Sniff a Rounter?

[jkeeper]

Hello, Is it possible to Sniff a 3810 and how different is it from Sniffing a switch?

Thanks

JKeeper

 

[marsd]

Yes and very different.
Without the aid of a switch with a monitoring port you
will have to use one of the assortment of snooping tools
that are used by crackers,script kiddies(and admins ) when they get local or some other non-free offering.

 

[jkeeper]

Thanks for the quick reply, now do you have any suggestions
of tools or where to look for them?

-James

 

[chriz]

Hello,

What do you want to sniff exactly ?

If the router is behind a switch and this one have a mirror port or snmp capability you can look at the traffic with any good analyser (sniffer,observer,ethereal...etc)

If you want to see what are exactly in the router (dropped packet, routing tables...etc) you can simply screen it via telnet or console ports.

Christophe.

 

[marsd]

There are a bunch of offerings for switched networks.
dsniff is okay, hunt is another, but this is really
kind of a dirty last ditch approach IMO.
As chrisz asks: maybe there is antother way to do what you want?

 

[jkeeper]

OK, here is the deal, This remote location had two T1's, had, and since one has been removed the users are screaming
that they need the other T1. It was removed for cost reasons.
The T1 connects to a 3810 which connects to a 2900 switch.
I have to monitor the traffic to see if it can be valedated one way or the other that they keep two T1s or not.

I was told to monitor the traffic comming off the 3810 port
to a 2900 switch and I would get the data needed.

I am thinking that I need to monitor the traffic coming and going from the 3810 using Sniffer Pro 4.5????

-James

 

[jkeeper]

OH yes! We are 97% Cisco and Windows NT 4.0 / some WIN 2000.

James is Jkeeper