Learn how to hack!

Learn how to hack even if you're starting today!

hub vs switch – sniffing

Posted on: February 20, 2010
5

Let’s look at the difference between a hub and a switch and how one could attack them. Watch the video to see hubs and switches from a hacker’s point of view. Read the post for a more formal description. (sorry about the quality, still working on perfecting this video stuff)



A hub and a switch have the same purpose; to connect a bunch of computers via ethernet “cross over” cables to create a network. Their main difference is that a switch is much more intelligent than a hub.


On a hub, all of the internet traffic (packets) are sent to every connected computer, where it is determined whether it belongs to that computer. As you may have already guessed, this isn’t very bandwidth friendly and is bad for performance.


Switches are much smarter, they are able to inspect all the headers of the packets coming in and determine where they are coming from and to whom they are destined for. The switch then forwards the traffic to the proper destination. This greatly reduces bandwidth and offers much better performance. For this reason you won’t find many hubs these days, switches are the preferred choice for networks for obvious reasons.


Because all traffic is forwarded to all the machines on a hub, it is very easy to sniff and store the traffic since it just comes to you. The sniffed packets may include website passwords, ftp passwords, the websites the user visits and other personal information.


On a switch, since the traffic is examined and forwarded to the correct machine, how would you sniff it if it doesn’t come to you? Easy, by ARP spoofing. Watch out for a post on that very soon.”"

  • Get MrCracker.com's Free Ebook!
  • Stay up to date on all the hacker news.
  • Discover new hacker websites.
  • Get free hacker tutorials!

5 Comments

Leave a Comment
  1. waqasali
    February 20, 2010 at 2:12 pm Reply

    Hey you say hub send data to all computers…..mean while you are saying

    “On a hub, since the traffic is examined and forwarded to the correct machine, how would you sniff it if it doesn’t come to you? Easy, by ARP spoofing. Watch out for a post on that very soon.

    • David
      February 20, 2010 at 2:46 pm Reply

      Hmm, I can’t seem to find me saying that.. at what time?

  2. waqasali
    February 20, 2010 at 8:37 pm Reply

    see last two line of your post…
    and thord line down from youtube video….

  3. waqasali
    February 20, 2010 at 8:39 pm Reply

    *third line

  4. David
    February 20, 2010 at 9:14 pm Reply

    Ah ok, i thought you were talking about the video. Thanks for the catch, i’ve updated it.

Leave a Comment

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>