Sorry for the lengthy post, I want to clearly describe the problem I’m having.
At the moment I am doing the “Intro to Network Analysis” module while also doing some heavy Googling trying to understand network fundamentals. There is one concept I’m having trouble understanding and thought I could get an answer here.
The problem basically is the following: I have trouble understanding how layer 2 of the OSI model works.
From my understanding, layer 2 concerns itself with communications between hosts on the same LAN. Hosts can be addressed using their unique MAC-address. Communications happen through ethernet frames.
I’m having trouble understanding how these ethernet frames are “routed”.
Say we have 3 hosts on the same LAN:
Host A: 192.168.1.2 (MAC AA:AA:AA:AA:AA:00)
Host B: 192.168.1.3 (MAC AA:AA:AA:AA:AA:01)
Host C: 192.168.1.4 (MAC AA:AA:AA:AA:AA:02)
If Host A sends a packet to host B, Host A constructs an ethernet frame with destination address AA:AA:AA:AA:AA:01.
In Academy, the following is stated:
To capture network traffic from "off the wire," it uses the libraries pcap and libpcap, paired with an interface in promiscuous mode to listen for data. This allows the program to see and capture packets sourcing from or destined for any device in the local area network, not just the packets destined for us.
The question I have is: How does the ethernet frame actually get delivered to host B? The academy quote above insinuates that somehow, the ethernet frame gets delivered to all hosts on the local network (meaning that host C could snoop on the traffic between host A and B).
I thought that the routing of these frames was done through a switch, meaning that traffic not intended for our PC/MAC address will not ever reach our PC.
Maybe the quote was talking about a wireless LAN? Would it be possible to capture all layer 2 traffic on a wireless LAN, since no switch is involved? If so, does that mean that a switched LAN is inherently safer than a wireless LAN?
Sorry for the long post, I hope someone here is able to clear things up a bit.