> I have always wondered, what happens when you put an ethernet adapter
> that is on a switched LAN into promiscuous mode (as with tcpdump),
> does it still recieve all of the LAN's ethernet traffic? I would
> think that it wouldn't as the switch wouldn't know to send data to
> that MAC address that is destined for another. Am I right on this?
you're right. you have to alter the switch somehow or fool it. the
proper way is to set the port you're on to monitor or spanning or
reflector mode (vendors call it different things). this is the idea of
having one port see all the traffic the switch sees, useful for
debugging or monitoring a segment.
the other options are to flood the switch with false MAC addresses (see
dsniff's macof tool) to have it flood its tables and revert to
forwarding all traffic to all ports or to arpspoof the target you wish
to observe so the switch will send the data to two ports and not just