‫So switches make it difficult to sniff the network traffic in the past, the traffic was being sent
‫to all ports with the hub technology with switches.
‫The traffic is directed only to the specified port.
‫So a network device only receives its own packets, not the others.
‫We need to use some techniques to sniff the traffic of the other devices then, huh?
‫These are some of the techniques to expand this sniffing space, you thought it couldn't be done.
‫So we'll talk about spane switched Porta Analisa or port mirroring, so that's a method of monitoring.
‫Network traffic with port mirroring enabled the switch sends a copy of all network packets seen on one
‫port or an entire van to another port where the packet can be analyzed.
‫Port Maring is supported by almost all enterprise class switches.
‫I can think of so, in other words, managed switches.
‫It allows a particular computer to see the network traffic, which is normally hidden from it.
‫You can monitor the entire traffic sent from the switch by copying its uplink port.
‫Now you have to have physical access and the admin privileges on that switch, so this method is often
‫used to send the network traffic to the IBS, which is typically an intrusion detection system device.
‫In a Mac address table overflow attack, also known as Mac flooding attack within a very short time.
‫The switches Mac address table is full with fake Mac address and port mappings.
‫Switches Mac address table has only a limited amount of memory, and when that table is full, the switch
‫cannot say any more Mac addresses in it.
‫So once the switch is MacArthur's table is full and it can't save anymore, Mac addresses, it generally
‫enters into a feel open mode and it starts behaving like a network.
‫Up frames are flooded to all ports similar to broadcast type of communication.
‫So as an attacker in the network, you start to receive the frames of others.
‫You know, address resolution protocol, AARP or AAP is network or protocol used for mapping a network
‫address, such as an IP address to a physical address such as a Mac address, a system asks for the
‫owner of an IP address by sending in our request, and the owner of the IP address answers him with
‫an hour reply.
‫What if the attacker replies first before the owner of the IP?
‫Once the attackers Mac address is connected to an authentic IP address, the attacker will begin receiving
‫any data that is intended for that IP address.
‫This is the basic principle of AAFP spoof attacks.
‫Our poisoning can be achieved because of the lack of authentication in the art protocol so the attacker
‫can send a spoofed art message onto the LAN.
‫Would you like to make the attack much more powerful?
‫Mm hmm.
‫I suspected as much.
‫Then you've got to replace your Mac with the gateway so every packet sent by the victim will be in your
‫malicious hands.
‫But we are ethical hackers.
‫Remember?
‫Dynamic host Configuration Protocol DHP is a protocol used to provide automatic and central management
‫for the distribution of IP addresses within a single network, is also used to configure the proper
‫subnet mask, default gateway and DNS server information on the particular device.
‫Now, similar to the other types of spoofing attacks, DHP spoofing involves an attacker pretending
‫to be someone else, in this case acting as the legitimate DHP server.
‫Since DHP is used to provide a dressing and other information, a client losing control of this part
‫of the network can be very dangerous.
‫In DCPI spoofing attacks, the attacker places a road server on the network and has clients are turned
‫on and request an address, the server with the fastest response is used if the device receives a response
‫from the rogue server first, the rogue server can assign any address as well as control which device
‫it uses as a gateway.
‫So a well-designed attack can collect traffic from local hosts to a rogue server that logs all traffic
‫and then forwards out the traffic to the correct gateway or to the device.
‫So this action would be almost transparent.
‫Thus, the attacker can steal information almost invisibly.