Ketchup,

if you are trying to sniff traffic for defensive purposes your can configure span ports (on Cisco devices, I believe similar features exist forother manufacturers). This will allow you to see traffic at packet level without restorting to re-directing traffic with arp spoofing.

However as you state, the bad-guys will likely have no qualms attempting an ARP spoof technique as the fallout of network failure isn't going to effect them. Might be a good idea to see how the network would handle such an attack. As with everything in this area make sure that you have fully explained the risks to your employer/client before trying these techniques and CYA, in writing, at all times.

RR

Arp cache poisoning is a valid attack vector but you can create bottlenecks on the network that can bring it down. So long as the client is aware of the potential consequences of the attack and you have documented the servers/hosts that you are targeting with the attack. You might not want to poison an entire subnet but only focus on a few targets so that any impact is limited.

Yes. DTP (Dynamic Trunking Protocol) attacks and others can enable you to sniff all traffic on a switch by enabling trunking on your port.

Yersinia can simplyfy these attacks for you or you can craft the packets in scapy.

dean