论文部分内容阅读
以太网数据传输通过广播实现,在同一网段的所有网卡事实上都可以访问在共享的物理介质上传输的所有数据。但在系统正常工作时,一个合法的网络接口应只响应两种数据帧:一是帧的目标MAC地址与本地MAC地址相符;二是帧的目标地址是广播地址。若要监听所有流经网卡的数据帧,当用于监听的主机连接在共享型以太网集线器上时,采用“混杂”模式可以监听到同一冲突域上传输的数据帧;但当监听的主机连接在交换机上时,可以利用交换机的端口镜像(Port Mirroring)功能实现监听。
Ethernet data transmission through the broadcast, all network cards in the same network segment in fact have access to all the data transmitted on the shared physical media. However, when the system is working properly, a valid network interface should only respond to two kinds of data frames: one is the frame’s destination MAC address is consistent with the local MAC address; the other is the frame’s destination address is the broadcast address. To monitor all data frames flowing through the network card, the “mixed” mode is used to monitor the data frames transmitted on the same collision domain when the host for monitoring is connected to a shared Ethernet hub. However, Host connected to the switch, you can use the switch port mirroring (Port Mirroring) function to achieve monitoring.