‫So switches make it difficult to sniff the network traffic in the past, the traffic was being sent
‫to all ports with the hub technology with switches.
‫The traffic is directed only to the specified port, so a network device only receives its own packets,
‫not the others.
‫So we need to use some techniques to sniff the traffic of the other devices then.
‫Huh?
‫These are some of the techniques to expand the sniffing space.
‫You thought it couldn't be done?
‫So we'll talk about span switched port analyzer or port mirroring, so that's a method of monitoring
‫network traffic with port mirroring enabled, the switch sends a copy of all network packets seen on
‫one port or an entire V man to another port where the packet can be analyzed.
‫Port mirroring is supported by almost all enterprise class, which is all I can think of.
‫So, in other words, managed switches.
‫It allows a particular computer to see the network traffic, which is normally hidden from it.
‫You can monitor the entire traffic sent from the switch by copying its uplink port.
‫Now you have to have physical access and the admin privileges on that switch.
‫So this method is often used to send the network traffic to the ABC, which is typically an intrusion
‫detection system device.
‫In a Mac address table overflow attack, also known as Mac flooding attack within a very short time,
‫the switches.
‫Mac address table is full with fake Mac address and port mappings.
‫Switches Mac address table has only a limited amount of memory.
‫And when that table is full, the Switch cannot say any more Mac addresses in it.
‫So once this switches, MacArthur's table is full and it can't save anymore, Mac addresses, it generally
‫enters into a fail open mode, and it starts behaving like a network of frames are flooded all ports
‫similar to broadcast type of communication.
‫So as an attacker in the network, you start to receive the frames of others.
‫You know, address resolution protocol, AAP or AAP is network layer protocol used for mapping a network
‫address such as an IPv4 address to a physical address, such as a Mac address?
‫A system asks for the owner of an IP address by sending an AAP request, and the owner of the IP address
‫answers him with an ARP reply.
‫What if the attacker replies first before the owner of the IP?
‫Once the attacker's Mac address is connected to an authentic IP address, the attacker will begin receiving
‫any data that is intended for that IP address.
‫This is the basic principle of AAP spoof attacks.
‫Arp poisoning can be achieved because of the lack of authentication in the protocol, so the attacker
‫can send a spoofed art message on to the land.
‫Would you like to make the attack much more powerful?
‫Hmm.
‫I suspected as much.
‫Then you've got to replace your Mac with the Gateway, so every packet sent by the victim will be in
‫your malicious hands.
‫But we are ethical hackers remember.
‫Dynamic host configuration protocol DHP is a protocol used to provide automatic and central management
‫for the distribution of IP addresses within a single network is also used to configure the proper subnet
‫mask, default gateway and DNS server information on the particular device.
‫Now, similar to the other types of spoofing attacks, DHP spoofing involves an attacker pretending
‫to be someone else, in this case acting as the legitimate DHCP server.
‫Since DHP is used to provide addressing and other information, a client losing control of this part
‫of the network can be very dangerous.
‫In DHP, spoofing attacks, the attacker places a rogue DHP server on the network and his clients are
‫turned on and request an address, the server with the fastest responses used if the device receives
‫a response from the rogue server.
‫First, the rogue server can assign any address as well as control which device it uses as a gateway.
‫So a well designed attack can collect traffic from local hosts to a rogue server that logs all traffic
‫and then forwards out the traffic to the correct gateway or to the device.
‫So this action would be almost transparent.
‫Thus, the attacker can steal information almost invisibly.