General discussion

Locked

packet sniffing on a switched network

By Jas03 ·
I'm trying to user a packet sniffer to test my networks traffic from my computer. My network is all controlled by one switch. I used to be able to do it when I had a hub but not after we put the new switch. Is there a way to packet sniff without having to rewire (so i'm between the router & the switch)or put a hub on the network?

This conversation is currently closed to new comments.

5 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

packet sniffing on a switched network

by bcbvale In reply to packet sniffing on a swit ...

On a Cisco switch you can configure SPAN. The exact configuration required is different for each model of switch but if you do a search on CCO for SPAN you should be able to find a configuration for your model of switch.

If you are not using a Cisco switch then you will need to consult your vendors documentation or maybe someone else will know.

ChrisV

Collapse -

packet sniffing on a switched network

by Jas03 In reply to packet sniffing on a swit ...

Thanks for your time
I have a 3com switch

Collapse -

packet sniffing on a switched network

by Joseph Moore In reply to packet sniffing on a swit ...

The differences between switches and hubs. That is what is going on.
When you use a hub, all ports on the hub are members of the same "broadcast domain", meaning all packets are sent to all ports on the hub. So, when you open a web page on a machine connected to the hub, the outbound HTTP GET request your browser makes is first sent to ALL ports on your hub! Therefore, when you run a sniffer on a hub-connected machine, you can see this HTTP GET request, because all ports receive all packets.
On a switch, each individual switch port is its own broadcast domain, meaning the packets in port 1 are NOT sent to all 24 ports on the switch. The packets are forwarded to the correct port on the switch.
Switches are much better in this respect. Less chatter, less latency, faster.
This is why you can't sniff while plugged into a standard switch port. All you see is your own traffic.

Like the previous answer said, you need to setup a Span port on the switch. A Span port is a specifically configured port that can hear all packets on every switch port. This Span port will not allow regular communications from/to it. You can't PING from a machine plugged into a Span port. All you can do is listen on it.

Check your 3Com switch manual onhow to set up a Span port. This will involve configuring the switch, either through a Telnet session or a console cable.

If you have NEVER configured your switch (and I am gonna assume this is the case) then you will have to do several steps before you can set up the Span port.

Good luck.

Collapse -

packet sniffing on a switched network

by Jas03 In reply to packet sniffing on a swit ...
Collapse -

packet sniffing on a switched network

by Jas03 In reply to packet sniffing on a swit ...

This question was closed by the author

Back to Networks Forum
5 total posts (Page 1 of 1)  

Related Discussions

Related Forums