SNIFFER 4.5

[78mike78]

i am running Sniffer 4.5, in a network with one netscreen router/firewall, and 8 switches, total 200 devices.
Is there a way i can see packets sent/recieved from one computer back and forward..another words, is there a way i can monitor one computer without having sniffer installed on it, running it from my PC

 

[jdavis1]

I think what you are asking is if you can capture traffic to and from a particular host using a separate device. That depends on the capabilities of your switches. You need to be able to mirror the traffic from the monitored host on another port on the switch / network. Most enterprise class switches have this capability. With Cisco IOS based switches, this is known as SPAN (Switch Port ANalyzer) or port monitoring. On older switches, your network analyzer had to be connected to the same switch as the device you want to capture from. Newer switches have the capability to perform RSPAN (Remote SPAN), a feature that allows you to send data from a port anywhere in the LAN to a network analyzer located somewhere else in the LAN.

Is that what you are asking or am I totally off the mark?

 

[78mike78]

Absolutly, thanks. i was looking to capture traffic from a server to all workstations. I am using sniffer 4.5.
How do people capture packets on the internet to hack email addresses. Do they get access to the switchs? I am not asking this to hack, this is only for informational.

 

[jdavis1]

The only way you can capture traffic on any network is to put a packet capture device where the traffic is flowing. So you would need to get access to ISP network devices in order to do this. I'm not sure that is how people "hack" email addresses. It would seem that there would be easier ways to do that.

 

[78mike78]

Yeah, i am not really trying to hack any email addresses, i was trying to figure out how people hack/sniff packets to get information and how they reroute packets so that they can respond to requests,..example dns hacking, when a computer asks for a request they catpture and respond with their own respond.

 

[jdavis1]

A simplistic but understandable explanation:

http://www.securesphere.net/download/papers/dnsspoof.htm

 

[78mike78]

Thank you.