a hub

On 30.04.2006 08:37 snipped-for-privacy@coolgroups.com wrote

depends on

yes

If really a hub and not a switch, which is far more common today, even when called a hub.

Either can happen, depending on the details of the card, the OS, and any drivers thereof.

If a hub (see above) and with the right drivers, then yes.

Any Ethernet card that I recall will reject a packet with an someone else's MAC address on the card (but not broadcasts). Queston 1: the card.

#2, yes, a packet sniffer can see the packet. Packet sniffers are available for all major operating systems, that operate on all major manufacturers card.

And using switches does not completely prevent sniffing, but it does make it quite a lot harder.

I would say that the typical case is the NIC discards any frame not addressed to that machine's (NIC's) individual MAC address or to the MAC group addresses the machine is registered to receive. And the typical case is that only broadcast frames, i.e. those with all 1s MAC DA, will interrupt the CPU of every machine on the net.

That's why IP version 6 has eliminated broadcasts altogether. They are a nuisance, e.g. as manifested by broadcasts used by ARP, RIP, and DHCP in typical IPv4 nets.

However, NICs can be set to "promiscuous mode," in which case all frames arriving at the NIC are forwarded to the CPU.

If the PCs are interconnected with a "hub," meaning a repeater, a sniffer will see all frames from any port.

Bert

The NIC should discard Ethernet frames--IP packets would normally be discarded by software running on the CPU, however some Ethernet NICs have IP acceleration features that allow some of the IP processing to be handled by the NIC.