full-disclosure - info on ip spoofing please

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue Apr 11 20:56:03 2006
From: michael.holstein at csuohio.edu (Michael Holstein)
Subject: info on ip spoofing please

> My question is How can you sniff packets on a link that your machine is 
> NOT on ie NOT on the same subnet??

It's not the subnet that's important .. it's the broadcast network 
(usually a VLAN). ARP spoofing is the standard way of doing this, but 
ARP isn't (usually) forwarded across a router.

You can't (passively anyway) sniff packets from a host in another VLAN 
without some special trickery.

/mike.