3

Example: Network of company A has 5 VLANs: Accounting, IT, Guests, Servers, Board.

All VLANs has DHCP servers enabled in their own VLANs. I am monitoring a single VLAN for DHCP packets by connecting my own PC into one of those networks. Using Fingerbank API (to fingerprint devices using DHCP packets) I can happily fingerprint those devices using above API to get knowledge what kind of device it is.

But I wish to have a single computer be able to see ALL broadcast packets from ALL VLANs. I know I can use SPAN for receiving mirror of network traffic, but I am not sure whether it is possible to see ARP/DHCP packets aswell. Any solution to this case or I have to use 1 VM for 1 VLAN separately?

I cannot imagine doing this within a company having 30 or more VLANs just to monitor DHCP packets.

For reference I use Cisco switches.

2

By far the easiest solution is a single DHCP server (cluster) for all VLANs. Use switches or routers (helpers) to relay DHCP requests to the server and monitor all requests there.

Using a hypervisor, you could also use a single machine attached to every VLAN using a dedicated vNIC for each. Depending on the hypervisor you could alternatively set up a port group monitoring all VLANs.

Edit: All mirroring/monitoring port solutions without filtering can potentially overwhelm the monitoring port. In best case, the capturing machine just misses DHCP request. In worst case, other important traffic is lost (e.g. on a virtual host with a shared downlink).

  • So using SPAN port won't help me, because it won't ever see the broadcast traffic? Means broadcast packets wont reach my sniffing device? – RedS Jan 4 at 21:35
  • SPAN should work as well. However, all mirroring/monitoring approaches without filtering have a potential bandwidth problem. – Zac67 Jan 4 at 21:45
  • But will I be able to see DHCP/ARP packets aswell via SPAN? I have never used it – RedS Jan 4 at 22:19
  • SPAN mirrors all traffic from the monitored port(s) to the mirror port, including DHCP and ARP. – Zac67 Jan 5 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.