2

I have a Provantage FS526T; my understanding is that all traffic can be captured in this sort of setup:

Device -> HUB -> FS526T Switch -> LAN

Or if the Switch CAM table is flooded, so it starts acting like a HUB.

However if the LAN is not being used while the HUB is connected, is there any other way to capture traffic?

e.g. finding out information about the VLANS being used and then somehow joining a VLAN.

Apologies if the question is somewhat vague.

0
2
  1. Use a monitoring port on the switch (if the switch supports this, check out the Wireshark wiki for more details).

  2. Use a network TAP

3

Cisco switches use SPAN (Switched Port Analyzer) in which you can use commands as such:

Switch(config)# monitor session 1 source interface fastEthernet0/1
Switch(config)# monitor session 1 destination interface fastEthernet0/10
Switch(config)# end

There are often limitations as to how many ports can be "monitored" simultaneously.

You may be better off throwing a HUB like you mentioned, but you might as well get smart and learn a better way to do it

1
  • A hub is a quick way to do it, if a bad one (slow, half-duplex, etc.)
    – Ricky
    Nov 14 '14 at 23:52
0

I would like to add to this. A network tap will sit in-line and monitors all traffic passing in/out of your switch. However, it will need to sit between the switch and the router. If you don't have a simple port to port connection this becomes more difficult.

If you can, like suggested above, configure your switch to mirror all traffic to a monitor port then you can monitor all traffic on the switch that way. However, I believe there will be some data loss if the traffic becomes too much for the switch to handle (check your switch specifications for specifics).

Either way, you will need some software/hardware to view the traffic. I work for a company that develops NetScope, which works like a tap interface and sits in-line on your network. It will also monitor a mirror port on a switch.

http://turbosoftnetworks.com/blog/76-video-netscope-interactive-reports-with-historical-drill-down

There are some free programs out there that will do it. Some a Linux-based ones based on ntop.

http://www.ntop.org/products/ntop/

1
  • Cheers for the heads-up about ntop, looks good.
    – user
    Feb 7 '15 at 11:38
0

If your switch supports OpenFlow you can create flows to get you the data you want. This obviously depends on your switch. Port Mirroring was a much implemented feature and many lower cost switches still implement monitoring that way.

-1

If you want to monitor all trafic that is going through the switch, I guess you can use a network tap >> https://greatscottgadgets.com/throwingstar/. On the monitor station use something like wireshark.

If you want to monitor only one port, and you have access to that switch, use port mirroring.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.