Security

Ask something
Discussion Locked

Monitoring Network Traffic on a Switch.

0 helpful
7 replies

by secadmin 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Is it possible to monitor all network traffic on a switch on all ports with one sensor connected to one port, without mirroring ports?

There is company that claims they can monitor network traffic on all networks connected to a switch with one sensor occuppying one port. Basically, they claim this port can see all traffic destined for other ports.

My understanding of a switch is a port only sees the traffic that is destined for it. This company defies this rule with their claim.

I am relatively new to network security, so any comments are appreciated.

Thanks

7 replies

by Former member

My understanding is that the switch would still look at all of the traffic. Whether it would forward or otherwise use the trafic it monitored is a different issue. On the other hand beware of companies who claim that they can do everything. It is not unusual for claims such as this to be not much more than vaporware.

by infosecgeek

In 3Com switches you can enable what they
call "Roving Analysis".
This feature allows you to choose a monitor port that will listen the traffic of the other ports that you specify through
the command line interface.

I hope this helps.

Gaston.

by erdo

It is not only possible, but I have done this in two different ways.

First, the simplest way is to set one of the ports of the switch as a monitoring port. Depending on the switch type, a comand is issued to the switch to set a port to monitor, jumpers are set on the switch, or in some switches there is a built-in monitor port. Just hook the analyzer to that port and it will see all traffic passing thru the switch.

The second method requires some hacking. The switch associates each host'sMAC to a port. If you write a clever program which dynamically changes the ARP cache, you can trick the switch to think that every MAC is at your own port. You also need to forward the frame/packet back out to the original destination. Depending ontraffic volume and the type of switch, this method does not necessarilly yield the best results.

Switches can be tricked to relinquish their data to any port. Ask the manufacturer what technique they use and what is the induced overhead. Performance will be affected when monitoring traffic by either method above.

This discussion is closed to new replies.