Re: [Nolug] Packet sniffing on switched network

On Fri, 1 Feb 2008, Joey Kelly wrote:

> Smarty. But a hub is layer 1, unless I'm as rusty as you claim, and a
> failed-open switch is equivalent to a hub.

Yea there's probably some overlap between layer 1 and 2, just like between
layers 2 and 3. In my mind, it's not a "hub", it's an "ethernet hub".
If you had some ATM, Frame Relay, PPP, or Token Ring lines (all also
layer 2) that happened to terminate into a RJ-45 plug, sure you could plug
them into the hub. But they're not gonna work.

The hub has to know what an Ethernet frame looks like to pull it off the
layer-1 wire and reliably repeat/retransmit it. Even the dumbest,
cheapest hub you can find still has to know all about CSMA/CD (carrier
sense, multiple access, collission detection)... it "talks" ethernet, so I
classify it as layer 2.

The copper wire, or the fiber, or even the air (wireless) is layer 1.

> No, I've never tried it before, but I smell a lab at the meeting later this
> month.

Interesting... let us know what you find out. ARP is a nasty protocol...
you can really wreak some havoc on a network if you know about ARP haha.

ray
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Ray DeJean http://www.r-a-y.org
Systems Engineer Southeastern Louisiana University
IBM Certified Specialist AIX Administration, AIX Support
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

___________________
Nolug mailing list
nolug@nolug.org
Received on 02/01/08