VULHUB ™

MiM can be used to redirect the flow between two hosts through a third host which logs it in tcpdump/pcap format. We use unsolicited ARPs to do this and the redirector listens for, and responds to, future ARP requests for the addresses in question, so the redirection should remain fairly persistent even when ARP caches expire. I put it together primarily to demonstrate that, yes, you can sniff in a switched environment. It just requires a couple ARPs.

MiM can be used to redirect the flow between two hosts through a third host which logs it in tcpdump/pcap format. We use unsolicited ARPs to do this and the redirector listens for, and responds to, future ARP requests for the addresses in question, so the redirection should remain fairly persistent even when ARP caches expire. I put it together primarily to demonstrate that, yes, you can sniff in a switched environment. It just requires a couple ARPs.