2002 at 11:42:19AM -0800, Strata Rose Chalup wrote:
> 
> David,
> 
> I've been given to understand that the technique involves reconfiguring
> the switch to copy traffic to a monitor port.  Given how easy it
> allegedly is to break into most switches, I think this is a valid line
> of attack.  


I believe Mudge (@Stake) gave a talk touching on this at USENIX
Security 2000 (if my memory isn't completely shot).  It's not always
necessary to break into the switch;  some switches will default to
hub-like behavior under certain circumstances, echoing every port
to every other port.

-- 
Mark C. Langston
mark@bitshift.org
Systems & Network Admin
http://www.bitshift.org