Greetings,
Is your network using hubs or a switches?
If you are using a hub, this is a simple ethernet repeater, all
packets are visible to all systems connected to that hub (even other
hubs if they are all connected together).
If you are using a switch, it is much more intelligent, and filters
out packets that are not destined for your machine. It knows which
packets go where by understanding the MAC address of the ethernet
boards, and routes based on this. For a special case of broadcast
packets, they are sent to all ports on the switch.
The reason for using a switch is to enhance available bandwidth on
each network segment (it also helps with security, as you have just
discovered). e.g. if two machines are are communicating directly, the
other systems never see the network traffic.
Therefore, if you are only seeing broadcast packets (including
ARP), this is what is going on.
HTH,
DGO
On Wednesday 08 August 2001 07:10, Zilvinas Atkociunas wrote:
> Hello mdk fans,
>
> I hope someone could explain me why I can't see my segment packets on my
> promisc workstation (mdk7.2, 2.2.17 kernel, running tcpdump turns PROMISC
> flag to state on). I can watch only packets coming to and from my
> workstation.
>
> Thanks in advance,
>
> zilvis
>
> BTW: The label on the box where my ws is plugged into plainly says "Dual
> speed 16-port Ethernet/Fast Ethernet Hub" so this is not switch. ;-)
--
"Entropy Requires No Maintenance"
