A switch should *always* be learning. A destination MAC address should always fall into one of two categories:
1. I have it in my switch table (NOT *ARP*, per se), because I saw traffic from it on interface X within the last N time-units. 2. It's not in my tables -- send this packet to every port and assume we'll see a packet from it soon so it will get added to my switch table. Switch table entries could get created when ARP response packets are seen -- or ARP requests, or DHCP broadcasts, or .... David Gillett > -----Original Message----- > From: Stuart [mailto:[EMAIL PROTECTED] > Sent: July 23, 2003 16:13 > To: [EMAIL PROTECTED] > Subject: RE: ARP Spoof Question > > > If we use a Cisco switch for example, don't they have a > learning period? > I would presume that the switch would go through the process > of building > its ARP tables again. > > Stu > > -----Original Message----- > From: Simon Gray [mailto:[EMAIL PROTECTED] > Sent: 23 July 2003 17:10 > To: [EMAIL PROTECTED]; [EMAIL PROTECTED] > Subject: Re: ARP Spoof Question > > >Q1.My Question is, Node C will also reply to that request of > Node A. SO > >now Node A has 2 different MAC for the same IP. How is Node > A handling > >this situation??? > >Q2.The switch also updates its table of IP/MAC address > bindings, so how > >is switch handling this situation??? > >Is it "first-come-first-serve" methodology which Node > A/Switch takes??? > > I don't know how correct this is, but I would of thought the Node > A/Switch > would update whatever stored record of IP/MAC it has with the new > details. > > Simon > > > -------------------------------------------------------------- > ---------- > --- > -------------------------------------------------------------- > ---------- > ---- > > > > -------------------------------------------------------------- > ------------- > -------------------------------------------------------------- > -------------- > --------------------------------------------------------------------------- ----------------------------------------------------------------------------
