Wireshark · Ethereal-users: Re: [Ethereal-users] sniffing in a switched network - arp spoofing using ettercap and ethereal

[Ulf Lamping <ulf.lamping@xxxxxx>]

Manu Garg wrote:

>Many of us know that sniffing is possible in a shared i.e.
>non-switched ethernet environment. But only few of us know that
>sniffing is also possible in a switched ethernet environment. One of
>the reasons is that it's not that straighforward. But it's not
>impossible or difficult. You can use man in the middle technique like
>ARP spoofing to sniff in a switched environment.
>
>
>This presentation is an attempt to explain how can somebody sniff in a
>switched ethernet using ARP spoofing. Dsniff has existed for long as a
>tool for various sniffing activities. But recently, tools like
>EttercapNG have made it easier.
>
>
>Link to my original post and presentation -
>http://manugarg.freezope.org/2005/06/sniffing-in-switched-network-many-of.html
>
>Presentation-
>http://manugarg.freezope.org/notes/arp_spoofing
>
>Please let me know your views on it.
>  
>
Yes it is possible, but it is really ugly for it's various side effects.

Have a look at the information on this topic so far at:
http://wiki.ethereal.com/CaptureSetup_2fEthernet

As the wiki page says:

*Please do not try this on any LAN other than your own.*

Regards, ULFL