Re: [Nolug] Packet sniffing on switched network

From: Joey Kelly <>
Date: Fri, 1 Feb 2008 14:03:17 -0600
Message-Id: <>

On Friday 01 February 2008 01:33:22 pm -ray wrote:
> On Fri, 1 Feb 2008, Joey Kelly wrote:
> > 3. Or you could go the l33t way and flood the linksys's arp cache,
> > forcing it to fail open and defaulted to a layer-1 device, after which
> > you could put your linux box anywhere on the LAN and sniff all traffic
> > ;-)
> Well even after it fails open, it's still "ethernet", so i contend it's
> still a layer-2 device. Everyone get out your OSI chart. :)

Smarty. But a hub is layer 1, unless I'm as rusty as you claim, and a
failed-open switch is equivalent to a hub.

> But i digress... Have you ever successfully had a switch 'fail open'?

No, I've never tried it before, but I smell a lab at the meeting later this

Joey Kelly
< Minister of the Gospel | Linux Consultant >

Nolug mailing list

Received on 02/01/08

This archive was generated by hypermail 2.2.0 : 12/19/08 EST