Switch sniffer

Hi all,

I have a LAN network completely hooked up via some switches. The switches route traffic to a certain port based on the MAC address in the traffic.

What I want to do it to sniffer the traffic on my LAN network. Is it possible to configure a switch in such a way that all traffic going thru the switch is copied to my "sniffer" port on the switch? Or do I need a sniffer or some hubs on the LAN to archieve this??

Thanks in advance
Jamie

I seen a sniffer that claims it can go through switched networks yet Im not that convinced and I forgot the name.
On a cisco switch plug into a port with sniffer and enable port monitoring for all the ports. This is very intensive for the switch to do all ports but will work. Usualy you only monitor one port at a time. Port monitoring will have all traffic on one interface duplicate it under the monitoring port so you can unintrusively sniff. I know you can do this with just about every manageable switch not just cisco but their terminology is different.

I heard a linux utility called "hunt" can sniff on a switched network. Also there was an article on this here

http://www.neworder.box.sk/newsread.php?newsid=10388

higher end hp procurve switch aslo have 'port monitoring'

There is a program called ettercap that you can use to sniff on a switched network.. it is not very easy to use but you can always try it... both Win and Linux

Thats the one I seen Ettercap. Could not remember the name hehe. still easier to put the switches in port monitoring as a full sniff of a network consisting of only 10 minutes could generate a 100 Meg file to sift through with say 50 PCs. its more productive to go after a certain device like all traffic hitting the server.

Sounds good that there is a utility which can sniff on a switched network.

Will see if I can find the program (I guess it is not capture program you run in Ethereal?) - and mail a message when I know how this program works

Thanks
Jamie

dsniff

christo

Your original post was correct. To sniff a switched network you need a switch that is capable of mirroring traffic to one port.

If your switch is not capable of that you can sniff individual links by connecting a hub to a link, connect the original device and sniffer to the hub. But you will only see multicast, broadcast, and traffic to that device.

only because switches keep an arp cache to map mac addresses to IP's. If you use a mac-spoofing based A/V, you'll probably figure out what you want.. It's harder, but nothing's impossible

christo

Layer 2 switches do NOT keep a mac to ip address table. They do keep track of which mac layer addresses are on each port.

you're right - wasn't thinking there for a sec, but anyway...

christo

Was it Curly of the Three Stooges that said "I am trying to think but nothing happens". I know the feeling well.

I have no idea who said that, but I'm feeling like that a lot today - wrestling with Swing layout managers and trying to case-harden an app with some inane exception handling...

*sigh

christo