Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
You may experience some slow load times, errors, and slight inconsistencies. We ask for your patience as we finalize the launch. Thank you.

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Sniffing out a 3524

We have 3524, 3548, 2950 (SMI) and 3550 (SMI) switches. Can I sniff the traffic on all ports by plugging in to one of the ports? Or can I sniff traffic on one siwtch by being plugged in to another? I know I can't by default. What's the best way to set this up?


  • Other Network Infrastructure Subjects
New Member

Re: Sniffing out a 3524

Im sure you know which switches, the only frames you will catch are broadcasts. If your switch has VLANs, you will only catch broadcasts frames on that VLAN.

Cisco use what they call a monitor port. You can set a monitor port or SPAN port (the one where you plug the sniffer) to recive a copy of all other frames from a particular VLAN or port. The SPAN port can be on a remote switch with some switches called Remote Switch Port Analyser.

You need to configure the monitor port on your switch to catch all non-broadcast frames.

Note the syntax will be different accross your switches as they have different SPAN features, but this link will help: