Why sniffer can capture packet on switch

epmahc1
epmahc1 used Ask the Experts™
on
I use cisco 2900 seriesXL . After i ran Sniffer Pro
I can see packet from A to B , but my computer is C
There're many kind of packet http icmp
but there's some notice that this event is one-way
means A send to B but B not reply.......
I set nothing on switch...

Is switch becomes hub ???
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Sr Manager Cloud Networking Ops
Commented:
So you set up a monitor port on the 2900? It sounds as though you might only be seeing traffic actually destined for the port you are plugged into or broadcast traffic.

Also, you won't be able to see the transmit traffic for the Sniffer Pro machine.

Steve

Commented:
A switch does not mirror all traffic to all ports like a hub.  Once the switch learns the layer 2 address for the devices hanging off of it, it will only forward unicast traffic to the port where the destination node is located.

If you want to capture the traffic on the entire switch, you need to configure a SPAN port.  Keep in mind that SPAN ports can only span ports within the same VLAN.  If you have more than one VLAN configured on your switch, you will need a seperate SPAN port.

Bryan
Les MooreSr. Systems Engineer
Top Expert 2008

Commented:
G'day, epmahc1
No comment has been added lately (114 days), so it's time to clean up this TA.
I will leave a recommendation in the Cleanup topic area for this question:

RECOMMENDATION: Points awarded to: SteveJ

If you would like to keep this question open for more expert input, this cleanup effort will get it closer to the top of the list where it will get more visibility for the experts.

Please leave any comments here within 7 days.


PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!

Thanks,

lrmoore
EE Cleanup Volunteer
---------------------
If you feel that your question was not properly addressed, or that none of the comments received were appropriate answers, please post a request in Community support (with a link to this page) to refund your points. http://www.experts-exchange.com/Community_Support/

Per recommendation, force-accepted.

Netminder
EE Admin

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial