Hey all,

I have been playing with Ethereal on our company network, (it's what sysadmin does when b0red), but I can't get it to monitor all traffic - it only seems to pick up frames sent from, or directly TO the LOCAL network interface (ethX). I was of the impression that with CSMA, (ie ethernet-ness), all packets and frames on the network bus could be sniffed.

Perhaps it's just an options with Ethereal that has to be set.. of if anyone knows how to do it using tcpdump, I could probably work it out from there. It would be extremely useful for us to be able to monitor all traffic on some of our more secure areas.

thanks
christo

Just a technical question beforehand :)

Have you got switches on your network? :)
If so there's your "problem" - or rather, the only
way to make ethernet bearable ;)

Cheers,
Tink

yes - in fact all our networks are switched. Is that going to change things?

thanks

christo

switch = packets only get sent to the IP they are destined for. Hub = packets get broadcast accross the network.

of course - I should have realised that the switch keep an arp cache mapping all the MAC addresses and socket numbers, so packets are sent on straight to destination machines... which means that the only way to sniff a switched network would invoice arp cache poisoning, or even better mac duplication - /me dives into the ifconfig docs..

christo