A router/switch with a port that receives ALL packets

I've heard that they make routers and/or switches that have a special port on them that recieves ALL network traffic.  THis would be for using with a packet sniffer.  Does anyone know of an inexpensive router/switch with this type of port?  What is this type of port called?

Also, anyone recommend an inexpensive software that will monitor all network traffic when connected to this port?

Bottom line:  I need a router/switch with a "receive all" port and some software...cheap.  (yeah, right)
markefarisAsked:
Who is Participating?
 
getzjdCommented:


You need a switch that supports what is called "port mirroring "
You did not state how many port you need so it is hard to make a recommendation.

Here is a short list of switches http://www.effetech.com/sniffer/faq.htm

Tcpdump, WinDump, and Ethereal are 3 open source sniffers you can use.
0
 
grahamnonweilerCommented:
If all you want to do is monitor traffic on your network then you don't need to change your router - just download and install Wireshark (free) on to one of your internal machines then let it monitor whats going on on your network.

Wireshark a recognised network traffic analyzer and will report on all traffic/ports/protocols in the same subnet as the monitoring machine. Nothing else to add to your existing network and far easier than installing a managed router with monitoring firmware!

For more information and download: http://www.wireshark.org/
0
 
getzjdCommented:
You cannot simply just use wireshark in a switched environment.  If you have a hub, then go for it.  Otherwise you need a switch that supports port mirroring
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

 
getzjdCommented:
If you use wireshark in a switched environment with no port mirroring then all you see is your PC traffic and broacasts
0
 
grahamnonweilerCommented:
"If you use wireshark in a switched environment with no port mirroring then all you see is your PC traffic and broadcasts" - this is not strictly correct as the ability of Wireshark to see network traffic is dependent on the type of NIC in place on the monitoring PC  and whether you are in a "managed" or "un-managed" environment.
0
 
getzjdCommented:
You basically stated what I already stated.  Managed or unmanaged is no different that saying a switch that supports port mirroring and one that doesnt.   Yes your network card may not support it, but if it does and you are in a switched environment you need a switch that supports port mirroring  as well... period.   Port mirroring to my knoweldge is ONLY found on managed switches.  I would venture to say that not every single managed switched provides port mirroring...
0
 
markefarisAuthor Commented:
Thanks graham... for the wireshark link.
and thanks getzjd for recognizing that I was using a switch (which would not broadcast to all ports) and for the link of switches that have port mirroring (and for defining port mirroring).
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.