Saturday, March 5, 2011

How to sniff network traffic from another machine connected to the switch

Assume that there are two machines (A and B) connected to the switch. You want to sniff the network traffic between them with another box (Sniffing machine C) connected to the same switch. NIC of sniffing machine C (even when set to promiscuous mode) cannot see messages exchanged between A and B, because switch creates virtual connection based on the MAC addresses of these machines.

Assuming that you have privileges to configure switch, you can create port mirroring between switch port involved in the traffic (1 or 2) and sniffing port (3). 

Port mirroring allows you to copy network traffic from one port of the switch to another. For example you create port mapping from port 1 (Machine A) to port 3 (Machine C). Now you listen on machine C using promiscuous mode and you can see traffic between A and B boxes.

On Linksys/Cisco routers you can configure port mirroring by entering web setup of the box and navigating to the Admin -> Port Mirroring section.

Please note that some switches allow you to mirror more than single port to the monitoring one. Make sure that bandwidth of the single port can handle entire traffic from all ports mirrored to it. Otherwise your switch can go wild or refuse to handle any packages at all.

No comments:

Post a Comment