asked on

How to capture all traffice on a network without disruptions.

What is the easiest way to capture all traffic on a network, lets say for 8 hours (9-5)? In the days of hubs this would be easy, just plug your laptop into the hub, but nowadays with switched Ethernet you cannot see all traffic from the switch. I guess then you have to somehow get between the switch and the dsl modem (or T1 access device). How do you do that without disrupting traffic?

ASKER CERTIFIED SOLUTION

Kalpesh Chhatrala

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

lcappelli

Port Monitoring on a Cisco Switch:

You do not say who makes the switch, on a cisco switch you can have every port's traffic mirrored to a single port, without disrupting any traffic, just cpu cycles, and put a laptop with wire-shark on the mirror port and sniff every frame, just like a hub used to!

This feature is called Catalyst Switched Port Analyzer (SPAN)

here is more info

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml

nomorefuzzylogic

or you could connect a hub followed by a switch to one port on your Internet router and then a PC onto the hub. All traffic will then come out of the one port on the Internet router through the hub to the switch which will then split the traffic. Your PC on the hub will be able to see all the traffic.