[olug] mystifying cable modem problem

[Dave Hull]

Quoting Bill Brush <bbrush at unlnotes.unl.edu>:

> 1.  A 10base-T network can be switched also.
>
> 2.  A 100base-T network can be run on a hub.
>
> 3.  Even if the network is switch you can use a promiscuous port to see
> everything (on a managed switch).
>
> 4.  On an unmanaged switch you can use certain tools to do Arp poisoning so
> your monitoring station can act as the man in the middle.

>From what I hear, some switches "fail open" or revert to a hub like mode if they
are overwhelmed (buffer overrun?) or otherwise compromised. If you can make that
happen on the network in question, you can see pretty much everything.

--
Dave Hull
http://insipid.com