1

In an envrionment where there is no packet switching, say a simple hub that repeats the signal from a port to all other ports, or a splitter, how come a packet can be sniffed?

I mean, if the packet's destination MAC is set to a specific NIC, how can it be listened by another host whose MAC is not the destination?

In theory, shouldn't it be dropped at the physical layer instead of passing it through upper layers if the destination MAC doesn't match?

3

Packet capture programs require the NIC to be set to "promiscuous mode," where the NIC will accept any packet regardless of the MAC address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.