Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!


Click here to return to the 'Strange behavior' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Strange behavior
Authored by: Jay on Aug 14, '01 12:15:59PM

This is a fantastic utility. Check this out: I have my Mac and a PC connected to a small hub on my desk. That's connected to a hub in the next office. When my PC has TCP traffic, TCPflow picks it up. Why is that? More interestingly, I can see the passwords (transmitted in clear text by Outlook) when the PC checks my email! What if I were connected to a larger hub at an office where it mattered? Could I see everyone's usernames and passwords when they check their email?



[ Reply to This | # ]
Sniffers
Authored by: bhines on Aug 14, '01 05:15:50PM
Jay: in a word, yes. You have discovered why "https" is a good thing. Network sniffing is Very Easy™. Another cool sniffer util to check out is - Ettercap. Etherpeek is a sweet network sniffer for OS9 and earlier. Etherpeek. -Ben

[ Reply to This | # ]
Hub vs Switch
Authored by: Another osX User on Aug 14, '01 10:52:36PM

>When my PC has TCP traffic, TCPflow picks it up. Why is that?

What you are witnessing is the difference between a hub and a switch. Incoming traffic from a hub will be broadcasted to any machines connected to it. Packets that are not intended for your IP are normally ignored, but packet sniffers log the receipt of the packet.

Switches only send packets to the machines that they are intended for.



[ Reply to This | # ]
re: replies
Authored by: Jay on Aug 15, '01 11:59:33AM

How interesting! Thanks very much. I new that a switch was more secure, but had never actually witnessed how public the information is!



[ Reply to This | # ]
Strange behavior
Authored by: mhanna on Aug 16, '01 05:47:02PM

I think TCPflow picks up the data going to the PC because in the Ethernet specification(Carrier Sense Multiple Access/Collision Detect) frames go to every interface on the collision domain(any interface connected by a link-layer device like a hub).

Anybody know how to configure tcpflow for a pppoe0 device??

Michael



[ Reply to This | # ]