Flooding a switch
Hello,
I'm trying to flood a Cisco 2950 switch so it falls over to bridge mode.
I'm using Ettercap to flood the switch. I can see all the MAC's in the CAM table have been used up via the show mac-address-table count command (8,000 in total on a 2950)
However when I run Wireshark to start sniffing I cannot see any unicast data between other hosts, I only see multicast frames (i.e. DHCP traffic etc)
Has anyone done this before or have any idea what I'm doing wrong or not doing ?
Thanks
I'm trying to flood a Cisco 2950 switch so it falls over to bridge mode.
I'm using Ettercap to flood the switch. I can see all the MAC's in the CAM table have been used up via the show mac-address-table count command (8,000 in total on a 2950)
However when I run Wireshark to start sniffing I cannot see any unicast data between other hosts, I only see multicast frames (i.e. DHCP traffic etc)
Has anyone done this before or have any idea what I'm doing wrong or not doing ?
Thanks
Comments
-
GAngel
Member Posts: 708 ■■■■□□□□□□
Most of the later IOS have broadcast suppression built in. Yours may be enabled. -
danc_101
Member Posts: 60 ■■□□□□□□□□
Thanks - I disabled that before I tried the flood but still no joy..
-
JDMurray
Admin Posts: 13,091 Admin
I have a couple of 2900-series switches laying around. This weekend, I'll try using BackTrack 4 to duplicate what you are doing and see if I get the same results. What's the version/date/features of IOS that you are using?