On Mon, 6 May 2002, kumar mahadevan wrote: > If I am on a Switched network and I change my MAC > address on my RH 7 box to the victim's (using > IFCONFIG). Now, how do I capture say for e.g Telnet > sessions between the victim and a server running > telnet service. If you change your MAC address to be that of the victim (the box in the same broadcast domain as your attacking machine) then you will be fighting the victim for control of the MAC address in the switch. The switch will alternately think that that MAC address is in one port, then another, as frames come in with that as a source address. In general, you'll just make the victim unable to communicate, and yuo won't be able to monitor most of the traffic. > > I don't want to ARP cache poison nor MAC flood the > switch. Then your best bet is to poison the ARP cache on the victim, to make it think you're the other box, or the router. Configure your box to forward the packets so you don't break the communications. Ryan ---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/
This archive was generated by hypermail 2b30 : Mon May 06 2002 - 14:14:01 PDT