Just curious why most packet sniffers are limited to their segment? is it the nature of a gateway to block the attempt outside a subnet?



If I understand what your asking correctly. Then the limitations are not imposed by the sniffer itself, but are limited by what it can see physically going past on the wire.

What you'll be able to sniff is mainly limited by the placement of your sniffer and the type of network you are on. For example on a network using a Hub you'll be able to see all the traffic being sent to every machine connected to that hub, but on a switched network most likely you'll only be able to see the traffic that is destined for you.

  • Yeah, I believe what I'm asking is directed at the limits imposed by a gateway/router rather than the sniffer app. What limits such apps from 'seeing' past the gateway router?? – piagetblix Mar 4 '11 at 16:27
  • Specifically what apps are you talking about? Are you talking about running something like wireshark on your machine and listing on the local interface? – Mark Davidson Mar 4 '11 at 16:28
  • not focusing on any specific app, the second part of your answer Mark, is the area that I want to understand more. The 'why' of how switched traffic limits what can be 'seen' is where i'm curious. Thanks – piagetblix Mar 4 '11 at 17:03

if segment = subnet, then they are limited because the router doesnt broadcast all the traffic to everyone (hubs however do* in some cases) and on a switched network you will only see the traffic for your pc and not all the traffic on the network... read up on Router vs Switch vs Hub vs Bridge and youll understand...

  • agh, there we go, its the nature of the broadcast that limits what traffic is available... – piagetblix Mar 4 '11 at 16:29
  • its not as much of a nature, as the structure of these things - e.g. on a switch everyone has a physical dedicated connection to the switch (costs a lot, but secure* arp injections / other attacks are still possible, depending on their structure / software ) and on the hub everyone is connected via the same physical line (cheap and insecure), making the traffic available to everyone. – Sigtran Mar 4 '11 at 16:36
  • so are your refering to a 'multi-layer' switch vs the 'classic' layer 2 type? – piagetblix Mar 4 '11 at 16:39
  • layer 1 = hub, layer 2 = bridge, layer 3 & above = switch & router – Sigtran Mar 4 '11 at 16:44
  • everything besides the hub is usually multilayer. and now its hard to find something that is just a hub, as the hardware is so cheap. – Sigtran Mar 4 '11 at 16:48

Just curious why most packet sniffers are limited to their segment?

What are you defining as "their" segment? Packet sniffing only works by listening to packets that are medium that the sniffer can listen to. If the medium has lots of people talking on it, it can hear them. But if people are miles away talking on a different medium, it is physically impossible for your sniffer to pick up those packets unless it is physically connected to that medium.

The only reason this works at all is that Ethernet is generally a broadcast medium (like a bus). Modern networks change this from a bus to a switched network which make it a star network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.