Thinking about getting a managed switch (question)

[latrosicarius]

Hi, Paul Adams was referring to a special port on a switch which can be configured for SPAN/mirroring using a program like Ethereal in this thread: http://forums.hexus.net/showthread.p...708#post794708

I'm thinking about buying a 24 or 48-port managed switch and I would like to make sure it has this ability.

Is there a special term that this is called so I can look it up in the product specs of switches to see if they have it or not?

Thanks!

[geezerone]

Port Mirroring or Monitoring is what you should be looking for, but Ethereal is a program running on a client connected to one port on a switch/hub and so the program itself will not accomplish port mirroring which you are looking for and has to be a requirement on the switch you are to purchase.

[latrosicarius]

Thanks... so If I get a switch with Port Mirroring / Monitoring, I won't need Ethereal to analyze ports & packets?

Thanx

[Moby-Dick]

it depends on your LAN structure as to where you want to sniff traffic.

eg if you want to sniff web trafficc you just need to connect a hub between the mcore switch and the router , then connect your sniffer to there

[latrosicarius]

hmm... then what's the purpose of getting a switch with Port Mirroring/Monitoring?

[badass]

hmm... then what's the purpose of getting a switch with Port Mirroring/Monitoring?

Mobys way as he said is only good for monitoring internet related traffic. With port mirriring you can see what goes on between all nodes connected to the switch. i.e. what teh computers are saying to each other. Its usefull for troubleshooting network problems.

[geezerone]

Port Mirroring - a function that copies packets sent or received on a specific port to another port. A monitoring device such as Sniffer or Rmon probe can be attached to a port to analyze the details of the packets that pass through the source port.

[latrosicarius]

...With port mirriring you can see what goes on between all nodes connected to the switch. i.e. what teh computers are saying to each other. Its usefull for troubleshooting network problems.

Yes, this is what I want. I want to be able to detect problems within the network, such as a faulty cable on one of the clients that's causing packet resends, etc.

I'm sorry, I'm such a noob, but can you please clarify: to do this, I will need the following, right?
- a switch with Port Mirroring
- a client PC attached to that port with a cross-over cable
- Ethereal or another port analyser program installed on that client

Thank you for your patience, everyone.

[geezerone]

You wouldn't need a crossover cable if connecting to a port on the switch from a client PC. only need a crossover cable when skipping a OSI layer, i.e. layer 1 PC connection to layer 2 switch doesn't need a crossover cable BUT if connecting to a router (layer 3) from a PC you would.

A switch port acts as its own collision and broadcast domain where as a Hub is basically a repeater and has just one collision and broadcast domain for the whole Hub so if you want to monitor traffic on a hub just connect to any port and analyse all traffic. A switch with mirroring enabled will provide your network sniffer with ALL the information the suspect client machine is TX/Rx and useful in troubleshooting. Before going down this path try swapping cables/ports first.

[latrosicarius]

Thanks mate

[latrosicarius]

Sorry I have to ask this:

I see a switch that supports "Port Mirroring", but there is no special port designated for this.

Where do I plug the client with Ethereal into?

I'm sorry!

Thanks

[latrosicarius]

NEVERMIND, I was able to download a manual for one of the switches... Apparantly, you just go to the web configuration and specify which port you have your sniffing client hooked up to.

Sorry for the bump!

[geezerone]

Yep, port mirroring has to be flexible as allows most efficient use of switch but glad u found the info.