can ettercap destroy/damage switch?

Printable View

June 19th, 2003, 05:12 PM
phishphreek

can ettercap destroy/damage switch?

I have been messing with ettercap for some time now and understand how it works on the application, protocol, OSI levels, etc.

What I'm not sure about is the harware.

I know that switches work at the layer 2 (MAC) and sometimes layer 3 (network/vlans).

In this case I'm using DLink and 3Com unmanaged workgroup switches. All layer 2.

I have not had an opportunity to play with it on managed switches of any type... as my experimenting is limited mostly to my home network.

Can using a program like ettercap damage a switch? Since it is forcing it to act as a hub and repeat all traffic through all ports...

Thanks in advance!
June 19th, 2003, 05:41 PM
Networker

Re: can ettercap destroy/damage switch?

Quote:

Originally posted here by phishphreek80

I know that switches work at the layer 2 (MAC) and sometimes layer 3 (network/vlans).

Just an info VLAN is still layer 2! (IEEE 802.1q)

Quote:

Can using a program like ettercap damage a switch? Since it is forcing it to act as a hub and repeat all traffic through all ports...

Switches r something that I know, I've been working into one implementation (h/w, f/w, s/w). And I never heard of such siwtch degradation.
the switching is there to forward frames, fill the CAM etc, it does not really care about what it is forwarding. There is MTBF in datasheet that should say the disponibility performances of the equipement (like 2 years with max uninterrupted traffic).

The only damage I could see are reversible, it could full up the flash because of counters, logs, ...
A simply reset of non permanent object from the flash by rebooting will be a work around.
Or u could find a firm bug, but normally these kinda test had been performed by the constructor (normally).
If that occurs u should be able to upload the firm through consol port
June 19th, 2003, 06:34 PM
KorpDeath

The only real damage I can think of is if you don't ventilate the switch properly and it overheats. I've smelled a few switches fry and it's worse than a mainboard, plus allot more smoke.

But like Networker said a simple reboot should fix whatever gets overburdened.
June 19th, 2003, 06:55 PM
nebulus200

I have seen a few older switches, that when they were subjected to things like ettercap, or even things like NMAP or Nessus, essentially lose everything (basically like a factory reset, if you were lucky, if not, it had nothing, no IOS). I would say if you have newer equipment the chances are very remote that something non-recoverable would happen, with older equipment I would say that the chances are still remote, but more likely than with newer equipment.

I would be more worried about the 3COM, I have seen nmap scans torch their routers, corebuilders, and Superstacks...

/nebulus
June 19th, 2003, 08:13 PM
phishphreek

Quote:

Just an info VLAN is still layer 2! (IEEE 802.1q)

Doh! I should have known that... actually I did know that... just forgot temporarily... :D

I'm not using very sophisticated switches... just messing about on my home LAN. I have a couple routers and very basic workgroup unmanaged switches that I have setup. I haven't noticed any problems as of yet... but I left ettercap running overnight on accident and thats why I was wondering about it.

I'm not really allowed to mess about on my work network (where we have the good stuff).... so I torture my home equipment.

Thanks for the info guys!
June 19th, 2003, 11:17 PM
w0rm3y

when using ettercap, it would do a arp-flooding, thus degradating performance. i have seen this on 2948's but haven't really seen too much degredation depending on the plugin you use on ettercap options.

-w0rm3y