You're wrong. See spanning ports on Cisco switches, also known as mirroring on other manufacturer's gear. This is standard practice for sniffing traffic on a switched segment. Going a step farther, if you hook up ethereal at an upstream router/switch, you'll see more traffic than you'll know what to do with.


PS

Idle scanning is not perfect when it comes to hiding. See my NMAP tutorials on this site.

--Th13