To do sniffing using Ethereal

cindylee27 · ‎03-21-2007

Hi All,

I would like to do sniffing on a switch where the server connected to check the traffics to the server. How can I achieve using Ethereal and the configuration on the switch?

Thanks!

Jon Marshall · ‎03-21-2007

Hi

You need to span the switch port that the server is on to a second port. Connect your PC into the second port and run ethereal and you will see all traffic destined for server.

Don't know which model of switch you have but if you do a search on Cisco site for make of your switch and span you should get the config docs eg. "3550 span".

Alternatively, if the server is a W2K server could you not use the Network Monitor tool that comes with the Windows Service Pack. Or load ethereal onto your server. Both of these would mean you didn't have any config to do on the switch.

HTH

Jon

Amit Singh · ‎03-21-2007

Please use the link below for SPAN configuration on 3560 switches.

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3560/1225sea/3560scg/swspan.htm

Please use the ethereal on your destination port connected PC where you want to monitor the traffic.

-amit singh