Sniffing out a 3524

[timpotter]

We have 3524, 3548, 2950 (SMI) and 3550 (SMI) switches. Can I sniff the traffic on all ports by plugging in to one of the ports? Or can I sniff traffic on one siwtch by being plugged in to another? I know I can't by default. What's the best way to set this up?

Thanks.

[steven-dunn]

Im sure you know which switches, the only frames you will catch are broadcasts. If your switch has VLANs, you will only catch broadcasts frames on that VLAN.

Cisco use what they call a monitor port. You can set a monitor port or SPAN port (the one where you plug the sniffer) to recive a copy of all other frames from a particular VLAN or port. The SPAN port can be on a remote switch with some switches called Remote Switch Port Analyser.

You need to configure the monitor port on your switch to catch all non-broadcast frames.

Note the syntax will be different accross your switches as they have different SPAN features, but this link will help:

http://www.cisco.com/en/US/products/hw/switches/ps628/products_configuration_guide_chapter09186a00800d84c5.html