How does it work ?
I have thought a switch would remember the MAC address and would not send the packet to a 2nd pc with the installed ethereal.
Do you clone the MAC address ?
Switches do not forward all traffic to all ports (as hubs do). Hence with a normal switch only broadcasts and packets addressed to a specific port (MAC) can be monitored. Monitoring switches should allow us to see the traffic flowing through all ports. Of course, we can use a sniffer to capture and analyse this traffic.