Before we move on to analyze the tax on the second oh layer we have to explain one more thing.
There are two kinds of devices operating in the Linkletter.
These are hubs and switches.
Hubs are still in use though they're getting less and less popular.
They differ and that they pass on the frames that they receive when a hub receives a frame it will get
forwarded through all ports.
This is called broadcast.
In this case everyone can receive the frame but obviously the only receiver should be the network card
that the frame was addressed to.
On the other hand a switch would forward the frame through a port connected to the host identified by
the MAC address appearing in the frame.
Someone may ask how does a switch know which port a given host is connected to.
This is not part of a switch initial configuration switch learns which hosts are connected to which
ports.
If it doesn't have that information it forwards incoming packets to all hosts that are connected to
it.
Only one of them should give a response message only one port should actually receive the packet.
This is how the switch learns that a computer identified by the MAC address ending in 0 9 is connected
to the port number 12.
This information is then stored in the cam memory.
It's an associate of memory.
And contrary to address based memory such as Ram Kammas a content based memory as a consequence a switch
can work like a hub.
This is how it works right after the first start of it can also be changed to the hub mode by an attacker
almost every network is based on switches.
You won't be able to intercept data sent between hosts just by connecting to the medium because of the
mechanism we just described.
You won't get data that's not addressed specifically to your machine
the port your computer uses won't get any needless signals.
This problem is typical of wired networks.
It's not present in wireless networks.
In wireless networking all users share the same medium.
Therefore attacks on wireless networks don't require the attacker to perform all the operations we're
about to discuss such as poisoning victims RPE cash
the first way to intercept traffic in a wired network is to change the switch configuration.
It must be forced into hub mode.
One way to implement this kind of attack is by using a program called Murkoff the program flood switches
with random IP addresses with attached MAC addresses.
The switch must remember all of them usually users by cheaps switches.
So it may be expected that the devices can memory will shortly be full then it will no longer be able
to remember which hosts connected to which port how the switch will react depends on a specific model.
Some models go into the hub mode.
It broadcasts the packets which ensures that the network won't go down.
Newer models usually block the port that receives the flood of random IP and MAC addresses.
Still others just crash switch manufacturers reacted to the threat coming from the May off program.
Therefore a new version of the program was created.
This time it uses only IP addresses from the local network.
Switch flooding is however not very effective.
It depends on something that the attacker doesn't control the switch reaction.
It's also a very noisy method.
It may end up as a DNS attack affecting the whole company a typical company network has a hierarchical
structure.
The first flooded switch starts broadcasting packets everywhere even through the uplink port which sends
them upward in the hierarchy.
This may lead to the flooding of the whole network which would obviously prevent you from intercepting
any meaningful network traffic.
Therefore another frequent attack consists of AARP cache poisoning the AARP or address resolution protocol
is responsible for IPN MAC address mapping.
When you want to connect to a host you don't use its MAC address but either it's IP or its name a mechanism
must exist that would change the IP you type to the MAC address and it's done through broadcasting.
If a computer learns that a MAC address ending in 0 9 corresponds to a machine identified with an IP
address ending in 12 it will save this information the information will be saved in the AARP cache buffer.
After that whenever your computer will try to establish a connection with the machine of a given IP
it will send packets to the MAC address saved in the buffer.