1

I recently set up a small business network, and am constantly learning more about how networking hardware works. It is my understanding that a Layer 2 device (Dell 48 port managed switch in this case) will switch traffic based on Mac Address once it learns which devices live down each port. This way not every device in the network sees every packet (obviously broadcast and multicast can be exceptions to this). In this case, I have a Dell SonicWall router connected to the switch serving DHCP. On the SonicWall there is a packet monitor feature that lets you watch for packets originating from or going to a specific IP. If I ping one computer from another computer, both connected directly to the switch, I assumed the router shouldn't be able to see the traffic. However, the packet monitor can see each ping as it happens. How is this possible? All of the traffic in the switch can't be piped back down to the router. The switch as a 100+ gbps backplane and the router is connected over a single gigabit port. Networks would never work if every packet had to be forwarded to the router first.

  • When do you refer to "packet monitor", are you talking about switch, or router?? – Orlando Gaetano Jun 13 '16 at 21:10
  • The packet monitor on the router – Alex Nussey Jun 13 '16 at 21:15
  • So, when you configure the "packet monitor" function, router will only send you the packet that match that rule, and IF passes trought him. On your case, whe you have 2 PC connected to the router, and you tried a ping between then, router WILL NEVER see that PING, because there is no need to pass across him. Be other hand, if your switch if "packet monitor", there you will see what you want – Orlando Gaetano Jun 13 '16 at 21:36
2

As per this page:

The SonicWALL Packet Monitor feature allows you to capture and examine network traffic as it crosses your firewall. When activated, Packet Monitor logs the details of packets as they pass through the device, recording data such as the packet's origin, destination and port number. This in turn can help you to gain information about the conditions on your network and identify potential threats.

Given that you're using a layer 2 switch I'd say the two PCs your pinging between are on different layer 3 networks and therefore need to send their data to the SonicWall which is then performing the routing between the networks and monitoring the traffic at the same time.

  • Thanks! That makes sense, I guess they must be on different subnets or VLANs somehow. I will have to check again next time I head out to the site – Alex Nussey Jun 14 '16 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.