So switches make it difficult to sniff the network traffic in the past, the traffic was being sent
to all ports with the hub technology with switches.
The traffic is directed only to the specified port, so a network device only receives its own packets,
not the others.
We need to use some techniques to sniff the traffic of the other devices then, huh?
These are some of the techniques to expand this sniffing space, you thought it couldn't be done.
So we'll talk about spane switched to analyzer or port mirroring.
So that's a method of monitoring.
Network traffic with port mirroring enabled the switch sends a copy of all network packets seen on one
port or an entire van to another port where the packet can be analyzed.
Port mirroring is supported by almost all enterprise class, which is I can think of.
So in other words, managed switches.
It allows a particular computer to see the network traffic, which is normally hidden from it.
You can monitor the entire traffic sent from the switch by copying its uplink port.
Now you have to have physical access and the admin privileges on that switch, so this method is often
used to send the network traffic to the IBS, which is typically an intrusion detection system device.
In a Mac address table overflow attack, also known as Mac flooding attack within a very short time.
The switches Mac address table is full with fake Mac address and port mappings.
Switches Mac address table has only a limited amount of memory, and when that table is full, the switch
cannot say any more Mac addresses in it.
So once this switch is MacArthur's table is full and it can't save anymore, Mac addresses, it generally
enters into a fail open mode and it starts behaving like a network.
Up frames are flooded to all ports similar to broadcast type of communication.
So as an attacker in the network, you start to receive the frames of others.
You know, address resolution protocol, AARP or AAP is network or protocol used for mapping a network
address, such as an IP address to a physical address such as a Mac address, a system asks for the
owner of an IP address by sending in our request, and the owner of the IP address answers him with
our reply.
What if the attacker replies first before the owner of the IP?
Once the attackers Mac address is connected to an authentic IP address, the attacker will begin receiving
any data that is intended for that IP address.
This is the basic principle of AAFP spoof attacks.
Our poisoning can be achieved because of the lack of authentication in the protocol so the attacker
can send a spoofed art message onto the land, would you like to make the attack much more powerful?
Mm hmm.
I suspected as much.
Then you've got to replace your Mac with the gateway, so every packet sent by the victim will be in
your malicious hands.
But we are ethical hackers, remember?
Dynamic host Configuration Protocol DHP is a protocol used to provide automatic and central management
for the distribution of IP addresses within a single network, is also used to configure the proper
subnet mask, default gateway and DNS server information on the particular device.
Now, similar to the other types of spoofing attacks, DHP spoofing involves an attacker pretending
to be someone else, in this case acting as the legitimate DHP server.
Since DCPI is used to provide dressing and other information, a client losing control of this part
of the network can be very dangerous.
And DCPI spoofing attacks, the attacker places a road server on the network and his clients are turned
on and request an address, the server with the fastest responses used.
If the device receives a response from the rogue server first, the rogue server can assign any address
as well as control which device it uses as a gateway.
So a well-designed attack can collect traffic from local hosts to a rogue server that logs all traffic
and then forwards out the traffic to the correct gateway or to the device.
So this action would be almost transparent.
Thus, the attacker can steal information almost invisibly.