Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Sniffing on 2950 series?

Hi,

Could anyone tell me if is possible, on a 2950 with default configuration, after flooding it with false arp entries, sniffing all traffic?.

Is it supposed the switch to act as a hub when the mac-address-table is saturated?

Do lower series have the same behaviour?

Thank you.

3 REPLIES
Silver

Re: Sniffing on 2950 series?

AFAIK it is true of all switches. When the CAM table is filled, they broadcast on all ports hence can be used for sniffing. THis is known as mac flooding. U can restrict using Broadcast/Unicast control on Switches . Hence Switch becomes a hub

http://en.wikipedia.org/wiki/MAC_flooding

http://www.watchguard.com/infocenter/editorial/135324.asp

New Member

Re: Sniffing on 2950 series?

Thank you for your answer. We agree about the theory, but, could answer anyone who tried it already?

New Member

Re: Sniffing on 2950 series?

Thank you for your answer. We agree about the theory, but, could answer anyone who tried it already?

107
Views
0
Helpful
3
Replies
CreatePlease to create content