Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Firewall Wizards: Re: Sniffing DSL Connection

Re: Sniffing DSL Connection

From: Crispin Cowan <crispin_at_immunix.com>
Date: Sun, 14 Sep 2003 17:58:44 -0700

Chuck Swiger wrote:

> Jeff_Lopes_at_groove.net wrote:
>
>> DSL Modem ---> Hub ---> Linksys Router ---> Internal Machines
>>
>> I then put a Linux machine on the hub and ran ethereal. No traffic!
>
> Do you have a real IP address from the DSL modem, or does your Linksys
> do PPPOE? If it's the latter, all of the IP traffic is being
> encapsulated within PPP-- ethereal should still see the traffic, but
> trying to match by IP addr will fail.

Or, your "hub" isn't really a hub. I've encountered a recent phenomena
where network equipment vendors are selling small devices marked as
"hubs" that are really switches. For most purposes this doesn't matter,
and in fact is just a free upgrade. But if you're trying to use the hub
as a network monitoring tap, you're SOL.

Test: put the hub on some other network that you *know* is carrying
normal IP traffic and see if you see anything.

Crispin

-- 
Crispin Cowan, Ph.D.           http://immunix.com/~crispin/
Chief Scientist, Immunix       http://immunix.com
            http://www.immunix.com/shop/
_______________________________________________
firewall-wizards mailing list
firewall-wizards_at_honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
Received on Sep 15 2003
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
edgeos