Re: [PLUG] trapping web site communications

["eric@lucii.org" <eric@lucii.org>]

On Sun, Aug 17, 2003 at 05:15:46PM -0400, kaze wrote:
> 
> (While far from authoritative on Linux, since the list volume is low
> recently on weekends I'll jump in.)
> 
> It is true that some cards will not support promiscuous mode.
> 
> from man ifconfig on Red Hat 9:
> 
>        [-]promisc
>               Enable or disable the promiscuous mode  of  the  interface.
> If
>               selected,  all  packets  on  the network will be received by
> the
>               interface.
> 
> Once you turn it on it looks like there'll be a flag showing it's on when
> you do for ex. ifconfig eth0
> 
> To test I would put the sniffer machine [S] on the hub with two other
> devices [A] and [B]:
> >From [A] ping [S], and you should see the ping in ethereal.
> >From [A] ping [B] and if working [S] will see it, if not working then [S]
> won't see it.
> 
> I think ping is a uni-cast thing, and thus this will test it.

Thanks.  I'll try this later tonight if I have the chance.

> IIRC there is a config file in which you specify the interface as
> promiscuous, but can't find it at the moment.
> 
> Also of note is that some switches have a management port which when set the
> right way allows a sniffer attached to it to snif properly.

My switch is a simple unmanaged switch so i suspect such an option is
not available to me.



Eric

-- 
#  Eric Lucas
#     "Oh, I have slipped the surly bond of earth
#      And danced the skies on laughter-silvered wings...
#                             -- John Gillespie Magee Jr.
_________________________________________________________________________
Philadelphia Linux Users Group        --       http://www.phillylinux.org
Announcements - http://lists.netisland.net/mailman/listinfo/plug-announce
General Discussion  --   http://lists.netisland.net/mailman/listinfo/plug