# Switches and packet sniffing

## daschapa

I have a home LAN, consisting in three computes + NAT'ed router. All conected to a cheap switch.

The doubt came to me when my brother was playing "Mu" (an eye-candy, brain-boring MMORPG) in his windoze box. I noticed that Wireshark wasn't catching such frames.

I know Mu to send/receive a lot of datagrams every second. But my wireshark, looks like being catching only broadcast frames and the ones wich has my host as recipient. I've checked the box wich gets eth0 in promiscuous mode.

So, I'm beggining to suspect that maybe, switches are such smart to learn where a mac is and deliver  a frame only trough such wire (I know bridges to do this, but not switches). Is this correct? or maybe my cheap ethernet card can't be turned in promiscuous mode?

----------

## NeddySeagoon

daschapa,

Thats right, switches learn where to deliver packets. It keeps traffic down, avoids collisions on the network and allows full duplex operation.

You need an old fashioned hub.

----------

## JeliJami

http://en.wikipedia.org/wiki/Network_switch

http://en.wikipedia.org/wiki/Network_hub

----------

## daschapa

Thanx guys.

So, we can say that switches are, not only more efficient, but also more secure than hubs.

Is there any way to get a Switch in "promiscuous mode"? LOL

----------

## RoundsToZero

Some fancier ones have special monitor ports, otherwise if you can get the switch to reset itself, it will have to start broadcasting on all ports again.  Not sure how long this lasts for, but it might give you a chance to get a leg up.  Ways to get it to reset itself are power cycling (obviously) or maybe if it's cheap and you flood it with enough weird packets it'll give up, fail open, and there you go.

Or just position your machine between the switch and wherever all the packets are going to and run the packet trace from there.

----------

## zeek

Or

```
emerge ettercap
```

and arppoison your brothers MAC.  Then you'll see ALL his traffic because your machine will be relaying all the packets for your brothers machine.

----------

