spoofs your ip as another box on your ethernet segment, portscans a host 'from' that ip, sniffs responses from the host.