packet monitoring

[Fred Martin_1]

Some time ago, I was using software that sniffed packets on my network, and presented a graphical screen that showed all the NICs on the network, with lines showing which hosts were talking to which. It also gave reports showing which NICs were sending the most packets, receiving the most, etc.

Over time I've gone to a switched network, and now the switches hide all that traffic; the software only reports what it can see.

The question is, is there still a method for me to monitor the same thing, on a switched network?

It helped me pinpoint bad NICs, network-noisy software and bad users, and I really miss it.

[Ron Kinner · Accepted solution]

Depends on the switch but some of them have a method of sending traffic destined to other ports to an admin-designated monitor port. Usually, tho, this monitor port can not be a participant at the same time so the PC would have to be dedicated to just that one purpose.

On a Cisco switch the basic feature to allow you to monitor another port is called Switched Port Analyzer (SPAN) (an unfortunate choice of name since it gets confused with spanning tree which is something else entirely) however, this is limited to only one port. To be able to monitor multiple ports (they have to be in the same VLAN) you need to have a switch and a version of operating software that can do Enhanced SPAN (E-SPAN).

Ron