He is right there is a built in flaw in arp (forget its name) here is an extract that sort of explains the issue but I'm sure others here will have better info, so you see at present on standard networks if somebody wants to eavesdrop and get passwords etc they can depending on skill level and knowledge.
A switched network does not lend itself to sniffing as easily as a network. It does not broadcast most frames. But the development of switched networks was driven by the need for more bandwidth, not for the need of more secure networks. Still it is much more secure that network and there is no reason those days to use anything but switched networks. Although sniffing is more difficult, it is not impossible and several methods are available to sniff switched networks:
ARP Spoofing. One of the basic operations of the Ethernet protocol revolves around ARP (Address Resolution Protocol) requests and replies. In general, when Node A wants to communicate with Node C on the network, it sends an ARP request. Node C will send an ARP reply which will include the MAC address. Even in a switched environment, this initial ARP request is sent in a broadcast manner. It is possible for Node B to craft and send an unsolicited, fake ARP reply to Node A. This fake ARP reply will specify that Node B has the MAC address of Node C. Node A will unwittingly send the traffic to Node B since it professes to have the intended MAC address. There are tools that care cable of doing this automatically sending fake ARP replies to classes of machines (i.e., NFS servers, HTTP servers, etc). One such tool is sniff5 and it works well to sniff for specific types of traffic. Other tools listen for the general ARP request and send the fake ARP reply at that time. The parasite4 program falls into this category and it serves well to sniff the entire network. For this type of attack to work, we need the ability to forward on the frames we receive to their intended host. This is most commonly achieved through some type of IP forwarding, either at the kernel or application level.
MAC Flooding. Since switches are responsible for setting up the virtual circuits from one node to another, they must keep a translation table that tracks which addresses (specifically, which MAC addresses) are on which physical port. The amount of memory for this translation table is limited. This fact sometimes allows the switch to be exploited by flooding the translation table. Primitive switches, not knowing how to handle the excess data, will 'fail open'. That is, it will revert to a hub and will broadcast all network frames to all ports. At this point generic network sniffers will work.
MAC Duplicating. It's not difficult to imagine that, since all frames on the network are routed based on their MAC address, that the ability to impersonate another host would work to our advantage. That's just what MAC duplicating does. You reconfigure Node B to have the same MAC address as the machine whose traffic you're trying to sniff. This differs from ARP Spoofing because, in ARP Spoofing, we are 'confusing' the host by poisoning it's ARP cache. In a MAC Duplicating attack, we actually confuse the switch itself into thinking two ports have the same MAC address. Since the data will be forwarded to both ports, no IP forwarding is necessary.