1

I was reading the wiki about promiscuous mode when I came across a piece of information here that suggests that one could use network switches to prevent malicious use of promiscuous mode.

In the context of an ethernet LAN, an attacker can sniff packets or perform ARP spoofing at the very least. I'm curious about how using a network switch can prevent either of these issues.

Improve this question

2 Answers 2

Reset to default
3

Promiscuous mode means telling an Ethernet card to record all packets that pass by, not just those addressed directly to it or broadcasts.

If that card is connected to a switch, however, then the switch normally only sends the card packets that are addressed directly to it (or to broadcast), so there's nothing else for the card to see.

I said normally because there are some circumstances where a switch sends other traffic out a particular port:

  • the switch admin might configure it to do that (e.g. so an IDS can monitor traffic)
  • the switch might do that if it is having problems (e.g. if it's not sure which port to send a packet to)

So you can't assume that just installing switches makes promiscuous mode go away completely as a threat; a determined attacker might attack the switch to try and make it do one of these things and send her host extra packets she can read with a promiscuous network card.

(And of course a determined attacked will do other things as well, such as attacking other bits of the network to make them send her packets they shouldn't.)

However, switches stop the casual user from using WireShark or Firesheep to poke about on the network; and in any case they offer other advantages, so most network managers have already upgraded to them.

Improve this answer
3
  • I would add this is the only security improvement the switch adds, an attacker can start to do more active attacks like ARP spoofing or DNS cache poisoning to get the network to start sending data it's way and the switch has little ability to stop it.
    – ewanm89
    Commented Oct 25, 2012 at 11:59
  • I disagree @ewanm89. Managed switches have the ability to define a specific mac for a specific port and not learn mac on a port, preventing arp spoofing. Managed switches also have an isolated mode which prevent 2 devices from talking to each other unless one is "promiscuous" ciscopress.com/articles/article.asp?p=1181682&seqNum=3 These features make a switch very powerful against layer 2 attacks. One would be left to DNS cache poisoning or other L3 attacks.
    – jrwren
    Commented Nov 9, 2012 at 18:30
  • jrwen, yes managed switched can stop some kinds of attacks in some circumstances. They can not stop every kind of attack.
    – ewanm89
    Commented Nov 9, 2012 at 19:27
1

As @Graham-hill mentions, at a basic level with a switch, a host on the network will only see the traffic destined for it.

The common attack cited for this is ARP spoofing/poisoning where a malicious host sends ARP responses to requests to attempt to get other hosts to believe it is a specific system (usually the router for that subnet).

defences against ARP spoofing/poisoning depend largely on the switches you use. Many switches do have features to defend against this. For example Cisco Port Security. Essentially from what I've seen these involve the switch learning which ports have which MAC addresses and rejecting traffic from hosts which claim to have an address it already knows is on a different port..

Improve this answer

You must log in to answer this question.