[Asterisk-Dev] VoIP Call Sniffer

[Russell Bryant]

> Not really, no.  All you need to do is to flood the switch with more
> MAC addresses than can be stored in its internal table (2048 addresses
> for most low-end switches, possibly 65536 addresses on high-end
> switches) and the switch will automatically switch over to acting like
> a hub.  Note that because the MAC address space is 48-bit, you would
> need to have approximately 54 Terabytes to store a table of all MAC
> addresses with their corresponding IP addresses (which would be needed
> to defeat this attack).

There's ettercap, too ...

http://ettercap.sourceforge.net/

Russell