#Mac address sniffer driver#
What you have described is a correct processing of a broadcast frame including its payload by the NIC driver and the IP driver. OK, so I guess I would still have to have promisc enabled
So the frame arrives with dest mac set to FF:FF:FF:FF:FF and each host looks at the frame, next the network layer and all hosts (but not the one with the IP in question) would drope the fames / packet. In that case, broadcast frames would be visible in Wireshark regardless of the promisc mode setting. I suppose you are still asking about sniffing and Wireshark. When I'm running any sniffer on host C (connected to same switch, same VLAN) will I be able to see the packet ? Or do I have to enable promiscuous mode inside Wireshark ?īut in case of broadcast frames each and every host on same VLAN would see them, correct ? Or would I still have to enable promisc mode ? My question now is (if all the above is correct). Even though it will send it to all ports it's still a unicast. So the switch inspects it's CAM table looking for Host B's MAC and "says" i don't know where host B is at, so let me send the frame / packet to all ports. So because Host A knew the MAC address of Host B I'm more than sure that Host A sends out an unicast frame. Host A sends the packet, it arrives on the switch (it will not learn the port Host A is on, because the CAM table is full) but it will not find Host B's MAC address as well (I know, that it can be present, but let's assume that it's not). Host A has in his arp table the MAC address of host B. It fills up the whole MAC table ( 8.000, 16.000 entries, whatever).Now, Host A wants to connect to B (both on same switch, same VLAN).
Now let's consider that I run a MAC flooding attack on the switch in question. If I'm not mistaken, in a switched environment a host will see all unicast (directly addressed to it), broadcast (within same VLAN) and multicast (when belonging to the multicast group) frames. Happy new year to all the support forums members!
0 kommentar(er)
