How can I run a packet sniffer on a Router or Switch

eyanez111 · ‎09-15-2007

I have on my network several router 1700 series and switches Catalyst 2950 and I want to know how can I run ethereal on those babies to monitore what comes and goes

scottmac · ‎09-15-2007

The two most common methods would be (the old way) insert a hub (not a switch) in-line between the devices withthe traffic you wish to monitor or (the new way, for Cisco anyway) using port mirrroring.

A hub (not a switch) will repeat every pulse that passes on the line to the analyzer.

Since finding a new hub these days is virtually impossible (even some of the things sold as hubs are really switches), the more common way, at least in Cisco environments, is to "SPAN" (aka Port Mirroring) the port of the device whose traffic you'd like to monitor.

Here's the setup guide for a 2950:

http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_19_ea1/configuration/guide/swspan.html

Good Luck

Scott

avmabe · ‎09-17-2007

I recommend doing what the other poster said and span the port. I would not bother with a hub if at all possible.

Also, use wireshark and not ethereal. The guy that wrote ethereal broke out on his own and took the code to "wireshark".

guruprasadr · ‎09-17-2007

HI, [Pls Rate if HELPS]

May be the Routers and Swithes are Interconnected in the Network and you will have to connect the PC with Ethereal installed directly to the Switch with Network Connectivity (IP Assigned in the same Network).

Need to enable the Port Mirroring Feature on the Switch Port to Capture the Traffic.

Refer the Link Below for the Procedure:

http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/12ew/configuration/guide/span.html

PLS RATE if HELPS

Best Regards,

Guru Prasad R