So switches make it difficult to sniff the network traffic.
In the past, the traffic was being sent to all ports with a hub, technology with switches.
The traffic is directed only to the specified port, so a network device only receives its own packets,
not the others.
So we need to use some techniques to sniff the traffic of the other devices then, huh?
These are some of the techniques to expand the sniffing space.
You thought it couldn't be done.
So we'll talk about span switched port analyzer or port mirroring.
So that's a method of monitoring network traffic.
With port mirroring enabled, the switch sends a copy of all network packets seen on one port or an
entire Vlan to another port where the packet can be analyzed.
Port mirroring is supported by almost all enterprise class switches that I can think of.
So in other words, managed switches, it allows a particular computer to see the network traffic which
is normally hidden from it.
You can monitor the entire traffic sent from the switch by copying its uplink port.
Now you have to have physical access and the admin privileges on that switch.
So this method is often used to send the network traffic to the IDs, which is typically an intrusion
detection system device.
In a mac address table, overflow attack, also known as Mac Flooding attack within a very short time.
The switches Mac address table is full with fake Mac address and port mappings.
Switches.
Mac address table has only a limited amount of memory, and when that table is full, the switch cannot
save any more Mac addresses in it.
So once the switches Mac address table is full and it can't save any more Mac addresses, it generally
enters into a fail open mode and it starts behaving like a network hub.
Frames are flooded to all ports similar to broadcast type of communication.
So as an attacker in the network, you start to receive the frames of others.
You know, address resolution protocol.
ARP or ARP is a network layer protocol used for mapping a network address, such as an IPV four address
to a physical address, such as a mac address.
A system asks for the owner of an IP address by sending an ARP request and the owner of the IP address
answers him with an ARP reply.
What if the attacker replies first before the owner of the IP?
Once the attacker's Mac address is connected to an authentic IP address, the attacker will begin receiving
any data that is intended for that IP address.
This is the basic principle of ARP spoof attacks.
ARP poisoning can be achieved because of the lack of authentication in the ARP protocol so the attacker
can send a spoofed ARP message onto the LAN.
Would you like to make the attack much more powerful?
Hmm.
I suspect it as much.
Then you've got to replace your Mac with the gateway.
So every packet sent by the victim will be in your malicious hands.
But we are ethical hackers, remember?
Dynamic host configuration protocol.
Dhcp is a protocol used to provide automatic and central management for the distribution of IP addresses
within a single network.
It's also used to configure the proper subnet mask, default gateway and DNS server information on the
particular device.
Now similar to the other types of spoofing attacks, Dhcp spoofing involves an attacker pretending to
be someone else, in this case acting as the legitimate Dhcp server.
Since Dhcp is used to provide, addressing and other information to clients, losing control of this
part of the network can be very dangerous.
In Dhcp spoofing attacks.
The attacker places a rogue Dhcp server on the network and as clients are turned on and request an address,
the server with the fastest response is used.
If the device receives a response from the rogue server first, the rogue server can assign any address
as well as control which device it uses as a gateway.
So a well-designed attack can collect traffic from local hosts to a rogue server that logs all traffic
and then forwards out the traffic to the correct gateway or to the device.
So this action would be almost transparent.
Thus, the attacker can steal information almost invisibly.