How to configure/setup sniffer 4.5 under switch environment

[14111411]

Hi sniffer Experts,

I used Sniffer PRO LAN v4.5 with Intel PRO/100+ NIC which supported promiscuous mode under Windows 2000. I connected sniffer machine into one of the ports on Intel 510T switch. Sniffer captured ONLY broadcast and multicast traffic.

Any advice/instruction on how to config/setup a Sniffer so Sniffer can capture all traffics on LAN will be highly appriciated.

Thank you very much in advance.
Ninh Nguyen

 

[JohnCarlson]

As with any switched environment, only broadcasts and traffic destined for your Sniffer's DLC address will be passed to the port the Sniffer is connected to unless the swicth is configured to mirror a port (or possibly a VLAN) to the "Sniffer" port.

I don't know the capabilities of the swicth you mentioned, but I would start there. Does the unit work in a shared media environment?

 

[14111411]

Heloo PghSE,

First of all, thank you very much for your quick response.

I'm not very sure what "a shared media environment" means. However, I connected a machine running Sniffer into one of a VLAN ports on a switch. I configured a switch as only one 24-port VLAN. Sniffer machine reside on the same VLAN I want to monitor.

Many thanks,
Ninh Nguyen

 

[JohnCarlson]

Ninh,

Sorry about that. A "shared media environment" could mean ethernet hub, ethernet coax cable (remember those?) or Token Ring MAU. Not many of those around, but a cheap, no - make that small, hub is great to have around. I use mine for testing Sniffers and inserting into a link when you don't want to ask a switch to SPAN or port mirror.

Understand that although Sniffers are certainly aware of VLANs, they are in no way tied to a VLAN. (What if you were analyzing IPX or SNA?) Just because two devices are in the same VLAN does not mean they will see identical traffic.

You need to understand the capabilities of the switch you are using, as it relates to port mirroring, or port monitoring, or whatever that vendor calls it.

In checking the web for you, Black Box corp reports in a fax back documemt 23018, at

http://www.blackbox.com/faxbacks/23000/23018.PDF

that the unit DOES support "Port Mirroring". There's your task to learn! Hope this helps! John Carlson
Sr Systems Engineer
Sniffer Technologies

 

[jkeeper]

Hello all members,

I mostly monitor this site so I can learn from you all. I must say, of all the sites I am a member of or that I visit. This is the most helpfull, most professional and the most helpfull. I want to thank the producers of this site and all of you for being here. Thank you.
This site "Rock".

Jkeeper