Re: ARP Spoof Question

2003-07-28 Thread Martin Brecher
The Fueley wrote: How would that apply to a layer 3 switch/router? Actually the packaging says that I have a Residential Gateway/Router/Firewall. Aren't gateways layer 7 devices? While switches are layer 2 devices, they deal with MAC addresses right? Maybe a smart switch knows which MAC addresses

RE: ARP Spoof Question

2003-07-28 Thread David Gillett
: RE: ARP Spoof Question what are layers? what purpose do they serve? dave On Thu, 24 Jul 2003, David Gillett wrote: Switches are layer 2 devices, IP begins at layer 3. A -switch- usually doesn't understand a single ip bit. The management side of the switch (snmp, http

RE: ARP Spoof Question

2003-07-24 Thread Stuart
]; [EMAIL PROTECTED] Subject: Re: ARP Spoof Question Q1.My Question is, Node C will also reply to that request of Node A. SO now Node A has 2 different MAC for the same IP. How is Node A handling this situation??? Q2.The switch also updates its table of IP/MAC address bindings, so how is switch handling

RE: ARP Spoof Question

2003-07-24 Thread The Fueley
-Original Message- From: Stephane Nasdrovisky [mailto:[EMAIL PROTECTED] Sent: Wednesday, July 23, 2003 2:05 PM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: Re: ARP Spoof Question I have a small question. I was reading about ARP Spoofing and here is my question. So when Node

RE: ARP Spoof Question

2003-07-24 Thread David Gillett
] Sent: July 23, 2003 16:13 To: [EMAIL PROTECTED] Subject: RE: ARP Spoof Question If we use a Cisco switch for example, don't they have a learning period? I would presume that the switch would go through the process of building its ARP tables again. Stu -Original Message

RE: ARP Spoof Question

2003-07-24 Thread Stuart
Gillett [mailto:[EMAIL PROTECTED] Sent: 24 July 2003 17:39 To: 'Stuart'; [EMAIL PROTECTED] Subject: RE: ARP Spoof Question A switch should *always* be learning. A destination MAC address should always fall into one of two categories: 1. I have it in my switch table (NOT *ARP*, per se), because I

RE: ARP Spoof Question

2003-07-24 Thread David Gillett
Switches are layer 2 devices, IP begins at layer 3. A -switch- usually doesn't understand a single ip bit. The management side of the switch (snmp, http, telnet, whatever) are to be considered as any other networked host. How would that apply to a layer 3

RE: ARP Spoof Question

2003-07-24 Thread David Gillett
Message- From: David Gillett [mailto:[EMAIL PROTECTED] Sent: 24 July 2003 17:39 To: 'Stuart'; [EMAIL PROTECTED] Subject: RE: ARP Spoof Question A switch should *always* be learning. A destination MAC address should always fall into one of two categories: 1. I have it in my switch

Re: ARP Spoof Question

2003-07-24 Thread Justin Pryzby
[mailto:[EMAIL PROTECTED] Sent: 24 July 2003 17:39 To: 'Stuart'; [EMAIL PROTECTED] Subject: RE: ARP Spoof Question A switch should *always* be learning. A destination MAC address should always fall into one of two categories: 1. I have it in my switch table (NOT *ARP*, per se), because I

Re: ARP Spoof Question

2003-07-23 Thread David J. Bianco
On Wed, 2003-07-23 at 01:22, Vineet Mehta wrote: Q1.My Question is, Node C will also reply to that request of Node A. SO now Node A has 2 different MAC for the same IP. How is Node A handling this situation??? Q2.The switch also updates its table of IP/MAC address bindings, so how is

RE: ARP Spoof Question

2003-07-23 Thread David Gillett
In a live network, you might (a) replace the NIC in a machine (perhaps later installing the removed NIC in a different machine), and (b) move a machine from one switch port to another. So the way node A, and the switch, handle this is to just keep the last information they saw. Node B can

Re: ARP Spoof Question

2003-07-23 Thread Simon Gray
Q1.My Question is, Node C will also reply to that request of Node A. SO now Node A has 2 different MAC for the same IP. How is Node A handling this situation??? Q2.The switch also updates its table of IP/MAC address bindings, so how is switch handling this situation??? Is it first-come-first-serve

Re: ARP Spoof Question

2003-07-23 Thread jfastabe
Vineet, I would assume that it would be the last ARP response that the system receives that ends up in the arp table, because i believe that it will setup an entry for each response and since the last one will overwrite the first one the second will be there. But ARP spoofing tools dont bother to