Re: [tlug] Class B Hubs not suitable for data center use?

["Jonathan Q" <jq@example.com>]

On 8/28/2002, "Josh Glover" <jmglov@example.com> wrote:

>"switching hub" == "cheap switch", I would say. J?

I would say, too.  I've only seen that term on low-end home/office switches
like Buffalo and Corega.  But a hub is a hub and a switch is a switch, and
mixing the terms like that only confuses people.  I wish they wouldn't do
it.

Simplified explanation for anyone unfamiliar with the difference:

Hub: Receives packets on an interface and broadcasts them out all other
interfaces.  The device for which they are destined picks them up, the others
(should) ignore them.  However, the others don't have to ignore them.  If you
run a sniffer, it puts the NIC into promiscious mode and captures packets from
all the other machines.  This makes hubs a security risk because passwords and
other sensitive data can easily be stolen by an intruder who takes control of
any machine connected to that hub.  Also by an insider who is out to hurt
you.

Switch: Receives packets on an interface and sends them out only the interface
to which they are destined.  This is done by looking at the destination MAC
address of the packets.  If I have an 8-port switch and I want to send packets
from my machine A on port 4 to machine B on port 6, those packets will go only
to machine B.  None of the other ports will see them.  It is not possible for
a machine on any of the other ports to sniff packets on this network.  This
makes switched networks inherently more secure than non-switched networks.

On a network with an advanced switch, it might be possible to sniff packets if
an intruder gained administrative control of the switch, but those packets
would have to be sent somewhere else for recording (a log host, for example)
and the switch would have to allow the administrator to be able to do that. 
This is far more difficult than sniffing on a hub network, and the perp is far
more likely to get caught, because if the switch was logging to the network
syslog host and suddenly stops doing it or suddenly starts recording sniffed
packet data there, the admins are likely to notice.


J

GPG key: DF12B4EF (5399 C834 3ABB C3AF 610C  5345 D5D6 E6EA DF12 B4EF)
gpg --keyserver pgp.mit.edu --recv-keys  DF12B4EF