2

There is a switch-based LAN without encrypted traffic. I want to sniff ALL its traffic (ARP, TCP, ICMP, etc.) by plugging the laptop into one of the switch port. Then run the software on the PC to sniff the network traffic.

Of course I will provide an authorized IP address to my laptop. It is an authorized test in lab environment.

How can I do the sniffing? What sniffing software should I use?

Improve this question

1 Answer 1

Reset to default
4

The easy part: Use Wireshark for the sniffing.

The hard part: In a switched network you need support from the switch to get all the traffic. It is called "port mirroring", "span port", "monitor port" depending on the vendor. Without control over the switch you will not be able to capture all traffic.

Improve this answer
4
  • This switch has only one connected port. Previously, I sniff in this way: unplug that port, and put laptop (running Wireshark) in between and reconnect both sides. The two RJ45 ports of laptop were configured as one IN and one OUT. This method works. However, it changed the original network connection. This is why I want to directly plug the laptop into a new switch port to sniff. However, the Wireshark has no response.
    – TJCLK
    May 24, 2016 at 9:44
  • 1
    I'm not sure I understand but if you want to sniff traffic from any other port on the switch my answer still stands. You need to configure a mirror port on the switch.
    – Sebastian Wiesinger
    May 24, 2016 at 9:51
  • I see. what about a ARP spoofing tool?
    – TJCLK
    May 24, 2016 at 10:05
  • 2
    That would disrupt network traffic and will not capture all traffic. Really you need to configure the switch. If this is a lab environment this should be easy to do.
    – Sebastian Wiesinger
    May 24, 2016 at 10:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.