From: Michael Scheidell (scheidell@secnap.net)
Date: Sat Oct 14 2006 - 07:52:27 EDT
> -----Original Message-----
> From: listbounce@securityfocus.com
> [mailto:listbounce@securityfocus.com] On Behalf Of Jon Hart
> Sent: Friday, October 13, 2006 12:32 PM
> To: pen-test@securityfocus.com
> Subject: unswitched behavior of a switched network...
>
> My question is, has anyone seen a situation where the same
> broadcast behavior occurs, but the CAM table itself is not
> overloaded and there is no good reason for entries to be
> expiring? Furthermore, even if the entries were expired, has
> anyone encountered situations (malicious or otherwise), where
> a given port will receive traffic outside of its own L2?
Broadcasts are, well, broadcasts. They have to broadcast. All
broadcasts are passed to all ports.
In fact, you will always see broadcasts, ipx, multicast, vrrp, CDP and
other type messages on all ports.
Also, is it a Cisco? Or some other box? Some 'switches' are just cheap
hubs (ok, expensive hubs) and if you have some 10mb and some 100mb
traffic, it can act as a hub.
-- Michael Scheidell, CTO 561-999-5000, ext 1131 SECNAP Network Security Corporation ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW ------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:12 EDT