Network Sniffing
On the data-link layer lies the distinction between switched and unswitched networks. On an unswitched network, Ethernet packets pass through every device on the network, expecting each system device to only look at the packets sent to its destination address. However, it's fairly trivial to set a device to promiscuous mode, which causes it to look at all packets, regardless of the destination address. Most packet-capturing programs, such as tcpdump, drop the device they are listening to into promiscuous mode by default. Promiscuous mode can be set using ifconfig, as seen in the following output.
reader@hacking:~/booksrc $ ifconfig eth0 eth0 Link encap:Ethernet HWaddr 00:0C:29:34:61:65 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 ...
Get Hacking: The Art of Exploitation, 2nd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
