Join or sign in Register for your free TechRepublic membership or if you are already a member, sign in using your preferred method below. Use Your Email Use FacebookUse Linkedin

How does promiscuous mode work with swit

Locked

I maintain approximately 150 stand-alone networks and have very limited WAN knowledge, so here’s how I understand things to work, followed by my question.

1. A switches and routers keep lists as to what port is connected to what address (switches by hardware address, and routers by protocol address). They work as a hub, mass broadcasting if they don’t know who the message belongs to. They capture the “From” address from packets to assemble their tables. Thus, afterthe tableis complete it will send packets destined for one particular workstation directly to that workstation instead of broadcasting it. (Is that all accurate?)

2. It is my understanding that when you run Network Monitor or another type utility, you put the network adapter on that machine into promiscuous mode. In this mode it “listens” to the network and can capture any packets from any machine (Does anyone know how to do this in VB?)

So, my final question is, if the switches or routers are

Topic

How does promiscuous mode work with swit

In reply to How does promiscuous mode work with swit

1. You are very close. Switches are really multiport bridges, they only look at the MAC address (hardware address of a card) in a packet. They do build tables of all the Mac Address’s and use that info to determine whether to forward that packet and towhich port. Routers, on the other hand only look at that Network Address of a packet to determine if it knows how to send it to the next hop. If it has no information in its routing tables on how to get that packet to its next hop it does not forward that packet. Broadcast packets are address to the Broadcast address of the subnet and are not by default forwarded by a router. Broadcast Packets on a switched network are forwarded to all ports.

2. Promiscuos mode is exactly as you described, it allows the adapter to recieve all packets on the wire not just the ones addressed to the adapter. Most all Ethernet cards can be put in Promiscuos mode , but not all Token-Ring adapters can. This only allows all traffic to be recieved by a card, you still ne

How does promiscuous mode work with swit

In reply to How does promiscuous mode work with swit

The question was auto-closed by TechRepublic

How does promiscuous mode work with swit

In reply to How does promiscuous mode work with swit

Sad your text got cut-off. But extrapolating the text upto a final question
‘Does Network Monitor run when a LAN is routed or switched’, you are correct guessing the answer is often NO.
For routing it depends – at least a NIC in a workstation in asegment can see most of the traffic. For switching definititely putting Monitor on a _workstation_ won’t work anymore. However running it on a _server_ will work much better, because even through the switch all workstations will connect to this server. Same holds for routing.

Don’t forget however that Network Monitor and all other software monitors are really low-cost alternatives to the ‘real stuff’. Which is hardware-based monitoring, with promiscuous probes. The probes which DO work in a switched environment are actually built-in agents situated in the switch itself. E.g. Nortel (ex-Bay Networks) has some cool stuff. Management of the information of course is in SW (Nortel Optivity), but the data itself is 100% correct and covers allservers and nodes in

How does promiscuous mode work with swit

In reply to How does promiscuous mode work with swit

The question was auto-closed by TechRepublic

How does promiscuous mode work with swit

In reply to How does promiscuous mode work with swit

You are about half right in your knowladge. The first thing you need to know is the OSI model. There are seven layers to network connectivity. Physical(the wires);Data Link(the link layer is what uses the MAC address); Network(This is what uses IP addrsses for communication; Transport(Error checking);Session(administers the connection between computer);Presentation(gets information ready for the network); Application( Provides a link between aplications and the network).
In a Switch or Bridge all packets are read by all computers up to the Data Link Layer. If the destination MAC adress is not there own it simply drops the packet. A router reads up to the Network layer and if the packets IP destination adress is on its subnet it broadcasts the packet to its subnet, if not it sends it to the next(destination) subnet. individual computers go through the same proccess to decide if a messege is for it if the MAC or IP address is not there own it drops the packet.
by putting a card in permiscous mode wh

How does promiscuous mode work with swit

In reply to How does promiscuous mode work with swit

The question was auto-closed by TechRepublic

How does promiscuous mode work with swit

In reply to How does promiscuous mode work with swit

This question was auto closed due to inactivity

[Author]

Replies