Network Security – Hub or Switch?



So, for those that have a little bit of knowledge about network hardware, you’ve probably heard this. “You can’t sniff switched networks”…. wrong…. let’s see what this is about. Older networking hardware was dominated by what’s called a hub. This was basically a “dumb” device that when it received data, it would retransmit the data to every machine connected with the expectation that the correct recipient would answer and all others would ignore that data. Of course, this stream of data is possible to watch and easily available software could log all network traffic fairly easily.


So, anything that is unencrypted could be captured and analyzed by any machine hooked up to a hub. But switches were supposedly smarter and some still think that a switch prevents network sniffing. A switch is supposed to know which machines are connected to which ports. So, data destined for machine A ONLY goes to machine A. This knowledge of what machine is where relies upon MAC addressing. So, this is susceptible to a number of attacks.

First, using easily available software, an attacking machine could flood the switch with bogus (false) MAC addresses, at which point the switch will likely give up and fallover to “hub” mode. Also, it’s possible to change the mac address of a network interface. This is another fairly easily available attack. The idea is that you duplicate the MAC address of the “target machine” and then both machines receive the same data from the switch.

There’s yet another approach though that has more interesting possibilities in the area of risk though. That is something called ARP spoofing (or arp poisoning.)

So, in short, switched networks can easily be sniffed.

Related Posts

Blog Traffic Exchange Related Posts
  • SSH, Proxies (Proxy's?), Tor and Web Browsing For quite some time I've been making use of a dd-wrt modified linksys box on my home network as an openvpn endpoint so that when I'm out and about in the world, I connect the vpn, switch firefox to route through a squid proxy server on the home network and......
  • Wireless ethernet security Flexbeta has an article giving a good primer on the different approaches to wireless security that are currently available and what seems to be on track for the next generation of wireless networking. One thing that is worth noting, if it's transmitted through the air it can be intercepted. Breaking......
  • The basics Well to start out, this might should be crosslinked in the computer security section, but I'm putting it in commentary primarily to catch those who might not typically look at computer security. First, why should you care about keeping your computer secure? I've heard people ask something like this. Usually......
Blog Traffic Exchange Related Websites
  • Using Login Banner on a Mac OS X system What is a login Banner? A login banner is a statement made by the system owner that asserts their rights and informs the users of the system what expectation of privacy they should have. Login banners are a critical aspect of IT system security as they allow IT systems administrators......
  • Wireless Broadband Internet-whether It Is LAN Or WAN Service-is Associated Having A Wireless broadband Internet-whether it is LAN or WAN service-is associated having a number of diverse myths. These typically center on security and need to do with anxiety about how info is transmitted over a wireless connection and, furthermore, need to do with concerns about eavesdropping, in several cases. You will......
  • Make Free Phone Calls with Google Voice, Gizmo, and Orgasmatron V: Google Voice Edition Earlier this year, I had posted a hack for making free phone calls with Google Voice, Gizmo, and Asterisk. Since then, Google closed the door on inbound SIP calls and thus the hack no longer works. Fortunately a new possibility has emerged that makes it possible once again. Nerd Vittles......
PDF24    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site