Re: Dual-Homed/Triple-Subnet Bridge Challenge

On 12.02.2008 20:52, Grant Taylor wrote:
> On 02/12/08 13:14, Vincent Callanan wrote:
>   
>> Just a by-the-way on this promiscuous mode business...
>>
>> I did in fact understand that modern switches (unlike old hubs) 
>> monitor MAC activity and learn where source and destination ports 
>> reside.  However, I assumed that if a NIC is placed in promiscuous 
>> mode, then this fact will somehow be communicated to the switch, 
>> perhaps in some status bit in packet headers, and the switch will 
>> then send all traffic to the NIC port.  Obviously, from what you say, 
>> this assumption is incorrect and I need have no concerns about my 
>> server getting overloaded with extraneous traffic.
>>     
>
> About the only thing that the client computer can to to effect what is 
> or is not sent to it (aside from doing some very nasty things with ARP) 
> is to enable Spanning Tree Protocol and mis-configure it and or allow 
> loops in the network.  If you want to have a discussion about STP, just 
> say the word.
>   

Yes, but unless the client is connected to two different switches, I
don't see a way to abuse STP to trick the switch to send all traffic to it.

>> But that leads me to ask the question:  How do Linux network sniffing 
>> utilities (which also use promiscuous mode) manage to pick up all 
>> traffic?
>>     
>
> In short, they do not.  The Linux (or what ever) networking sniffing 
> utilities only see the traffic that comes to the NIC its self.  That is 
> why if you want to sniff a switched network you either need to put a Hub 
> in-line or use a SPAN / Mirror port on a switch.  This way, all the 
> traffic makes it to the Linux (or what ever) system's NIC in promiscuous 
> mode.
>
> Remember that switches and bridges will (by default) only send traffic 
> to all ports if they do not know where the destination MAC is.  Thus if 
> they do know where the destination MAC is, they will send it only to the 
> destination MAC, *NOT* all ports.
>   

And exactly this is how you can force a switch to send all traffic to
the client. Have the client send a continuous stream of packets with a
spoofed source MAC of the computer you want to eavesdrop on. The switch
is tricked into learning that the most recent location of the victim is
the sniffing client. No need to mess with ARP. However, this usually
causes the switch to not send packets to the victim anymore, so it may
not be exactly what you want.
The other way to get all traffic to a switch relayed to the sniffing
client relies on downgrading the switch to a hub. Switches only have a
limited number of MAC addresses they can store in their forwarding
table. If you fill the table with fake entries, the switch doesn't know
where to send a specific packet and sends it everywhere. Thus, it has
effectively become a hub.

To prevent attacks of that type, you can enable port security on the
switch or use more advanced features.

On the other hand, if you are the network admin, you can tell a switch
to copy all traffic it receives to another port with a feature called
"port mirroring" or "roving analysis".

Regards,
Carl-Daniel

-- 
http://www.hailfinger.org/


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/