On our network , when I sniff traffic from my PC, I also get details of packets which show source and destination IPs NOT meant for my PC. I have not done any configuration on my Nortel 2550 switch for ARP poisoning. I also observe that the network is slow. What could be the problem?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Yes, it is not mirrored port. I expected to see traffic which show packets containing either source or destination IPs of my machine. However I can see traffic to and fro for almost all the nodes on my network, looks like ARP poisoning is happening, but how? Is there any worm, virus or malicious program doing it, we have updated Symantec antivirus, and I am also using antispywares like Spybot -S & D.
Without seeing the pcap file I won't be able to tell much. If it was arp poisoning, you would be seeing excessive (and unrequested) arp traffic. You might also connect the 2550 with the JDM and check the arp table (if it is configured as a router) - it will show you the mapping of ip addresses to mac addresses. If multiple IP address have the same MAC address then you will know something is fishy.
Sorry if I have misunderstood here , but from what I am reading so far, nothing is out of the ordinary, this is an expected behaviour, when you use a protocol analyzer / Packet sniffer like Wireshark, you are configuring your NIC to run in promiscuous mode, which is bound to display most of layer 2 & layer 3 traffic going on this switched segment of the network, not just the traffic from / to your own machine.
Whatever Admin3k is saying is correct to some extend, but not for a switched network. In promiscuous mode, all the traffic will be captured by wireshark but why all the packets are available on a port in the switched network environment? It should be expected if you are capturing traffic using hubs in your network.
IF something is wrong here please point out.
Its possible the switch's MAC table has collapsed and the switch reverted to hub mode - this is a common failure mode for Nortel kit that can see more nodes (mac addresses) than they have room for in their mac table.
Really though, you will need to post the destination IP and MAC addresses of the stray packets (plus the IP and MAC of the monitoring node) so we can see what sorts of packet you are seeing. A certain number of packets are *supposed* to be forwarded - multicast and broadcast traffic for example - And it is possible the extras are of this type. even a dead node (i.e. one without a known MAC on it) gets a surprising amount of traffic on most networks - routers broadcast failover, switches spanning tree, servers availability and service location, new nodes DHCP requests, etc etc.
Business Accounts
Answer for Membership
by: rcflyrPosted on 2009-06-25 at 23:12:50ID: 24718364
what are the IP's that you are seeing? Also, you are sniffing traffic on the port you access the network on, not a mirrored port correct?