Yo Joe!
On Fri, 13 Sep 2002, Joe Touch wrote:
Without a dobut you are right, though I think the degree of difference is
awful small. Through hosts with root on switches or through wireless into
the mix and you are back to being roughly equivalent.
Hosts with root can't snoop anything but broadcast UDP on switches
unless the switch is configurable; many switches aren't.
root has no problem seeing adjacent UDP even on a switch. Just overflow the
arp cache or poison it.
Here is a link to how it is done:
http://dhar.homelinux.com/dhar/downloads/Sniffers.pdf
The dsniff package includes tools for this purpose:
http://monkey.org/~dugsong/dsniff/
RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 20340 Empire Blvd, Suite E-3, Bend, OR 97701
gem(_at_)rellim(_dot_)com Tel:+1(541)382-8588 Fax: +1(541)382-8676