How can I run a packet sniffer on a Router or Switch

Unanswered Question
Sep 15th, 2007

I have on my network several router 1700 series and switches Catalyst 2950 and I want to know how can I run ethereal on those babies to monitore what comes and goes

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
scottmac Sat, 09/15/2007 - 12:52

The two most common methods would be (the old way) insert a hub (not a switch) in-line between the devices withthe traffic you wish to monitor or (the new way, for Cisco anyway) using port mirrroring.

A hub (not a switch) will repeat every pulse that passes on the line to the analyzer.

Since finding a new hub these days is virtually impossible (even some of the things sold as hubs are really switches), the more common way, at least in Cisco environments, is to "SPAN" (aka Port Mirroring) the port of the device whose traffic you'd like to monitor.

Here's the setup guide for a 2950:

Good Luck


avmabe Mon, 09/17/2007 - 05:35

I recommend doing what the other poster said and span the port. I would not bother with a hub if at all possible.

Also, use wireshark and not ethereal. The guy that wrote ethereal broke out on his own and took the code to "wireshark".

guruprasadr Mon, 09/17/2007 - 21:09

HI, [Pls Rate if HELPS]

May be the Routers and Swithes are Interconnected in the Network and you will have to connect the PC with Ethereal installed directly to the Switch with Network Connectivity (IP Assigned in the same Network).

Need to enable the Port Mirroring Feature on the Switch Port to Capture the Traffic.

Refer the Link Below for the Procedure:


Best Regards,

Guru Prasad R


This Discussion